(bright upbeat music)
- Hi, everyone.
It's great to be here as a part of the Azure Hybrid Event.
I'm Jeremy Winter, Vice President
for Azure Arc and Azure management.
Now you've heard from my colleagues,
Rohan, Corey, Assad, and Gabe,
talk about different aspects of Azure hybrid,
and our focus to give you a comprehensive solution
that meets you wherever you are.
Now I'm here today to cover the key value
that you can get from Azure Arc
to govern and secure your infrastructure
such as servers, Kubernetes clusters,
and services deployed anywhere.
To quickly recap, Azure is built for hybrid at its core.
And Azure Arc is a key component
of Microsoft's hybrid and multi-cloud platform
that seamlessly extends the capabilities of Azure
to on-Prem data centers, edge locations,
and any other public cloud.
Customers on Azure consensually operate, govern,
and secure infrastructure running in diverse environments.
In this session, we're going to focus in
on the single control plane
which enables consistent operations,
automation and security,
and how you can start leveraging the same skill sets
you are building with Azure in other environments.
We also know security and governance is top of mind for you.
We'll look at how you can work with Microsoft
as a trusted security partner,
leveraging our investments in security in your environments.
Let's look at how your environments are evolving.
The advances in cloud and edge technologies
are enabling organizations to reinvent
and scale their businesses in ways
that we could have only imagined just a few years ago.
You may have had investments in hundreds or even thousands
of applications to meet your business needs,
yet these applications are distributed
across multiple data centers, branch offices,
edge locations, and cloud platforms.
Now when I talk to customers, often the questions I get are,
"How do you govern diverse and distributed environments?
"How do you ensure security across the entire organization?
"And how do you do this in a way
"that all operations are consistent?"
Now, with Azure and Azure Arc,
we are helping you establish a consistent way
to govern secure and operate all of these environments,
enabling developers to build applications once,
and then deploy and run them in the same way anywhere.
Azure Arc helps our customers unify operation in management,
a key first step to being successful
at scaling with the hybrid and multi-cloud strategy.
Azure Arc is really an extension
of what we're doing in Azure.
We've always taken an approach
that we must manage a wide range of resources.
We understand that it's not enough to have a point solution
for one kind of resource at a time.
Whether it's just servers, just containers, or just apps,
the reality is, that it's all of these
that we need to manage.
Security is a priority area
we've made a ton of investments in,
to protect our customers running in Azure.
We understand that security is even more top of mind
for our customers with diverse and distributed environments.
This is why we are bringing the security investments
we've made native in Azure to the hybrid space.
And lastly, the ultimate outcome
of a consistent platform approach with Azure Arc
is that you and your team skill sets become transferable,
whether you're working on-Prem
or in any of the public clouds, whether you're working
on traditional three-tiered applications or you're building
a new micro-service architected application
to run on Kubernetes,
these common set of Azure services and tools
can be standard across all those different scenarios.
But before we get any deeper here,
I think it'd be great to show you an Azure..
show you Azure Arc in action.
So I'm going to hand it over to Ryan Willis,
a member of my engineering team to give us a tour
for just how easy it is to get up and running
across the variety of resources and environments.
Ryan, welcome.
Hey, can you give us a run through on Azure Arc?
- Thanks Jeremy.
Let's head over to the Azure portal,
and see how Tailwind Traders is using Azure Arc
to unify their operations.
Tailwind Traders is a retail organization
with workloads and multiple clouds,
data centers, and retail stores.
Like many organizations, they have a mix
of legacy applications running on Windows, Linux,
and SQL servers, and all their new applications
are being containerized to run on Kubernetes in the cloud.
The servers in Kubernetes cluster you see on the screen here
are running outside of Azure,
but they show up and can be managed from Azure,
thanks to Azure Arc.
So I'll open up one of these Kubernetes clusters
and we'll see that it's modeled
just like any other Azure resource.
They belong to resource groups and subscriptions
and can be tagged with metadata
to help you organize and find related resources.
Azure Arc also makes the DC
to enroll this Kubernetes cluster
and other as your management,
monitoring, and security services.
So for instance, if I wanna start collecting performance
and log information for my cluster,
I can go to the Azure Monitor insights tab
and specify the workspace
where I want to store the data in Azure.
The Arc agent running on that Kubernetes cluster
will take care of installing
and configuring the monitoring tools for me.
I don't have to mess around with copying scripts
or even beyond the same network as my cluster
to start collecting these logs and metrics.
The same approach works for Windows and Linux servers too.
And it's all possible because of that Azure control plane
that Jeremy had mentioned earlier.
The control plane gives a consistent inventory
and management experience for all of your resources,
no matter where they may be running.
It's also the foundation for governance with Azure policy.
So, Azure policy allows you to set guardrails,
for Azure resources and monitor compliance over time
to minimize risk and simplify audits.
Azure Arc extends policy to your servers
and Kubernetes clusters running outside of Azure,
so you can have a single pane of glass for compliance
across all of your environments.
So let's drill deeper and take a look at compliance
across our resources.
Here, we can see a list of all the policies assigned
to our subscription and the latest compliance status.
This status is updated and re-evaluated regularly
to catch any changes in the configuration of your machines.
So remember earlier when I enabled monitoring
on that Kubernetes cluster,
policy can help automate that for you as well.
Let's look at the Enable Azure Monitor for VMs policy.
This policy checks Azure VMs and Arc-enabled servers
to see if the monitoring agents are installed.
When that server is connected to Azure Arc
for the first time,
policy will automatically deploy
any monitoring tools required to that server.
But if for some reason the monitoring tools
are removed later on, the IT admins can create
a remediation task to re-install the agent
on all the non-compliant machines.
And this gives you a zero-touch configuration experience
that works at scale with built-in reporting.
Tailwind Traders is also using Security Center
to get a complete picture of their security posture
across all their resources.
When we open Security Center, we can see a quick summary
of how we're doing across a variety
of security controls and recommendations.
Security Center can help with your next audit
with pre-built policies to audit operating system
and resource configurations
against common regulatory standards.
Security Center takes the audit data from Azure policy
and maps it to the appropriate controls in the standards
so that you don't have to do any guesswork.
Let's take a look at the inventory of resources
the Azure Security Center is monitoring.
So just like with our other services,
Security Center integrates with the control plane
and it's comparing the inventory of known resources
against the security data that it's collected about them.
For each resource, we can see whether
they're fully protected, and how many recommendations
are available for that resource.
If we click a non-premises SQL server for example,
we can see that there are several findings for our server.
In the recommendation details,
we can see that our on-premises database
has several vulnerabilities that can be addressed
to improve the security posture of our environment.
Each security check is annotated with a severity level
and the benchmarks to which it's applicable,
making it easy to understand the potential impact
of each recommendation.
And so everything I just showed
is just scratching the surface
of the possible integrations you get
when you connect your hybrid and multicloud servers
to Azure with Azure Arc.
I'll toss this back to Jeremy to tell you more
about how this all works.
- Thanks, Ryan.
That was great, and I appreciate your time.
So simple, yet powerful.
So all right, let's dive into where we see customers
like yourself really taking advantage of this.
When it comes to managing that wide range of resources,
Ryan showed how he can operate them in a single place.
A single agent install makes it easy
to onboard all these resources to Azure
including physical, virtual Windows, Linux, SQL Server,
and Kubernetes clusters.
Once resources are onboarded by communicating
through the control plane,
you're able to use the same capabilities
Azure provides for your cloud resources,
on your resources outside of Azure.
So once we get everything into that control plane,
it becomes simple and easy to manage, automate,
and rationalize these new IT investments.
Azure Arc gives you that truly
single pane of glass experience,
so you can unify all your operations under one roof.
Let's take a deeper look here.
For Azure native resources, we provide a wide range
of solutions for operations and security,
which are also available for resources connected with Arc.
Customers are using them
with existing traditional applications,
as well as new cloud native apps.
Azure Monitor is a great example of one of these.
Once a resources is Arc-enabled,
you can just turn on Azure Monitor
and immediately begin to collect, analyze,
and act on telemetry data from resources connected
through Arc running anywhere.
Azure Monitor helps you maximize performance
and availability of your applications,
and proactively identify problems in seconds.
Now, Azure Lighthouse helps make multi-tenant, self-service,
and delegated access control easier.
With it, you can keep full transparency into user actions
and manage multi-tenant access
without compromising security.
You can easily decide who can access to your state,
what they can access and when.
Now with arc, you can use Lighthouse,
not only in Azure, but anywhere on the edge or other clouds.
This is a powerful concept for multi-tenant needs
or enabling managed service providers,
again with Azure constructs
extended to your other environments.
Now, Azure Arc is a platform
for an entire ecosystem.
You get a choice of the tools and systems you need
to work with.
We understand flexibility is important,
especially where you already invested.
Azure Arc supports Windows server
and a wide range of Linux operating systems,
such as SUSE and Red Hat.
You can manage SQL server on Arc-enabled servers,
so in addition to the governance and inventory benefits,
you're able to take advantage
of SQL specific security services
or proactive SQL server assessments,
ensuring your databases are optimally tuned.
Azure Arc-enabled Kubernetes meets you where you are
with your existing Kubernetes investments.
Any CNCF conformance Kubernetes
can host the Azure Arc agent
and gain the benefits of the cloud-based management.
In addition to the broad support,
we have a set of validated partners,
including OpenShift, Rancher, Tanzu, and Karbon.
Azure Arc-enabled Kubernetes is also integrated
with Microsoft first party offering AKS on Azure stack HCI,
giving you lots of options
for where and how you adopt Kubernetes.
And you saw it earlier,
we're working across many different Azure services,
data services, application services, even machine learning,
to enable them with Azure Arc
so that they can run anywhere just like they do on Azure.
- Okay, onto the next area
I see customers utilizing Azure Arc,
governance and compliance.
You know, governance and compliance is a critical aspect
of being successful with the cloud-operating model,
and another capability that we've deeply built into Azure.
With Azure's policy capabilities you set the guardrails,
which help you audit and enforce resource configurations
across Azure in a scalable manner.
Through Azure Arc, hybrid resources are integrated
into the native policy engine
that runs from within Azure.
Azure policy will continually check on the compliance
and regulatory state of your systems
without you having to string together
a bunch of custom scripts.
So with Azure Arc and policy, you can govern the environment
and ensure resources are compliant
with your operating practices
in a consistent and repeatable way
regardless where you are running those applications.
Now in addition to governance and compliance,
Azure also provides a secure foundation
to strengthen your security posture.
At Microsoft, we invest more than a billion dollars a year
in cybersecurity and have over 3,500 global security experts
monitoring and securing Azure.
We also analyze trillions of signals
from Microsoft services, such as Windows and Xbox
around the globe to identify new and evolving threats.
The insights we've gained in cybersecurity
have formed the way we build Azure security tools
to protect our customers workloads.
But we also wanna take action.
We wanna help you see and stop threats
before they cause harms so that you can feel good
about the global coverage across your entire estate.
Azure Arc works with our security products
to help make it easier
to build next generation security operations
across the data centers, edge, and multi-cloud.
Let's first talk about how you can ensure
that your cloud infrastructure is configured
in a secure manner at any point in time.
The first one is Azure Security Center,
continuously assesses the security state
of your cloud resources across virtual machines, networks,
apps, and data services.
Its multi-cloud capabilities help you visualize
your security state and quickly get insights
on your configured security controls.
The second is Azure Defender
which provides a competitive cloud-native extended detection
and response solution for Windows and Linux servers,
containers, and serverless workloads
that Azure and hybrid customers have widely adopted.
Azure Defender benefits
from the Microsoft Intelligence Security Graph
which uses those trillions of signals
I mentioned before from Microsoft services.
And this really helps us protect and think about systems
around the globe to identify new and evolving threats.
And finally, everything comes together with Azure Sentinel.
Azure Sentinel makes it easy to collect security data
across your entire hybrid organization
from devices, users, apps, servers, and any cloud.
Azure Sentinel uses the power of AI
to help you quickly identify real threats,
and releases you from the burden of traditional seams
by eliminating the need to spend time on setting up,
maintaining, and scaling that infrastructure.
All of these are capabilities
that you can simply just turn on
if you've onboarded with Azure Arc.
In fact, what we're seeing is that security scenarios
are one of those top reasons customers are using Azure Arc
with their existing Windows and Linux servers
that they're managing today.
Now, we're seeing great momentum with thousands of customers
using and building solutions
with our hybrid capabilities today.
What's amazing is how so many of these customers
are using them in vast and different scenarios.
Many customers are, like I just said,
starting with global security coverage for their IT estate.
Others, like Gabe talked about in the previous session,
are building new cloud-native applications anywhere
with both Kubernetes and Azure services.
Many customers are also looking
to accelerate their cloud adoption
and migration initiatives here.
They want to start adopting cloud practices
and technologies on-Prem with workloads
that aren't ready to be migrated to the public cloud.
They wanna be able to build cloud skills and processes
so that when they move, they're ready to go.
One of the customers that I think it would be great
to tell you about is actually a partner of ours, Avanade.
Now Avanade is using Azure Arc
to accelerate cloud-adoption decisions,
simplify and standardize their infrastructure management
while thinking about reducing costs
and ensuring regulatory compliance.
For many of their customers, the cloud migration
is something that takes time, and not every workload
can move to the public cloud.
While they are preparing to move,
Azure Arc enables Avanade to connect environments
and start utilizing the Azure services.
The skills and processes they develop
carry forward when they are migrating to Azure,
and are consistent with the skills and processes
for the resources that remain on-Prem.
Beyond migration, Azure Arc
is enabling Avanade to support portability
utilizing Kubernetes-based applications.
One Avanade customer, for example, has a SAS offering
for financial services companies worldwide.
When regulations require software and data
to remain in a specific country, the company has to manage
and run that part of the solution very differently.
As we talked about throughout the session,
Avanade and their customer have turned to Azure Arc
to manage everything for consistency and governance controls
regardless of which country or environment
the solution needs to run within.
Alright, as we wrap this section up,
I wanna to thank you all for joining me.
A few things to keep in mind.
First, remember that bringing everything
into a single set of management tools
is more than just a superficial view.
It's a path to build transferrable skills
to work on critical and strategic initiatives.
Second, our goal is to help you have peace of mind
with operations and compliance,
and they are more important than ever
in a hybrid and multi-cloud world.
The technologies in Azure can help you make progress
with the new cloud model.
And finally, we're going to continue to have security
at the forefront of our priorities,
as the world becomes more and more reliant on technology.
We will continue to be with you
as you safeguard your data, infrastructure,
and your entire state.