HPC Workload Series Free and Shared Basic Serverless compute service Azure Container Instances (ACI)

Availability Set Basic • One ACI = one Docker container

• 2 fault domains for classic
• A8-11 General purpose • Ideal for development, testing, and non-critical work Event-driven actions and triggers
• N Graphic GPU optimised • Up to 3 instances (manual) • No SLA • HTTP-based API endpoints (HTTP triggers) • Role Based Access Control (RBAC)
• 3 fault domains for Resource Manager deployments Standard • Short-running workloads
• H High performance computing Standard • Timer triggers
• 5 update domains Up to 10 instances (auto scale) Azure Container Services (AKS)
Scale Set HPC Pack • • Ideal for production and cost effective Programming Languages
• Windows Server 2012, 2016, and Linux • 5 Slots • Data replication between two nodes • C#, F#, Node.js, Java, PHP, PowerShell, Batch, JavaScript, • Load balancing
• Max 100 VMs • Daily backups • Orchestration
• Create HPC clusters on-prem • High availability SLA Python, Typescript
• Max 1000 VMs with placement groups (auto scale) • Azure Traffic Manager • Long running workloads
Azure Batch Premium Plans
• Managed disks needed for large scale sets Premium
• Most cost-effective option for scientific calculations • Redis persistence • Consumption App Service Plan (cost effective)
VM Series Cloud-native HPC solution • Up to 20 instances (auto scale)
• A0-7, Av2, B General purpose • Create workloads > 53GB • Other App Service Plans
• HPC head node and compute nodes • 20 Slots • Ability to isolate
• F Compute optimised • Daily backups
• Virtual Machine Scale Sets (VMSS)
• D,E,G Memory optimised • Azure Traffic Manager
• VMs using RDMA are placed in same VMSS
• L Storage optimised Isolated
• Virtual Network
• N Graphic GPU optimised
• Azure Blob Storage for node disks • App Service Environment (ASE) – scalable, secure Cloud Infrastructure Ready
• H High performance computing • Up to 100 instances/plan or 100 plans with one instance • Host on VMs as-is
Join VMs to domain Hybrid HPC solution
+ ExpressRoute to connect cloud with on-prem Service that exposes different apps as APIs Cloud DevOps Ready
• Enable Azure AD Domain Services • Use containers to develop and deploy
+ VPN Gateway endpoint between cloud and on-prem API Gateway • Decouple application from infrastructure
• Bridge between app and outside world Cloud Optimised
• Enhanced security, policies, authentication
• Modernise mission critical application
• Caching, throttling
Routing methods API Management Portal
• Performance, Weighted, Priority, Geographic • Define custom APIs
Handle load & locate closest geo region at DNS level • Package APIs into open or protected products
Developer Portal
• Developers can access APIs and documentation
Up Orchestration Platform
• Select different (better) Service Plan • Cloud and on-prem
Out • Container orchestration
Hybrid Connections Data-integration service • Scale out Web App manually or automatically Lifecycle Management
• Establish a rendezvous point in the cloud • Create workflows to automate data move + transform • Service developer (creates microservices)
• On-prem app connects using HTTP/ Sockets to cloud • Connect to ML, HDInsight, Data Lake Analytics Workflow Driven • Application developer (creates applications)
WCF Relays (Service Bus Relays) • Data sent over HTTP using certificates Integration with cloud and on-prem services • Application administrator (creates config & packages)
• On-prem app uses WCG bindings to connect to Srv Bus • No firewall ports need to be opened • BizTalk, … • Operator (deploys, monitors, maintains)
Multiple programming languages
• ASP.NET, Core, Angular, React.js, Java, Python
Securing Web API
• Azure AD
• Azure AD B2C – with Facebook and Google providers
Enables access from app to other services • Active Directory Federated Services (ADFS)
Connects Azure and on-prem applications using TCP Cache static content to multiple regions • API Management – policies, API keys, throttling, …
• Deploy app inside a VNet
• Uses Azure Relay Service
• Access services within same VNet (VMs, DBs, …)
• Part of App Service and is a separate Azure feature
• TCP or UDP

Access on-prem web apps from the cloud

•
•
•
Provides single sign on (SSO) + secure remote access
Connector – lightweight agent on on-prem server
External endpoint – direct URL or access via MyApps
Bridge between on-prem data sources and Azure
• Uses Service Bus
• Azure -> Analytics, Logic Apps, Flow, Power Apps, …
• On-Prem -> SQL Server, SQL Analytics, SharePoint, …
Architecting Microsoft Azure Solutions 1

Provides central repository Cloud Service for big data processing and analytics General-purpose v1 Unstructured data – VHDs, images, audio, etc. VNets Load Balancing
• One catalog per tenant • Data pipelines, activities, datasets, linked services, triggers, • Classic, does not support latest features. • Max 1TB page blob, 200GB block blob • Max 50 VNets per subscription • Transport Layer 4
• Sources – Blob Storage, Data Lake, QL Server, Oracle, … pipeline ru, parameters, control flow General-purpose v2 Access tiers Subnets • Any protocol
• Available in - East US, East US2, West Europe • Newest, that combines v1 and blob storage • Hot – optimised for frequently accessed data • Max 1000 subnets per VNet • Azure VMs and Cloud service endpoints
• Latest features at a reduction in costs • Cool – Suitable for backups and not often viewed data • Max 10 VNet connections (peering) per subscription • VNet: Internet and internal facing
Blob storage • Archive – set at blob level, cannot be read or modified Pubic Address • Endpoint monitoring: Supported via probes
• Same features as storage v2 acc, but only block blobs. • Max 60 public dynamic addresses per subscription Types
Replication (X redundant storage) • Max 20 public static addresses per subscription • Basic
• Locally – 3 copies within data center Private Address • Standard … up to 1000 VMs, HA ports, and NSG.
• Zone – US East 2 and US Central, 3 datacenter copies • Max 4096 private addresses per VNet
• Geo – three regional copies
DNS
Big data storage and analytics service • DNS for multiple VNets requires own DNS server
• Based on Hadoop Yes Another Resource Negotiator (YARN)
• Solutions - Store, Analytics, and HDInsights Semi-structured, non-relational data
Massive Parallel Processing (MPP) Data Lake Store • Suitable for datasets without complex joins
• Uses Hadoop/Spark and Machine Learning for insights • Access via OData and LINA queries
• Storage repository for big data workloads
• Uses Data Movement Service (DMS) between nodes • Max 500TB data Gateway
• Unlimited structured, semi-, and unstructured data
Data Lake Analytics • DNS level
• Uses serverless approach • Application level 7
• Pas-as-you-go, monthly commitment Create file shares in the cloud • HTTP and HTTPS
• Uses U-SQL to analyse the data • Access with Server Massage Block (SMB) protocol Traffic management • VNet: Any public or internal IP address
• Cached fast access on Win Server using Azure File Sync • DNS level • Endpoint monitoring: Supported via probes
HDInsights • Any protocol
• Deploys Hadoop components in form of clusters in cloud SSL
• VMs, Cloud Service, Web Apps, and external endpoints • SSL off loading to avoid costly decryption
• Opensource service for analysing and processing data • VNet: Internet facing
• Apache Hadoop, Spark, HBase, Storm, Kafka, Interactive Q Asynchronous processing of messages Firewall
• Endpoint monitoring: HTTP/HTTPS GET
• Microsoft R Server • REST.API supports GET, PUT, and PEEK • Web Application Firewall (WAF)
• Messages max 64KB and max 7days lifetime
Load balancing
• Use with load balancer for high-avail and high-per
Same architecture as SQL Server Analysis
• Enterprise grade data modelling in the cloud
Integrated storage spanning on-rem an cloud
• iSCSI and SMB support
StorSimple Virtual Array
Open source relational database • Hyper-V 2000 R2 and VMWare 5.5
Azure VPN
• Used by PHP developers, CMS WordPress • iSCSI server (AN) or File Server (NAS).
• Basic – max 10 site-site, 128 point-site, avg 100Mbps
• ACID, replication, Performance, security, extensibility, StorSimple 8000 Series Used for VMs stored in Az Blob storage as page blobs. DMZ • VpnGw1 – max 30 site-site, 128 point-site, avg 650Mbps
concurrency, JSON support • Leased physical device • Standard – unmanaged HDD disk drives. LRS and GRS • Network Security Groups (NSG) • VpnGw2 – max 30 site-site, 128 point-site, avg 1Gbps
• Pricing • Virtual Appliance Manager replicates data to cloud redundancy only. • User Defined Routes (UDR) • VpnGw3 – max 30 site-site, 128 point-site, avg 1.25Gbps
• Basic – 1TB, 4 CPUs, locally redundancy • Premium – SDD, high-performance disk support • Firewalls
• General Purpose – 1TB, 4 CPUs, local+geo redundancy Site-to-site
Network Security Groups • Requires Routing and Remote Access Service (RRAS)
Relational database • Memory Optimised – 1TB, 5 CPUs, local+geo red. • Inbound and outbound rules
• Elastic Database Pools (eDTUs) • Internet Protocol Security (IPSec) connection
• Checked between VMs, VNets, and other services • Internet Key Exchange (IKE) management protocol
• Individual databases (DTUs) Applied to one or more subnets or network interfaces
• High availability, geo-replication, failover groups
• Point-to-site
• Low order numbers are higher priority • Connect IKE2 or Secure Socket Tunneling Protocol (SSTP)
• Backup and Recovery
• Basic – 7 days retention
User Defined Rules • No RRAS device required
• Create UDRs & IP forwarding by creating a routing table VNet-to-Vnet
• Standard and Premium – 35 days
• Restore - Point-in-time, deleted DB, Geo, and Az Rich search experience over Azure storage Virtual Network Service Tunneling • Max 10 VNet connections (peering) per subscription
Premium Azure Table Storage • Force external traffic through a site-to-site VPN tunnel
Recovery Vault • Multi-model and globally distributed database • SQL Database, CosmosDB, Blob Storage ExpressRoute
SQL Server Stretch Database Open source relational database • Low latency, high availability, high performance • Text search, analysis, and linguistic analysis Web Application Firewall • Any-to-Ant (IPVPN) – provider sets up secure connection
• Move or archive cold data from on-premises SQL Server to • Open Source, ACID, Replication, Performance, Security, Tiers • Part of Application Gateway and based on OWASP 3.0 • Point-to-Point Ethernet –two provider connections
Concurrency, JSON, JSON Indexing, Extensibility APIs • Can protect max 20 applications behind an App G/W
Azure SQL • SQL, MongoDB, Gremlin (Graph), Table, Cassandra • Free, Basic • Co-Located at Cloud Exchange – two cross connections
• Standard S125GB,50 indexes, S2100,200/S3200GB/HD1000 indexes • Examples: SQL Injection, Cross-Site Scripting, Bots, … • Maximum 10GB

AJATO Transformations Limited | 2018.09 | github.com/wpschaub/Quick-Reference-Posters

Directory and identity management Synchronise on-prem AD identities with Azure Store cryptographic keys and secrets Security for data in transit, rest, and in use Define and enforce rules and actions for resources
• Plans – Free (no SLA, 500k objects), Basic, Premium P1/P2 • AAD password hash synchronisation
Implement the principle of least permissions
• Service Tiers: Standard and Premium • HTTPS – security in transit • Roles in Azure can be added to a scope • NOT about users, groups, or application access
• Protocols – OAuth 2.0, OpenID Connect • User passwords hashes synched between AD and AAD • Hardware Security Modules (HSM) with Premium • Transparent Data Encryption – security at rest • Apply governance strategy
• Scope cam be subscription, Resource Group, or Web App
• Endpoint V1 • Hash synched with any change • Always Encrypted – data in use, AlwaysEncrypted columns • Example: All VMs use managed disks
• Set 2000 role assignments from Portal, PS, CLI, Rest API
• Work and school accounts • Provides single sign-on (SSO)
• Built-in Roles: Owner, Reader, Contributor
• Azure Active Directory Library (ADAL) • AAD pass-through authentication
• Endpoint V2 • Passwords are not synchronised, but validated on-prem
• Work, school, and personal accounts • Provides single sign-on (SSO)
• Microsoft Authentication Library (MSAL)
Microsoft Graph
• Connects multi services and provides single endpoint
• AAD is integrated in Microsoft Graph Premium protection for Az identities
• Detect identity based issues
Manage and control access inside an Az AD tenant • Detect compromised identities
• Az AD Prem P2 or Enterprise Mobility + Security E5 feature • Policies: MFA registration, user risk, sign-in risk
Cloud identity management for mobile and web apps • Grant permanent or temporary role access
• Leveraged using MSAL Encrypt Windows and Linux VMs • Flow: User request, review, approval, notification, action,
• Social Accounts – Facebook, Google, LinkedInn • Windows – Bitlocker monitor
Authentication provider for external users to on-prem • Enterprise Accounts – OpenID Connect, SAM • Linux – dm-crypt
• WEB SSO for federated users accessing on-prem apps, • Local accounts – email/user and password
using Azure AD Connect • App must be registered inside Azure B2C tenant
• Web Services (WS) – WS-Federation compatible
• No external user account management – own credentials Advanced Thread Protection and Security Mngt.
using Security Assertion Markup Language (SAML) • Features:
• Install on-prem of Azure VM and use MS Graph. • Centralised policy management
Hybrid cloud and data management tool • Continuous security assessment
• Manage on-prem and Az infrastructure • Actionable recommendations
• Azure, AWS, Win Server, Linux, VMWare and OpenStack • Advanced Cloud protection
Enables organizations to work safely with others • Services: • Prioritised alerts and incidents
• Enabled by default for all AAD tenants • Security and Compliance Solution • Integrated security solutions
• Integrated with Office 365 • Security and Audit • Tiers: Free and Standard (hybrid environments)
Two step verification (MFA) • AD Premium Features requires license ration of 5:1 Encryption for data at rest • Security Domains • Advanced Threat Detection
Every AS Premium licence = five external users Managed identity for resources in Azure • Storage Service Encryption (SSE) • Notable Issues • Activity group, campaign, and threat summary report
• Know – password
• Set conditions for users, for example, enforce MFA • Service Principal only known within bounds of Az resources • Written to storage account using 256-bit AES encryption • Detection
• Have – phone, verification app, 3rd party OAuth tokens • Az Endpoint Protection
• Use policies to delegate permissions • Assign appropriate Role-based Access Control (RBAC) • Set with Portal, PowerShell. CLI, and REST API • Thread Intelligence
• Are - biometrics • Anti malware protection for Az and on-prem VMw

Automation ensures consistency and saves time

• Development, testing, acceptance, and production
• PowerShell – create resources and configure
• Desired State Configuration (DSC) – enforce config
• Features: Configurations, Resources, Local Config Mgr.
Meet performance and SLA requirements
• Vertical scaling – change VM sizes
• Horizontal Scaling – add / resource resources
• Strategies
• Monitoring and alerting
Architecting Microsoft Azure Solutions 2
• Azure Automation
• Process Automation – automate management • Decision Making Logic – automation runbooks
• Configuration Management – DSC, PowerShell • Az Monitoring Scale – integrated in Az Monitor
• Update Management – Cloud + on-prem environments • App Architectures – Service Fabric scales
• Shared capabilities horizontally
• 3rd Party
• Chef – virtual and physical config management, Windows
+ Linux + Mac
• Puppet
• Azure Event Grid – supports automation tasks
• Azure Logic Apps – supports call to automation runbooks
• Azure DevOps – CI/CD

Create modern, intelligent applications, with AI/ML Environment to build and deploy bots
• Artificial Intelligence (AI) & Machine Learning (ML) • Freeform communication
• Services: Vision, Speech, Language, Knowledge, Search • Tiers
• Vision – Categorise, moderate, classify, index, … images • Free – up to 10,000 messages
• Speech – Speech enabled, recognition, translate • Standard S1 – pay for 1,000 messages at a time, SLA
• Language – LUIS, spelling, linguistic, text analysis, web, …
• KB – Personal experience, train AI to converse naturally
• Search – Bing, autosuggest, entity and custom search

Internet of Things (IoT) Hub

• Send massive amounts of data to Az for processing
Monitoring solution in Az Portal Algorithms to apply complex math calc to big data • Bi-directional, secure and routable communication
Collects and analyzes log files from resources • Tools • Scale up to millions of connected devices
• Azure and on-prem resources • Infrastructure metrics and logs for Az services
• Capabilities: • Machine Learning Studio – drag/drop predictive models • Integrated with Azure Monitor
• Analysis tools – OMS, Security Center, AI, PowerBI • Leaning Workbench – end-end science solution • Tiers: Basic (8k msg/day), S1 (400k), S2 (6M), S3 (300M)
Asynchronous processing of messages • Activity Log – info on all types of events
Reliable, brokered messaging system • Diagnostics Settings – info on events within specific srv • AI Gallery – community-driven solutions Event Hub
• Messages up to 64KB in size • Ideal for Integration and IoT scenarios • ML Modules – out-box models for analyzing data
• Metrics – time-based metric points for resources • Ingress of device data streams
• 7 days retention maximum • Messages up to 256KB (basic) and 1MB (premium) • Data Science VMs – preconfigured workloads
• Alerts – View and manage Az alerts • One-way communication
• Messages become visible after 30sec if not deleted • Queues – first in first out (FIFO), one consumer • Aggregated metrics monitoring
• Multiple receivers • Sessions – grouping of messages by session ID • Tiers: Basic (100 connect), Standard (1K), Dedicated (25K)
• Topics – Publish/subscribe by multiple consumers IoT Edge
• Subscriptions – Apps connect to sub to get to topics • Installed at the edge of on-prem network, DMZ
• WCF Relays – gateway for on-prem WCF services to Azure • Collect device data and send to IoT Hub
• Tiers – Basic, Standard (topics, tx, sessions), Premium Helps you follow best practices for Az deployments
• High Availability Pipeline for event processing and real-time analysis
• Security
Az Portal Dashboard showing resource issues • Sources – Apps, sensors, IoT Hub, Event Hub, Blog storage
• Performance • Views • Targets – Data Lake, PowerBI, SQL data Warehouse
• Costs • Service issues
• Planned Maintenance
• Resource Health
• Health Alerts
Queues - Standard queuing with messages up to 64KB
Brokering at enterprise scale with messages up to 1MB, transactions, and sessions - Service Bus Provide valuable insights into IoT data
• DB storage for massive amounts of data
Secure and high-quality streaming and storage • Sources – IoT Hub, Event Hub
• Flow – Upload → Encode → Secure → Analyse
• Join data – metadata, telemetry, and visualise
• Cognitive Azure Media Analytics
• Features – Integration, storage, visualization, query
• Indexer, Hyper lapse, Motion detect, summarize,
Az resource network monitoring for network comms Monitoring solution for cross-platform apps character recognition, face recognition, and moderation
• Capabilities • Az and on-prem apps
• Topology • Events
Push notifications from backends to mobile • IP flow velocity • Rate data
Event management across Azure resources • Scenarios – Send codes, notifications, news • Next Hop • Exceptions
• Apps are notified when an event happens • Tiers • Security Group View • Page views and performance
• Throughput of millions of events and 24h retry • Free – 1 million messages / month • VPN diagnostics • Diagnostic logs
• Publishers – Az subscriptions, Event Hubs, Topics, IoT Hub, • Basic – 10 million messages / month • Packet Capture • Custom Events IoT Hub – Two-way communication
Resource Groups, Blob storage, Service Bus, V2 storage, … • Standards – 10 million messages / month • Connection Troubleshooting • Integration One-way communication for cost effective data ingest – Event Hub

AJATO Transformations Limited | 2018.09 | github.com/wpschaub/Quick-Reference-Posters

 Architecting Microsoft Azure Solutions 3

DC/OS, Docker Swarm,

Kubernetes )

AJATO Transformations Limited | 2018.09 | github.com/wpschaub/Quick-Reference-Posters

AJATO Transformations Limited | 2018.09 | github.com/wpschaub/Quick-Reference-Posters