Coming up, we are going to have a look how easy it is
to enroll Azure Management Services,
like monitoring, security center, and update management
to your hybrid and multicloud resources.
I'm here with Ryan Willis from the Azure Management Team.
And we going to have a look how you can leverage
the Azure Management Resources,
for your hybrid and multicloud resources.
Obviously we have a couple of awesome
Azure Management Services in the cloud,
for IT pros, developers, and everyone who needs them.
Can you tell us a little bit about, more about these?
Yeah, definitely.
So obviously there's too many to talk about today,
but let's focus on a couple of them.
First off is Azure Update Management,
which is really designed to help make sure,
that you are aware of which machines
in your environment are missing updates
and helps simplify when you actually go
and schedule those updates to be installed.
Secondly, we have Azure Monitor,
which is really the foundation of so many
of our Azure Management Services,
because it's responsible for collecting logs
and performance data from your servers,
which can be uploaded to log analytics workspaces
and shared with other Azure services
that can make recommendations
and analyze the log data from those machines.
And then lastly, we have Azure Security Center,
which is kind of our overarching view
of your security posture for everything
we're aware of in Azure,
including both the configuration of things
like your servers and Kubernetes clusters,
as well as higher level things like,
did you configure role-based access control
and network ackles correctly.
So let's talk a little bit about
some of the IT Pro related tasks.
I mean, I have seen many IT Pros actually spending a lot
of time doing update management for the servers.
It doesn't matter if they're Linux or Windows servers,
like update management is really
a big challenge for our customers.
And obviously we see that in Azure, we have
as you mentioned, we have update management
and you just said that, like with Azure Arc,
we can actually extend this
to our hybrid and multicloud resources.
You know, the real benefit of Azure Arc
is that you see all of your resources
in the Azure Control Plane
and it makes it easy to go
and discover and onboard to services like update management
which can really simplify your life.
And so to help explain, what's going on
here for an IT professional, who is managing a server
and potentially the updates on that as well.
Let's take a look at a demo
of Update management on Azure Arc.
Okay, so I've opened up a Azure Arc server here
and you'll notice on the left
we have an Update management tab.
If we navigate there,
we will see the current status of updates on this machine.
Now, if we haven't onboarded Update management yet,
this might be blank, but we'll provide instructions
on how to actually get it all set up.
But the idea here is an Update management view,
you'll be able to actually go and see
all the updates that server might be missing
and the severity and classification of those updates.
And you can go in and create schedules as well
for when you want them to be updated.
But if we head over to the multi machine view,
so if you're a responsible for managing a group of servers
this is where it really starts to shine.
And so here you'll see a list of
all of the servers the update management is monitoring
whether or not they are up to date.
You'll see one of these servers
is missing a security update.
So, it is marked as non-compliant
but the others are just missing some less important updates.
So they're, they have updates
you could install, but they're deemed compliant.
And so from here,
we can actually go and create an update schedule.
And the update schedule is when you actually want to go
and push these updates out to a server.
You might choose to do it as a one-off update.
If there's a particular set of updates you want to do
or if you want to maintain full control
over which updates get pushed out
and you'll select which servers you need to update as well
as when you want the update to be pushed out.
Now, if you want to do a more automated approach
you could also do a recurring update where
say the third Sunday of the month, you can go and
push out the updates to each of your machines.
So the choice is yours, but the experience is the same.
You can tell us how much time
you allot for your update windows.
If the updates take longer than that amount of time,
we'll stop updating and just update the status
with which updates are missing.
And you'll be able to track the history
and success rate of your update jobs right here
in the Update management experience.
Oh, this is awesome.
Again, this is really like
I have helped and worked with so many IT administrators
which needed to take care of managing these updates.
And you obviously run into different scenarios
where you probably wanna schedule updates.
Like probably you wanna run like on a group of service.
You wanna run it every Tuesday night.
And the other one would be probably in first day night
and Azure Update management really makes that so easy now.
Another task where IT Pros and developers
obviously can benefit from is
when it comes to monitoring, right?
We all need monitoring solutions.
We need to know how are our systems performing
in terms of performance
but also when it comes to like troubleshooting or
when even, when we know that there's probably like
not enough disc space anymore and things like that.
So I know that Azure Arc, can help us here as well, right?
Yeah, definitely.
So we give you a one-click experience to go set up the
Azure Monitor Insights for VMs feature.
And this gives you a wealth of information.
So when we think of Azure Monitor is kind of two halves
there's the log collection half where you can go
and tell it here's the logs that matter to me,
please collect them and let me query
across them for a single machine
or maybe a group of machines to find interesting events
or track down a potential issue with that server.
And then there's also Insights, which are focused on
being able to understand how the server fits
into your network, as well as the
performance counter information
for its usage of resources.
So let's take a look at a demo of this in action.
So we're back here, again, looking at our
Azure Arc server and on the left side now,
if we head over to the Insights section
we'll be able to take a look
at the data collected from this machine.
And we start on this map page, which is the dependency graph
of network connections, both in and out of the server.
Now my server doesn't have any
inbound connections right now.
It's still a Dev/Test server.
So it's, hasn't been doing much
but I can actually go in and click
any of these connections out
and see how much traffic is going over them,
how frequently they're connecting.
And it's very useful information for understanding like
is this machine being used by others
if I were to potentially decommission it.
Now over here on the performance counter page,
we can take a look at the current disk usage,
CPU utilization, available memory.
And you can even set an alert up such that
if you start to run out of space or you find that over time
you are using more CPU than you expected
at certain times of day,
you can set up a web hook or an email or a text message
so that you get an alert when you have some servers
that are potentially running out of capacity.
Now for these experiences,
much like everything else we've talked about,
there's also a multi machine view.
So in the Insights page
we are able to see across my entire resource group
how all of my servers are doing.
So if you have an application it's distributed
across multiple machines, you might want to go
and figure out if one of them was potentially spiking
and investigate where potential bottleneck might be.
So if we think about Kubernetes as well,
it's just a similar experience
for being able to monitor your Kubernetes clusters,
but let them illustrate how to actually onboard one.
If I had over to the Azure Monitor page
and go down to containers, you'll see a list
of all those clusters, which are currently monitored.
But if I go to unmonitored clusters,
I'll be able to see here that there,
it knows, there is an Azure Arc cluster that is
not yet onboarded to container insights for Kubernetes.
So if I click that and then go to enable it,
I will be able to automatically deploy
the necessary prerequisites to that Kubernetes cluster
to go and start monitoring it.
This is done through an extension model.
So, if we head over to the
Kubernetes cluster and look at its extensions,
you'll be able to see that this is currently in progress.
And once it's done,
it'll start collecting all the logs
from the containers in that cluster
and give you a similar insights into,
you know, resource utilization
and make it a lot easier for your developers to understand,
you know, are the issues we're having
potentially with our app related to the infrastructure
or my application.
This now like seeing all these monitoring information
side by side, doesn't matter if they're running Azure
or outside of Azure, this is really fantastic.
And again, it's not just about servers, as we said,
there's also Kubernetes clusters we can onboard.
So we can really get that whole view
of everything which is going on in our environment.
So that, that is pretty cool.
I also want to quickly highlight one point you showed it
at the beginning is the log analytics part
which is obviously very great.
I cannot just get like performance logs.
I can also get auditing logs and security logs, right?
And I know that we can also leverage
these logs even further, right?
Using, for example, Azure Security Center.
Absolutely. Yeah.
So if you use Azure Security Center or Azure Sentinel,
these tools can plug into the log data
and they will actually
tell log analytics which logs they need to collect
in order to provide you recommendations
about the security of your systems.
And then they will automatically analyze them
and provide really useful insights.
For example, detecting unsuccessful log on attempts
to your server, and they have their own logic
to be able to throw that into an alert,
or if you're looking from the
security operator point of view with Azure Sentinel,
you know, you can create your own queries
on this data and get a deep understanding
of the audit events and security events
that are coming out of all of your machines,
right from the Azure portal
using a very easy to use Kusto query language.
So, can you show us a little bit
more about security center?
Yeah. Let's go take a look, actually.
All right.
So we're back here in the Azure Portal,
looking at the Security Center page,
and this is really your hub
for everything you need to know about the
security of your resources that are registered in Azure.
The basis of this is really the Secure score.
It's a single number you can look at
and get an understanding of how am I doing
on important configurations that could impact
the security of my environment.
But we can also look at things like regulatory compliance.
So if we click here, you can opt into
a variety of different regulatory standards
where there's predefined policies and checks in place
so that we can provide you information about your adherence
to the controls specific to each of those baselines.
If you don't have a particular one in mind,
we have a great Azure Security baseline you can start with
and you'll see for each of these items that
we are able to measure your compliance
across all your resources.
Now there's also Azure Defender.
This is an optional component of Azure Security Center
that provides really deep analytic insights
into what is happening with all that log data.
So we were just talking about, you know,
being able to throw alerts when there are
malicious logins on your machine.
That is a capability of Azure Defender,
but let's also look at vulnerability assessments.
So, there's obviously huge potential to run
software on your servers that have known vulnerabilities
for CVEs or potentially outdated versions.
And your Azure Defender for servers license includes
access to a vulnerability assessment solution
that can go and analyze this for you
and show it in a very easy to use interface.
We also make it easy to onboard.
So you'll see here is a couple servers that I have,
Arc and Azure that are not yet onboarded
to the vulnerability assessment solution.
So I can just go here and click through and say, look,
I'd like to install this automatically on my server
so that I can start getting these insights.
And this is one of those things
that's measured in that Secure score.
We want to make sure we are collecting data
so that we can analyze and give you
that best recommendation.
And then when we head into the recommendation section,
we can actually drill deep into the
vulnerability assessments and take a look at
what data came back for these servers.
So, we see here a list of software found
on these machines with associated severities.
And it's got everything from, you know,
configurations of autoplay and windows
to outdated versions and known vulnerable
software that's installed on our servers.
This is fantastic.
I mean like the sheer power we can offer here,
not just in terms of tooling,
but also the data via, or having from
like a tax our against our infrastructures and our services.
We basically gather all that data and put that
in our threat intelligence and actually give that
to our customers when they run an Azure
and with Azure Arc.
We also give any the same technology
and making the available, the services available for them
even if they're run outside of Azure.
And I think that, that is pretty cool.
If people want to learn more about this
like you showed us a couple of different operational tasks
like in terms of update management,
you showed us monitoring how developers
and IT Pros can leverage that
as well as when it comes to security.
We have Azure Security Center
and like we can leverage Azure Sentinel, as well.
So where would people go to learn more about this?
Yeah, so the best place to start was probably
the Microsoft Docs.
So we have docs for each of these individual services
as well as some information about it
in the individual Arc pages as well
with regards to how they tie in with Azure Arc.
But you'll also find some examples
in the Azure Arc jumpstart site, ready to use
configurations that already have like
the monitoring agent deployed for you.
And of course, you know, there's also gonna be some
great videos on all of our tech community sites and blogs
that can help you get started with unique
and potentially interesting combinations of these features.
Thank you very much, Ryan.
This was really helpful.
And for those who are watching, if you're working
in a hybrid cloud environment or multicloud environment,
make sure you check our cloud adoption framework
and our Azure Architecture Center to find out more.