(gear whirs)
- Coming up, we take a look at updates to how you can
manage and secure distributed multi-cloud compute resources
in Azure using Azure Arc.
Now, we're going to look at how this extends
a unified management plane to your virtual machines
and physical servers on-premises,
including now your SQL Servers wherever they are.
To help me explain all the different updates that we have,
I'm joined today
by Travis Wright from the Azure Data Engineering Team.
Welcome back to Microsoft Mechanics.
- Yeah, thanks for having me back.
It's great to be here.
- So, before we get started talking
about all the different updates,
just to recap if you're new to Azure Arc,
really the easiest way to think about it
is as a bridge that simplifies complex
and distributed environments across on-premises,
Edge, and also multi-cloud
into a unified central management plane in Azure.
Now, you don't have to migrate these resources
or move them to a common directory service.
They simply stay where they are.
- That's right.
A lot of organizations have resources spread
across data centers, other public clouds,
and a lot of these just have different management toolsets.
With Azure Arc, we're giving you a frictionless way
of bringing together all the infrastructure
and services that you have across the clouds,
across all your data centers,
and Edge site locations
into a single, consistent view and toolset.
This includes providing some Azure services,
such as data services, as we announced at Ignite.
You can manage Arc-enabled Kubernetes clusters
and servers wherever they are from Azure.
And you can manage your servers,
whether that's Windows or Linux, at a platform level.
And today, at the hybrid virtual event, we're announcing
that you can even manage Azure Arc-enabled SQL Servers,
allowing you to manage your SQL Server workloads
anywhere from Azure.
Once it's under Azure Arc management,
you'll be able to apply policy
and govern those resources centrally and securely at scale.
- That's right, and if you missed this at Ignite,
that was the show we had with Travis,
you can also check that out at aka.ms/ArcDatabase.
Now, I know a lot of the updates really revolve here
around Azure Arc-enabled SQL Server,
so can you tell us about the updates there?
- Yeah, we think this is going to appeal to a lot of people
because almost every organization we come across,
they have lots and lots of SQL Servers.
Depending on where those SQL Servers are,
if it's on-premises or in AWS or in Azure,
how you manage them really is kind of different.
There's a different toolset to them.
And so, Azure Arc greatly reduces this complexity
by giving you a way to manage your entire SQL Server estate
from a single point of view,
and a single toolset from Azure.
- And it sounds great,
but can you tell us then kind of the machinery
and how it all works?
- Yeah, to bring your SQL Servers
under Azure Arc management,
each SQL Server has to have an agent installed on it,
and then that agent needs to be able to securely establish
that secure communication channel up to Azure.
This enables secure, bidirectional communication.
So I'll show you how to get this up and running.
Here's where you would see a list of Arc-enabled servers.
Right now I have none, so let's get one going.
First, we'll need to get Windows Server under management,
and then the SQL instance.
I'll click create.
You can choose to do this at scale by creating a script,
which will use a service principal to onboard.
You could then deploy that script
with something like System Center
or your favorite software distribution tool.
For this demo, we'll use the interactive script,
which will prompt me to log into Azure.
I'll choose the subscription, resource group,
and region as usual.
Then, I'll choose Windows or Linux,
and then click review and generate
to generate the script.
The script contains all the information that it needs,
including your tenant ID, subscription ID,
and resource group,
so that it can securely broker a trust relationship
to Azure.
Now, I'll download the script,
and from here, execute the script.
That's now going to log me into Azure.
I just need to paste in my authentication key.
So once I'm logged in, the script will complete,
and we can switch over to add/remove programs, refresh,
and see that the Azure Connected Machine Agent is installed.
And if we go back to the Portal
to the machine's Azure Arc view,
we'll see it show up there.
We can drill into it and see some of the details about it,
such as the computer name and operating system information.
So now this server is Arc-enabled
and can be managed from Azure.
- Right, and so to be clear here,
we've brought in the Windows component into management,
but we still need to tackle
the SQL instance aspects of management as well.
- Yeah, exactly, that's the next step.
So now we're going
to manage the SQL Server running on that Arc-enabled server.
So starting where we left off,
looking at the Arc-enabled server named SQLServer01,
I'll follow the same general process of generating
and downloading a script.
I'll go to the SQL Server's Azure Arc view.
Then click add, and you'll be prompted
to select your subscription and resource group,
instance name, location, username, password,
and then click review and create.
I've already done that to save time.
I have the script here that I'm going to run it.
So now this is installing the SQL Server extension
to the Azure Arc agent,
and configuring it to discover the SQL Server instance.
Just to confirm that it worked,
I'll hit refresh in the Azure Portal,
and now we can see that there is an Arc-enabled SQL Server,
and we can start to manage the SQL Server from Azure.
- Got it, so once everything
is under management with Azure Arc,
what are some of the examples then
where this gets even more powerful?
- Yeah, so one of the best examples
is with security operations.
Not many people know this,
and it's actually kind of hard to fathom it,
but Microsoft spends about a billion dollars a year,
and has 3,500 dedicated engineers
constantly doing security research.
And we enable you the benefit from that investment
that Microsoft makes by providing you these services,
like Advanced Threat Protection,
vulnerability assessments in Azure Sentinel.
So, let me show you.
Here I have an Arc-enabled SQL Server.
Azure Arc extends Azure Security Center's vulnerability
assessments and Advanced Threat Protection services out
to these SQL Servers in my own data center.
So let's take a look at the security tab
to see what might currently be recommended for me.
Vulnerability assessment has a high severity recommendation
for me to take a look at.
Let's drill in.
Here's a classic example of a security best practice
that hasn't been followed in this case.
The sa login is enabled,
and the vulnerability assessment
is recommending that it should be disabled.
Vulnerability assessment will tell me the reasons why
this change should be made,
and even provide me with the exact T-SQL script to run
to disable it.
By going back now we can see that
Advanced Threat Protection has detected
a brute force attempt.
My guess is that this is related
to the fact that the well known sa login was enabled.
Here we can see that there were 30 failed login attempts
with the sa login.
Let's see what the action is
that is recommended by Advanced Threat Protection.
So it looks like the recommendations
are to block the IP address of the client
that was doing the attack.
Also, it looks like we can protect ourselves better
by disabling the sa login,
which we've already done.
Lastly, we can see that this is all integrated
with Azure Sentinel so that our SecOps team
can see these incidents there in a central location.
They can further investigate the issue
by using Sentinel's advanced logging analysis
and visualization tools.
- That's an awesome example in terms of security,
but what about day-to-day operations
and config management?
How does that help us here?
- Yeah, configuration management is a big advantage
of Azure Arc.
One of the best ways to show this
is through the Azure Policy, which we can see here.
Azure Policy helps bring existing infrastructure
into a compliance state,
or ensures that services are compliant
as they are provisioned,
and we can track our compliance here
in the Azure Policy compliance dashboard.
Policies define desired configuration,
and we can provide hundreds of policy templates
or you can create your own.
So let's take a look at some of the policy templates
that we provide.
We'll search for the SQL related ones using the search box.
Here's a policy template
to enable transparent data encryption
on all our SQL databases.
This will automatically encrypt all data at rest
without requiring any app changes.
We can look at the details of this,
and then we can assign it to a scope.
A scope is a subscription and resource group.
So here we would target the same subscription
and resource group
that we just created the Arc-enabled SQL Server in,
and this policy would be applied to it.
Since this takes a few minutes to apply,
I won't actually create it right now.
But by creating a policy like this,
it would send down the policy to the Arc-enabled SQL Server
in my data center, and all of the databases
on that SQL Server would then be encrypted
with transparent data encryption.
And then, any future Arc-enabled SQL Servers that are added
to that resource group will also have
that policy applied to them,
and all of their databases would
automatically be encrypted as well.
- And this is a really going to help
in terms of consistency.
But most of what you're showing here is related to servers.
And now last time you were on,
you talked about Arc-enabled Kubernetes
and really some of the things that you can do
with data services as well,
so what are some of the updates there?
- Right, so at Build,
we announced the public preview
of Arc-enabled Kubernetes,
which enables you
to take any Kubernetes cluster you have anywhere,
register that with Azure,
and then it becomes manageable by Azure,
including the ability to integrate it with Azure Monitor
so we can collect monitoring
and performance statistics about that Kubernetes cluster,
and send that up to Azure Monitor so you can see
that information across all your Kubernetes clusters
in a single view in the Azure Portal.
So, if I flip over to Azure Monitor,
I can see near real-time state of my nodes and pods
across all of my Kubernetes clusters.
This blue oval under the icon indicates
these Kubernetes clusters are outside of Azure.
I'll drill into one,
and you'll see the overall performance
of the cluster here in this dashboard.
You can see node CPU utilization,
memory utilization, and node and pod counts over time.
And also, we can see the overall state
of the infrastructure,
and I can see details about the nodes and controllers.
Lastly, I can see both my apps
and Arc-enabled data services running in these containers.
These particular containers that you see here
are running Azure Arc-enabled data services.
- Okay, so now you can actually monitor
your Kubernetes clusters everywhere centrally
from one place using Azure Monitor.
Now it's awesome to see all the different progress
that you and your team have made in a couple of months,
but what's happening next?
- Yep, so we're going to continue bringing Azure services
to be enabled for customers
to run wherever they want through Azure Arc.
Concretely, there's a couple things we're working on
in data services right now.
The first is that we're going to enable you
to take backups locally,
and then send those backups up to Azure
for long-term, off-site retention in Azure.
And then secondly, you know,
really what management system would be complete
without the ability to do automated patch
and update management?
So that's a really key feature that we're building,
and really excited to deliver that to customers,
that they can patch
their Arc-enabled data services anywhere,
whether that's in their own data center,
in Edge site locations or other public clouds,
from the context of Azure.
- Thanks, Travis, and really as someone who grew up also
with systems management,
I'm going to be watching this space super closely
as it develops.
And if you want to get started with Azure Arc,
be sure to check out aka.ms/AzureArcData,
and sign up for the preview.
Of course, also,
keep following all the updates across Microsoft
on Microsoft Mechanics.
That's all the time we have for this show.
Thanks for watching, we'll see you next time.
(whooshes) (beeps)
(upbeat music)