- Coming up, we're joined by Azure expert, Matt McSpirit
to look at how you can set yourself up
for success as you migrate or build new solutions
in the cloud with Azure Landing Zones
and set up reference environments to choose from
that provide the operational foundation
to host your workloads in Azure.
So Matt, it's great to have you back on the show.
- Thank you.
It's nice to be on as the subject matter expert
from time to time.
- Yeah, thanks for joining us from home today.
So we decided to cover this topic
because we're seeing a huge surge in cloud adoption,
whether you're kicking the tires
or architecting broader efforts,
it's important to start in the right way
to avoid operational issues down the line.
- Yeah, you're right.
And this is a challenge that's true of any cloud adoption.
It's not just specific to Azure.
Now on the one hand, the cloud is a great enabler.
It makes innovation a lot faster, but on the other hand,
not everyone has a common understanding
of networking, security,
and identity management and governance.
- Right, and many of us have experienced the impact of that.
For example, if you've got like 15 different teams
that are experimenting or running workloads
or maybe using 15 different network topologies,
things aren't going to match up
and you're going to be less likely to set things up properly
for consistent security
and maybe even governance requirements.
- Exactly, so with Azure Landing Zones,
we go beyond best practice documentation.
So we give you the building blocks and the scaffolding
at the workload or the organizational level
to ensure that any resource that you build or migrate
to Azure aligns with the rules and policies that you set.
So practically speaking, this means that we provision a set
of Azure baseline services that you deploy as code
via resource manager templates, policies and blueprints
to give you a landing zone to host your workloads.
Now, this ensures consistency across foundational services
like how you configure networking, identity,
resource organization, governance policy,
operations and more.
- We've all been there.
If you're managing things on prem, probably you have
a plan in place maybe for business continuity or security.
So this then is going to onboard you
into operational best practices in the cloud,
so that the right people can access your apps,
your services, your resources
and it ensures that your networking
is consistently configured
and any of the policies that you want in place,
those are there as well.
- Yeah, that's right.
And we give you a number of landing zone options.
Now, most people choose to start small and expand,
which helps you to centralize your operations incrementally
to learn the ways of the cloud.
Now, there are three main landing zones
to choose from in this category.
The first is focused on migration.
And this is where most people get started
when they want to lift and shift VMs into Azure.
The second is our foundation blueprint,
which gets you ready to add policy and governance.
And the third is a landing zone from Terraform.
- Can we take a look at some of these so everyone can see
what these look like in action?
- Absolutely.
So I'm going to pick a generic scenario that we see a lot.
Let's say I've got hundreds of VMs to move
in a limited amount of time.
I've got a mixture of non-mission critical workloads
and high-risk workloads with sensitive data.
And also I've got existing policies
and security and operations tools that I use on-prem.
And I want to have the same control, if not better in Azure.
Now of course, with this landing zone approach,
we want to learn as we go.
And so my goal is to move over the VMs
for our non-critical workloads first.
- Okay, so how do then Azure Landing Zones help
in this case?
- Well, first you need a few things before you get started.
You'll obviously need a target subscription in Azure.
and with Azure AD in place, you'll want to make sure
that your tenant has the right identity
and access controls configured.
And to help you out, you can check out
our best practice guidance at aka.ms/IDAMBestPractices.
Once you have these in place,
you'll search for Azure blueprints in the Azure portal.
I'm going to type in blue and click on blueprints,
which takes me to the getting started page.
Now, then I'll hit create
and I'm presented with a few options.
And in this case, I'll pick cloud adoption framework,
CAF Migration landing zone.
This gives me a starting point to create my blueprint.
So I'll go ahead and give it a name,
a definition location to define the resource group
where this will be stored.
Or you can optionally add a subscription.
And in my case, I'll choose Sub106 and select.
And then I'll move on to artifacts.
This presents me with a few foundational components,
and in my case it's provisioning resource groups
for shared services like Key Vault
that we're going to use to manage our secrets.
Log analytics for monitoring.
And behind the scenes,
it's also provisioning a storage account.
Networks, which will create a virtual network with subnets
for the gateway, firewall and a jump box.
And it's going to provision an Azure Migrate project
so that I'll be able to migrate my servers.
So from here, I'll save the draft.
And that's going to take me back to the getting started page
and you'll see the definition succeeded.
- Alright, so now you've got a draft blueprint
and you've kind of saved your progress,
but nothing's provisioning or being enforced yet.
- That's right.
And the nice thing with these blueprints
is that you can also go back and edit them at any time.
So next I'll go in to blueprint definitions
and back into the one we just created
and hit edit blueprint.
Now this is going to let me customize my landing zone
further and add some artifacts.
And you can see you've got a few options.
You can add policies that are applied to the subscription
or the resource group level.
You can assign roles to govern who gets to use resources
or add resource manager templates,
which will allow you to do further automation.
Now in my case, I'm going to select policy assignment
and add a policy for tagging.
So I'll search for tag
and I'll choose this one to append the tag
and its value to resource groups.
And this is going to ensure that any new resource
in my resource group gets tagged,
which is useful to track the resources.
In my case, it's going to help me create filtered views
later for my VM usage and costs of my migrated machines.
I can go ahead and add additional artifacts if I want to,
but I'm going to move on and save the draft again.
- Okay, so I there that there were a lot
of different options listed
when you're adding that tagging policy.
But what if I wanted to add more policies or artifacts?
How would I even know where to start with this?
- So I just showed a blueprint for migration,
but you can take the next step once you're more familiar
with policies and artifacts
and deploy the Cloud Adoption Framework Foundation blueprint
to your subscription.
So as you can see here,
it gives you a really useful baseline
with a handful of common policies predefined.
And this will also turn on native security
and operational tools like the Azure Security Center
to monitor security vulnerabilities across your resources.
- And one thing to note here: these blueprints
are complimentary and you can apply them
to specific resource groups
or also across an entire subscription.
- Exactly, and we actually encourage that
you start small and grow from there.
It's a great way
to build your operational muscle incrementally.
But let's go back to our migration landing zone.
So I'm going to publish the blueprint
and give it a version number,
along with some notes for the change.
And now with that published,
I can assign the blueprint to our subscription.
It's automatically going to complete the name
and the version, but I'm just going to add
a quick name prefix here.
And as a tip, you'll typically want to make sure
your locations match as much as possible.
So in this case, I'm going to select East US.
I'm going to add my organization name, in this case subdemo.
Now another tip here is to ensure that your name you choose
is unique and all lower case without any spaces and dashes
for this to work.
And this is similar to when you set up a storage account.
Next, you need to define the parameters for your artifacts.
Now for the tag artifact I added earlier,
I'm going to give it a name cost center.
And for value, I'm just going to type
"one, two, three, four, five, six,"
as well as the value needed for my Key Vault deployment.
Now to find that value, I'll jump into Azure AD
to show where that is.
For this, you'll typically want to use
a service principal account and grab the object ID
as you see here.
Now I'll switch back to my blueprint
and paste in that parameter.
I'll make a few other adjustments
for log analytics retention, choose East US region again.
Then I'll define my VNET's address space.
And with the Azure Migrate artifact,
we're going to choose Central US.
And this is mainly because at the moment
this service isn't currently offered in East US.
And finally, I'll click assign
and that's going to link my blueprint to my subscription
and the resources will start to provision.
Now that's going to take a moment,
but you can watch the progress as resources are provisioned.
Once everything has succeeded,
we can take a look at our new resource groups.
So if I click into the network and resource group,
you'll network security groups have been built
for Core and Jumpbox, and a virtual network was created.
- Right, and in this case, we actually picked
the cloud adoption framework,
migration landing zone blueprint,
but how does that link
to the Azure Migrate set of tools?
- Well from here, you can open Azure Migrate
and see it's been deployed to your landing zone.
And now when I migrate my VMs over using Azure Migrate,
they'll use my landing zone to connect
to the VNET I've defined,
apply my tagging and policies, enable monitoring
and adhere to whatever guardrails I've set up.
Now, obviously I'm summarizing a bit here for time,
but if you want more guidance on using Azure Migrate
to move your VM and other the resources into Azure,
you can check out aka.ms/MechanicsAzureMigrate.
But with this landing zone now active,
you've got a safe place to host your workloads in Azure.
And you can get familiar with Azure's management approaches
using Azure Resource Manager and Azure Policy.
- Right, and as you say, this approach really
to start small and scale helps you
to incrementally govern your environment.
But now what you showed can also be scoped
to a subscription or resource group.
But what if I need a compliant architecture
across a large enterprise on day one?
- Well, we've got some options for that too.
So for enterprise operations where you can't afford
to start small and expand,
but need a highly-governed architecture
before you can even start in the cloud,
we've got an architecture that builds out
a comprehensive Azure foundation,
and this in turn enables you to operationalize
and construct many landing zones at scale.
Now, the good news is that this helps you
to build centers of excellence for management, connectivity
and identity with security baked in throughout
to help manage your organization's cloud operations.
- Okay, so what are some of the options then
to get these up and running?
- So your options here are pretty expansive.
In the cloud adoption framework in Microsoft docs,
you'll see we have three reference implementation options
for enterprise scale.
The enterprise scale foundation landing zone,
which assumes all resources are hosted in the cloud.
The enterprise scale Virtual WAN,
which assumes hybrid connectivity with VWANs.
And the enterprise-scale hub and spoke for Azure
using VNET hybrid connectivity to on-prem resources.
And if I click into this last one,
you'll see we're going to provision new management groups
and subscriptions
with all the resources you see in this topology.
Now enterprise scale landing zones are good
if you need to move secure, mission-critical workloads
to the cloud right away.
And if you're already committed to migrating 100%
to the cloud,
this provides an upfront blueprint
to really kickstart your efforts.
And of course, if you're operating
in a highly-regulated industry,
this option can really accelerate compliance.
And everything's also available on GitHub
at aka.ms/GitHubEnterpriseScale.
- So can we get an idea then
of what one of these would look like then fully implemented?
- Yeah, absolutely.
I've got one right here.
So here we have the enterprise scale hub and spoke
for Azure reference implementation already deployed
straight from GitHub.
Now, right from my Azure homepage,
I can see that the landing zone
has provisioned separate subscription
for connectivity, landing zone and management,
along with a few other provision resources.
And if I jump into management groups,
you'll get a better idea of the group hierarchy.
I'll click into platform
and you'll see additional nested management groups
for connectivity, identity and management.
And drilling further under connectivity,
you can see the dedicated subscription.
Within that subscription, you'll see the resource groups
and here you can see it's provisioned a firewall,
public IP and VNET.
But this doesn't stop with group and resource provisioning.
Like our blueprints, it also deploys policy.
So here in policy assignments,
you'll see we've already provisioned eight policies
and initiatives that were assigned with this landing zone.
So even though this is highly structured
and builds out several services, the intent here
is to give autonomy to the workload teams
for their environment
and to make sure that the right resources
and guardrails are in place.
And that's really what landing zones are all about.
And you can start small and expand,
or opt for an Enterprise landing zone.
It's really up to you and what your situation calls for.
- And it's really great to see
that everything's not only been well thought out,
but it's also backed by automated provisioning
of resources and policies.
And it's not just reams
of documentation-based best practices
that a lot of us in IT grew up with.
This is the real deal.
So what's the best way then to get started
with Azure Landing Zones?
- Well to get started,
check out the Azure Landing Zones documentation
as part of the cloud adoption framework
at aka.ms/Adopt/LandingZone.
And there are some additional tutorials available
on Microsoft Learn at aka.ms/LearnLandingZones.
- Thanks Matt for the great intro
to Azure Landing Zones.
Of course, keep checking back to Microsoft Mechanics
for the latest updates.
Subscribe if you haven't yet, and thank you for watching.
(light melodic music)