Hey everyone, my name is Alfred Sin and I'm a Program Manager working on Azure Automanage. Thanks for joining the session,
today I'll be talking to you
about managing your servers with both Azure Automanage and Azure Arc
So Azure Automanage is a fairly new service, we're actually still in public preview as of today so I'll give you an overview of how we got
to Azure Automanage,
the customer problems we're trying to address, and we'll talk about how we intersect with Azure Arc and once you
understand the story it'll actually make a lot of sense that we're bringing Automanage
over to Arc
So, that being said le'ts talk about how we got here. So one customer challenge,
overarching customer challenge that we're aware about is the complexity of IT management
sys admins have to stay up to date with so many different things and deal with so many different challenges on a day to day basis. We
spoke to a lot of these
customers and you know we ended at three different buckets of where the challenges lie. One is just the opex overhead
so the continuous day to day nonstop tasks of just making sure things are backed up properly make sure you're ready for a disaster
recovery scenarios to making sure you're staying on top of updates
making sure you're staying on top of security and whatnot. This takes us to my second point which is the whole improving operational
security so
sure if you classify operation security under OpEx but is also worth its own separate call
out because the sheer work as required in staying up to date against the latest threats
so that's extra time, extra opex that our sysadmin customers have to take into consideration when they're managing their IT
workloads and then the third piece, the third challenge the customers shared with us was keeping pace of innovation so
you know the whole prospect of Azure building a new features and delivering a new things so quickly makes it a challenge for customers to
stay on top of what's new with happening with API Services can be helpful, which might be deprecated in the future which one they should
move to - just staying up to date with all these management tools that are being built so regularly.
Now some of the customer commentary we received that backs up our thoughts are your customers don't want to
manage the servers or spend time on menial tasks and then another Fortune 500 apparel and sporting goods company basically told us
that anything that differentiates or simplifies the day to day management of the OS is a differentiator. So these are things that
we kept in the back of our minds as we were coming up with the idea and the scope of Azure Automanage.
Now, here's a summary of
some of the feedback we received. Customers don't really have any motivation to refactor their line of business workloads to cloud-
-native. So in other words if customers are running something on some servers on prem then if it's working then why
would they want to refactor that and go through all the effort of making sure it works again in another environment?
Which takes me to my second point which is that the cloud represents not much more than a different place to incur the same level of OpEx
It's just a different environment. Here's an example occurred a backup on-prem, well
you probably want to backup in the cloud. And if you do monitoring on-prem, well you probably want to set up some monitoring in the cloud.
And so on and so forth. You can think about it similarly with updates.
And a third piece which you know we touched on a moment ago - it's just hard to maintain lockstep with the cloud's pace of change.
There are so many things happening in the cloud all the time and it's hard to stay on top of those.
So some lessons that we learn from all this feedback. Customers still have these line of business applications
running on what we call classical computing architecture so there's millions of bare metal or virtualized server instances that are still
running around on premise and these line of business applications really aren't going anywhere. So there's this huge long tail that
just work...so what's the point of doing anything to them if they will just work and serve their needs? So we have to ask ourselves (we as
Azure and, you know, the Automanage team), simplify and add value these classical computing scenarios?
which takes us to our netx point about what might be missing here?
I'm sure we're all familiar with the paradigms IaaS and PaaS and SaaS. IaaS being just a standard lift-and-shift, migrate your workloads
from a
server on prem into a VM in the cloud, PaaS being any platform service offered, and SaaS.
But we figure there's something missing in the middle that helps bridge that gap between infrastructure and platform/software
as a service. Something that makes that transition a little bit easier
We were kind of calling it OS-as-a-service, where we take care of the day today repetitive management
operational tasks at the operating system level for the customer so we replace repetitive day to day tasks with this exception-only
management model where if things are working you don't hear from us
only if things have failed, if something has really really truly gone wrong with your VM, that's when you'll hear from us
So that's where we landed with Azure Automanage. Currently we have been offering called Azure Automanage VM Best Practices.
This is based
on a set of best practices that's published in the Cloud Adoption Framework which is a publicly available documented.
If you search for Azure Cloud Adoption Framework, that'll get to it. Basically what we do is we will eliminate the need to discover an
onboard to
select best practice Azure services. So for example if you're onboarding a bunch of VMs to the cloud
and you're not sure which services to use with your VMs for an optimal Azure experience we take care of the headache for
you so we have this curated set of best practice services, you don't have to figure out what they are, you have to figure out onboard
them
we'll do that for you. We'll will configure them for you per Azure best practices, and we'll also apply a guest OS baseline. So there's a
Windows baseline and there's
a Linux baseline that we apply to your VMs and that will configure your VMs per a bunch of security recommendations.
We will also monitor your virtual machines for drift. What we mean by drift is: let's suppose backup gets disabled on your virtual machine
after you've onboarded
to Automanage. Well if backup gets disabled and all of a sudden you might not have any more backups left to fall back on in the in the
event of
any sort of interruption to your business your application and workload, so
in that case, we as Automanage will actually monitor for backup and if something gets misconfigured, we'll detect that as drift and we'll
correct for that across a VM's entire lifecycle. Backup is just one example, some there's a few more and I'll talk about them in a moment.
From an onboarding perspective we offer a point and click portal experience, so again I'll demo that to you in a moment as well. We also
offer an Azure Policy
for at-scale scenarios. For when you want to onboard a large amount of VMs onto Azure Automanage.
And we also offer ARM templates, so you can enable Automanage via ARM.
Now you're probably wondering where this all fits with Arc. So the exciting thing is that we're actually making Automanage available over Arc.
The following services, these six services on the left side of the screen that you see are the services that are available to Arc enabled Automanage servers.
OS baselines, as I mentioned, will enable Azure Guest Config and will apply certain baselines to your machines.
With VM updates, we'll onboard you to Azure Update Management, which allows you to then create your own schedules and define when
machines get patched and when you get rebooted for patches. Monitoring will enable
monitoring services of VM Insights Monitoring and Log Analytics on your machines.
We'll also enable Azure Change tracking and Inventory which lets you have a look at when
files or programs might have been changed inside your machine,
we'll also on board you to Azure Security Center and of course a supporting service is the Automation Accounts. So this is required by
a couple of the underlying services here. Two other noteworthy services that I'll call out - these are currently only available in
Azure Automanage, not available in Automanage over Arc. If you onboard a virtual machine to Automanage, you'll also get
backup and antimalware in the form of the
Microsoft IaaS Antimalware Extension.
So this has been a lot of words, I've said a lot of things so let's hop into a demo in the portal.
I'll show you what I really mean by Automanage and Arc.
Here I've got my Azure portal
This is the Automanage blade in the Azure portal. You can find this by simply searching for Automanage.
In my case I'm already here. So to onboard a VM - let's do this - we'll onboard a machine onto Automanage, it'll be an Arc
server and we'll maybe maybe throw in an extra VM as well, just for fun.
So this is the enablement flow so there's three pieces to this there's the machines there's a configuration and then optionally there's an
advanced section. For machines, this is where the Arc piece comes along. We go into
here, and then we can search for a bunch of machines. All of mine show up.
Then I will just onboard the top four. There's a few Linux, there's Windows, there's
Azure virtual machines, there's Azure Arc servers, whatever, this will all work in Automanage.
Now let's skip down to the configuration, which is the next step. You'll see I've got two environments here: there's a dev/test and there's a production environment.
so when I compare them, that's when I see what's available
in each environment and which services actually get enabled for me. So I've got machines insights monitoring, backup
Azure Security Center, Antimalware, Update Management, Change Tracking
Guest Configuration with the baseline. So the one interesting piece about the guest configuration baseline is that it's applied a little bit differently
for both Linux and Windows. In Linux, we apply the baseline and just an audit only mode so within
your guest assignments you get to see each individual line item in your baseline and
how your virtual machine or you Arc server might differ from the recommendation in the
baseline, but we won't actually change anything in your server.
From a Windows perspective we will go in and will do an audit + remediate so we'll actually go in and correct things that are not comformant
with the baseline. So that's an interesting piece to note there.
Automation Account, Log Analytics workspace, like I mentioned, they're supporting services for some of these
above, and then boot diagnostics for Azure virtual machines
That's what we enable for the Production profile. Now if we switch to Dev/Test, you'll notice that monitoring and backup disappear
because they both charg a little bit extra within their service so we don't want include them by default.
And I mean, in a dev/test environment you probably don't care too much about backing up or monitoring it
So that's that, I'll leave it as production for now.
You'll notice a configuration preference as well so I can also create a new preference which will allow me to do a couple extra detailed things
Now I'm going to show these to you, do note that they are only available for azure virtual machines and are not yet supported for azure arc.
So there's backup, you can tweak some of the
backup frequency or how long I retain it for. And then for Antimalware there's a bunch of settings as well that I can tweak or I can just disable it
altogether. Now, since I'm onboarding some Arc machines, I'm just going to stick with the best practices
and then I'll talk about advanced here as well. It's pretty simple, it's just an Automanage Account, just an identity under which
Automanage will operate to do things in your subscription.
There we go. That's the ongoing process! So now I hit enable, we'll wait a little bit, mean it takes about 10 minutes to get everything on board
so we won't sit around here, I won't subject you to sitting around with me for 10 minutes while these things onboard
but now they're in progress and they'll be onboarded.
So let's pop back over to the deck.
In terms of supported operating systems, this is all we've got so far so obviously we've got Windows Server support, 2012R2
and above, we've got some CentOS, RHEL, Ubuntu, and SLEs support as well. You can see the different versions here
Take a screen shot of something or these are all noted in our docs if you want to cross-reference against what you currently have.
Now here's some extra details about our current state and current support features and whatnot. As I mentioned earlier, we are in
public preview, we support both Windows and Linux on Azure and Arc so
both different types of OSes and both different platforms
you can use Automanage on all this stuff.
and in terms of pricing, this is another question that we get a lot
We're free! We don't charge anything to use Azure Automanage
and we intend for this best practice service to be free for the duration of its life. But do note
that some of the services we enroll in will incur some usage fees so again, backup for
example will charge a little bit for the backup vault for storage incurred there.
Monitoring will charge a little bit for the metrics - to store those metrics,
just the data storage there, so there's a little bit of a fee there.
Now, from an Automanage and Arc perspective, our supported features: of course the Hybrid Instance Metadata Service (what would we do without it)
there's Guest Config and baselines, Azure Monitor, Azure update management, Azure policy and change tracking & inventory.
With that, I'll wrap things up, thanks for listening to this on demand session and you can check
the links here to try out both Arc and learn more about Automanage.
And if you ever have any other questions or anything feel free to reach out to this e-mail, AutomanageExperts@microsoft.com
I'm one of people in the mail but there are a ton of other people, well, a handful of the people behind it that are super super helpful
and very knowledgeable about Automanage from the product team and whatnot.
Thank you for your time and I hope you enjoy the rest of the hybrid event!