Please enable JavaScript.

Coggle requires JavaScript to display documents.

Prerequisites for Azure Administrators - Coggle Diagram

- - - - The Az PowerShell module is available from a global repository called the PowerShell Gallery.
      - Install-Module -Name Az -Scope CurrentUser -Repository PSGallery
    - - A PowerShell command is called a cmdlet (pronounced "command-let"). A cmdlet is a command that manipulates a single feature.
      - Cmdlets follow a verb-noun naming convention; for example, Get-Process, Format-Table, and Start-Service. There is also a convention for verb choice: "get" to retrieve data, "set" to insert or update data, "format" to format data, "out" to direct output to a destination, and so on.
      - Cmdlets are shipped in modules. A PowerShell Module is a DLL that includes the code to process each available cmdlet.
      - You'll load cmdlets into PowerShell by loading the module in which they're contained. You can get a list of loaded modules using the Get-Module command
      - Sample Commands
        
        Connect-AzAccount - login to Azure via PowerShell
        
        Get-AzContext - gets the active Subscription.
        
        Get-AzSubscription - list of all subscription names in your account.
        
        Set-AzContext -Subscription <Subscription-ID> makes the selected Subscrption active
        
        Get-AzResourceGroup list of all Resource Groups in the active subscription.
        
        New-AzResourceGroup -Name <Name> -Location <region> creates a new Resource Group
        
        Get-AzResource list of all resources in your Resource Groups
- - - - You use a template for deployment and that template can work for different environments such as testing, staging, and production.
      - Allows you to specify your project's infrastructure in a declarative and reusable way without having to write the sequence of programming commands to create it.
      - The templates can be versioned and saved in the same source control as your development project.
      - Infrastructure as code enables you to describe, through code, the infrastructure that you need for your application.
        
        Faster deployments
        
        Better traceability
        
        Improved scalability
        
        Consitent configurations
      - ARM templates are JSON files that define the infrastructure and configuration for your deployment. Azure Resource Manager then uses this information to deploy the resources in an organized and consistent manner.
      - Allows you to automate deployments and use the practice of IaC.
      - ARM templates are idempotent, which means you can deploy the same template many times and get the same resource types in the same state.
      - Resource Manager orchestrates the deployment of the resources so they're created in the correct order. When possible, resources will also be created in parallel, so ARM template deployments finish faster than scripted deployments.
      - Resource Manager also has built-in validation. It checks the template before starting the deployment to make sure the deployment will succeed.
      - If your deployments become more complex, you can break your ARM templates into smaller, reusable components. You can link these smaller templates together at deployment time. You can also nest templates inside other templates.
      - ARM template file structure
        
        Schema is a required section that defines the location of the JSON schema file that describes the structure of JSON data
        
        contentVersion is a required section that defines the version of your template (such as 1.0.0.0). You can use this value to document significant changes in your template to ensure you're deploying the right template.
        
        parameters is an optional section where you define values that are provided during deployment. These values can be provided by a parameter file, by command-line parameters, or in the Azure portal.
        
        apiProfile is an optional section that defines a collection of API versions for resource types. You can use this value to avoid having to specify API versions for each resource in the template.
        
        variables is an optional section where you define values that are used to simplify template language expressions.
        
        functions is an optional section where you can define user-defined functions that are available within the template. User-defined functions can simplify your template when complicated expressions are used repeatedly in your template.
        
        resources is a required section that defines the actual items you want to deploy or update in a resource group or a subscription.
        
        output is an optional section where you specify the values that will be returned at the end of the deployment.
      - Deploying an ARM template
        
        Deploy a local template
        
        To deploy a local template, you need to have either Azure PowerShell or the Azure CLI installed locally.
        
        Deploy a linked template.
        
        Use linked templates to deploy complex solutions. You can break a template into many templates and deploy these templates through a main template. When you deploy the main template, it triggers the deployment of the linked template.
        
        Deploy in a continuous deployment pipeline.
        
        A CI/CD pipeline automates the creation and deployment of development projects, which includes ARM template projects. The two most common pipelines used for template deployment are Azure Pipelines or GitHub Actions.
    - - Define and deploy your infrastructure through the declarative syntax in Azure Resource Manager templates, rather than through imperative commands. Only use imperative commands to manage your resources, such as stopping or starting a VM.
        
        Declarative commands is a statement of the desired result. ARM Templates in YAML are declarative in nature.
        
        Imperative command is a statement that provides sequence of instructions to arrive at the desired result.
      - Define all deployment and configuration steps in the template. You should have no manual steps for setting up your solution.
      - Arrange resources with the same lifecycle in a resource group.
      - Use tags for all other organizing of resources.
    - - Resource is a manageable item that is available through Azure. e.g. VM, Storage Account, etc.
      - Resource Group is a container that holds related resources for an Azure solution.
      - Resource Provider is a service that supplies the resources you can deploy and manage through Resource Manager.
      - Template is a JSON file that defines one or more resources to deploy to a resource group. It also defines the dependencies between the deployed resources.
  - - - Resources can only exist in one Resource Group.
      - Resource Groups cannot be renamed.
      - Resource Groups can have resources of many different types.
      - Resource Groups can have resources from many different regions.
      - A Resource can be moved from one Resource Group to another Resource Group.
      - A Resource Group can be used to scope access control for administrative actions.
      - A Resource can interact with resources in other Resource Groups.
      - All the resources in your Resource Group should share the same lifecycle. You deploy, update, and delete them together. If a certain resource needs to exist on a different deployment cycle, it should be in another Resource Group.
  - - - You can associate the lock with a Subscription, Resource Group, or Resource.
      - Locks are inherited by child Resources.
      - There are two types of Resource Locks, (1) Read-Only Locks which prevent any changes to the resource, (2) Delete Locks which prevent deletion
      - Only the Owner and User Access Administrator roles can create or delete management Locks.
- - - - Azure Active Directory (Azure AD) is Microsoft's multi-tenant cloud-based directory and identity management service
        
        Single sign-on to any cloud or on-premises web app. Azure Active Directory provides secure single sign-on to cloud and on-premises applications.
        
        Works with iOS, macOS, Android, and Windows devices. Users can launch applications from a personalized web-based access panel, mobile app, Microsoft 365, or custom company portals using their existing work credentials.
        
        Protect on-premises web applications with secure remote access. Access your on-premises web applications from everywhere and protect with multifactor authentication, conditional access policies, and group-based access management.
        
        Easily extend Active Directory to the cloud. You can connect Active Directory and other on-premises directories to Azure Active Directory in just a few steps. This connection means a consistent set of users, groups, passwords, and devices across both environments.
        
        Protect sensitive data and applications. You can enhance application access security with unique identity protection capabilities.
        
        Reduce costs and enhance security with self-service capabilities. Delegate important tasks such as resetting passwords and the creation and management of groups to your employees. Providing self-service application access and password management through verification steps can reduce helpdesk calls and enhance security.
        
        Azure Active Directory Concepts
        
        Azure AD Account. An identity created through Azure AD or another Microsoft cloud service, such as Microsoft 365. Identities are stored in Azure AD and accessible to your organization's cloud service subscriptions. This account is also sometimes called a Work or school account.
        
        Azure tenant/directory. A dedicated and trusted instance of Azure AD, a Tenant is automatically created when your organization signs up for a Microsoft cloud service subscription
        
        More instances of Azure AD can be created.
        
        Azure AD is the underlying product providing the identity service.
        
        The term Tenant/Directory means a single instance of Azure AD representing a single organization.
        
        Account. An identity that has data associated with it. You can't have an account without an identity.
        
        Identity. An object that can get authenticated. An identity can be a user with a username and password. Identities also include applications or other servers that might require authentication through secret keys or certificates.
        
        Active Directory Domain Services (AD DS) vs. Azure Active Directory
        
        AD DS is the traditional deployment of Windows Server-based Active Directory on a physical or virtual server.
        
        You can deploy and manage AD DS in Azure virtual machines it’s recommended you use Azure AD instead, unless you are targeting IaaS workloads that depend on AD DS specifically.
        
        Azure Active Directory is different because
        
        Identity solution. Azure AD is primarily an identity solution, and it is designed for Internet-based applications by using HTTP and HTTPS communications.
        
        REST API Querying. Because Azure AD is HTTP/HTTPS based, it cannot be queried through LDAP. Instead, Azure AD uses the REST API over HTTP and HTTPS.
        
        Communication Protocols. Because Azure AD is HTTP/HTTPS based, it does not use Kerberos authentication. Instead, it uses HTTP and HTTPS protocols such as SAML, WS-Federation, and OpenID Connect for authentication (and OAuth for authorization).
        
        Federation Services. Azure AD includes federation services, and many third-party services (such as Facebook).
        
        Azure AD users and groups are created in a flat structure, and there are no Organizational Units (OUs) or Group Policy Objects (GPOs)
        
        Azure AD is a managed service. You only manage the users, groups, and policies. Deploying AD DS with virtual machines using Azure means that you manage the deployment, configuration, virtual machines, patching, and other backend tasks.
        
        Azure Active Directory editions
        
        Azure Active Directory Microsoft 365 Apps. This edition is included with O365. In addition to the Free features, this edition provides Identity & Access Management for Microsoft 365 apps including branding, MFA, group access management, and self-service password reset for cloud users.
        
        Azure Active Directory Premium P1. In addition to the Free features, P1 also lets your hybrid users access both on-premises and cloud resources. It also supports advanced administration, such as dynamic groups, self-service group management, Microsoft Identity Manager (an on-premises identity and access management suite) and cloud write-back capabilities, which allow self-service password reset for your on-premises users.
        
        Azure Active Directory Free. Provides user and group management, on-premises directory synchronization, basic reports, and single sign-on across Azure, Microsoft 365, and many popular SaaS apps.
        
        Azure Active Directory Premium P2. In addition to the Free and P1 features, P2 also offers Azure Active Directory Identity Protection to help provide risk-based Conditional Access to your apps and critical company data. Privileged Identity Management is included to help discover, restrict, and monitor administrators and their access to resources and to provide just-in-time access when needed.
        
        Azure AD Join is designed to provide access to organizational apps and resources and to simplify Windows deployments of work-owned devices.
        
        Single-Sign-On (SSO) to your Azure-managed SaaS apps and services. Your users won't have additional authentication prompts when accessing work resources. The SSO functionality is available even when users are not connected to the domain network.
        
        Enterprise state roaming of user settings across joined devices. Users gain the ability to securely synchronize their user settings and application settings data to the cloud. This reduces the time to configure a new device.
        
        Access to Microsoft Store for Business using an Azure AD account. Your users can choose from an inventory of applications pre-selected by the organization.
        
        Windows Hello support for secure and convenient access to work resources.
        
        Restriction of access to apps from only devices that meet compliance policy.
        
        Seamless access to on-premise resources when the device has line of sight to the on-premises domain controller.
        
        To have the device under the control of Azure AD
        
        Registering a device to Azure AD enables you to manage a device’s identity. Azure AD device registration provides the device with an identity that is used to authenticate the device when a user signs-in to Azure AD. You can use the identity to enable or disable a device.
        
        Joining a device is an extension to registering a device. Joining provides the benefits of registering and changes the local state of a device. Changing the local state enables your users to sign-in to a device using an organizational work or school account instead of a personal account.
        
        AD Join is intended for organizations that do not have on-premises Windows Server Active Directory infrastructure
        
        Implement self-service password reset
        
        Enabling Self-service Password Reset (SSPR) gives the users the ability to bypass the helpdesk and reset their own passwords.
        
        You have three options in configuring Self-Service Password Reset, (1) None, (2) Selected, (3) All
        
        Selected option is useful for creating specific groups who have self-service password reset enabled.
        
        After enabling password reset for user and groups, you pick the number of authentication methods required to reset a password and the number of authentication methods available to users. Such as email notification, text, or code sent to user's mobile or office phone, or a set of security questions.
        
        Azure Administrator accounts can always reset their passwords no matter what options are configured.
        
        Azure AD defines users in three ways
        
        Directory-synchronized identities. These users exist in an on-premises Active Directory. A synchronization activity that occurs via Azure AD Connect brings these users in to Azure. Their source is Windows Server AD
        
        Guest users. These users exist outside Azure. This type of account is useful when external vendors or contractors need access to your Azure resources. Once their help is no longer necessary, you can remove the account and all of their access.
        
        Cloud identities. These users exist only in Azure AD. Cloud identities can be in Azure Active Directory or an external Azure Active Directory
        
        Create user accounts
        
        Create users via Azure Portal
        .
        
        via Microsoft 365 Admin Center
        
        via Microsoft Intune admin console
        
        via CLI
        
        Deleted users can be restored within 30 days.
        
        Sign in and audit log information is available.
        
        Create bulk user accounts
        
        Just fill out the comma-separated values (CSV) template
        
        When creating bulk users, consider implementing naming conventions for usernames, display names, and aliases. While for passwords, figure out a way for new users to receive their password in a secure way.
        
        PowerShell is also available for bulk user uploads.
        
        Create group accounts
        
        Security groups. Security groups are used to manage member and computer access to shared resources for a group of users. his option requires an Azure AD administrator..
        
        Microsoft 365 groups. You can give people outside of your organization access to the group. Both users and admins can use Microsoft 365 groups..
        
        Addng members to groups.
        
        Assigned. Lets you add specific users to be members of this group and to have unique permissions.
        
        Dynamic User. Lets you use dynamic membership rules to automatically add and remove members. When a member's attributes change, Azure reviews the dynamic group rules for the directory. If the member meets the rule requirements, they're added. If the member no longer meets the rules requirements, they're removed.
        
        Dynamic Device (Security groups only). Lets you use dynamic group rules to automatically add and remove devices. If a device's attributes change, Azure reviews the dynamic group rules for the directory. If the device meets the rule requirements, they're added. If the device no longer meets the rules requirements, they're removed.