Microsoft works with customers across the world and in the past some customers
chose their cloud providers by looking at their competitors so they didn't end
up on the same cloud I mean think about it if you've used Asher for any length
of time you should know that our subscriptions are boundaries and our
networks are also boundaries but the underlying physical hardware that all of
these things are running on do exist in a physical location in a physical data
center somewhere in the world so when you run your VM you are isolated and
separated from all of the other people running VMs on that same host across
multiple different subscriptions but sometimes for customers that's not
enough there may be regulatory or security reasons why they need an extra
layer of separation but Microsoft wants a sure to be the cloud for everyone so
it's been built from the ground up to provide a lot of separation but still
have everybody running on in the same regions in the same availability zones
in the same data centers on the same racks and sometimes on the same hosts as
others so we've got to still be able to do that while giving the option to
somehow be separate from everyone at the same time that sounds like a really hard
problem to solve but Microsoft has done the hard work to make it easy for you
and we're gonna talk about how you can take advantage of it today with Azure
dedicated hosts
I'm Dean Cefola and this is the Azure Academy the story of dedicated hosts is
really a straightforward one we want to take a physical host running in Azure
assign it to a particular customers Azure subscription so that no other
systems are going to run on that host that way we isolate the compute and the
memory of that host to one customer and that way we provide a area of isolation
and security and here's the main page for our Docs this is Doc's top Microsoft
comm and a short link to get there would be a kms /as your Doc's when you get
here you go to products and then we can go to either Linux or Windows virtual
machines and in the table of contents link we want to go under the concepts
and under there go to dedicated hosts so basically what we're going to do is
create a host group and inside that host group which is a Azure resource
construct we're going to create a dedicated host which will then select a
host out of the particular availability zone fault domain all in the region that
we want and take that host and assign it to our subscription which then we can
provision virtual machines from now there is another feature that we'll be
doing a video on real soon called proximity placement groups which are a
way to reduce your network latency between your VM workloads and if you are
interested in that click the subscribe button so that you don't miss that this
is not directly related to that feature although you get a similar benefit
because you're running your VMs on the same dedicated hosts and then they will
obviously be very close to each other so you do get reduced network latency but
it is not the same thing and we'll get into those details in that other video
now there are some high availability considerations to take into account and
then of course that gets into using availability zones and fault domains
matter of fact let's take a look over in the table of contents real quick here on
availability and performance and specifically availability so this is
where we get into all the high availability constructs in Azure
specifically availability zones availability sets zones are where we
have a certain amount of data centers within an azure region we take that and
depending on where they're located we then break that into different zones and
there will be many zones in a region your particular subscription will have a
zone assignment that we will call zone 1 zone 2 or zone 3 you don't have to
particularly worried when are any of these things exist in the real world all
you should be concerned about is that you put your stuff in zone 1 or zone 2
or 2b zone redundant you would have something in zone 1 zone 2 and zone 3
that depends on your architecture for your applications but along with that we
also have availability sets and availability sets are within the data
centers themselves we have racks of equipment each of those racks contain VM
hosts and then also storage and then we map that across racks and we call those
fault domains so every rack is its own fault domain and then we have the
logical construct of update domains which is going to spread across multiple
racks and both of these things are something you need to be aware of in
figuring out your dedicated host build-out and placement so let's jump
over to the azure portal now and get started so at the top here we'll go to
create a new resource and I'll type in host group and we'll select that and
we'll click create and I'll create a new resource group for this and I'll call it
a a host group and hit OK and then we need to give our host group a name and
we need to place it in a location like every other resource and now we have our
choice of our availability zone and fault domains remember those are the
racks that we're going to span this across so for the availability zone our
options are zone 1 zone 2 zone 3 or none now this is again dependent on the
region that you select if you select for example South Africa north you can see
that there are no availability zones present there I'll just choose East US
and I'll put my stuff into Zone two and then the number of fault domains that I
would like would be to because I'm gonna have
two hosts and I want them on different racks and we'll click Next and then add
the appropriate tags so I'll use a tag for my cost center so I know who's
paying for this what environment I'm in my application of the Azure Academy and
when my maintenance window is going to be Thursday at 6 p.m. and then we'll hit
the review and create button and the validation has passed so we can build
our host group now before I do I want to show you the link here for the arm
template so you can capture this for future use and you can see the same
basic parameters here as well so just be aware of that and we'll hit create and
that should take just a moment and then we'll be ready to provision our host and
our host group is now complete so let's go to that resource and just to give you
the quick tour you see across the top here the resource group that it's in how
many hosts are provisioned with the availability and fault domain counts are
the region and subscription that it's located in as well as all of the tags
now like every Azure resource we do have an activity log here and you can see
just one entry so far just being created and we have access control so you can do
all of your roll assignments as well as look at all of your tags add new ones
remove other tags and then the properties pane where you'll find the
resource ID for your host group we also have resource locks and I'm gonna add a
lock here and this will be a delete lock and that's gonna protect this host group
from being deleted even by the owner in order to do a delete you will have to
remove this lock first and then we have the link for the export template which
again gives us the arm code to be able to deploy this again in the future now
the one thing that isn't here is a button to provision new hosts but we can
search for that in the top and we have a link here for hosts so I'll click that
and click to create a host we'll want to put this in the same resource group and
then we need to give our host a name and then select the appropriate region again
should be the same region where our host group is and now we have to select our
hardware profile that begins with selecting a VM family now we have here
the DSV 3 es v3 and FS b3 and these are type ones and this is a type 2 now what
does all of that stuff mean the de and F families are all series of VM SKUs and
the types refer to the different hardware generations so this is a newer
generation than these guys are so I'm going to select the f-series here and
then we have our number of fault domains and I'll select two fault domains then
we have the option to automatically replace a host on failure now what this
will do if we choose this to be enabled looking back at the docks is
to do some automation around the host lifecycle and if you run into some
issues with your underlying host the host will first be under investigation
when there's a problem and we'll determine what the root cause is and if
that requires action on our part and then we will put the host into ad
allocated state assuming that you choose this feature to be enabled and the VMS
will move off of it to a host that is running all right until your services
can be healed and restored otherwise the VMS running on that host may fail if the
host does so this is something that I would recommend but if this is a lab
perhaps you would not want this feature enabled then we come to the part where
you can enable the azure hybrid use benefit and this feature if you did not
see it as part of our cost-saving measures video you can go and check out
the YouTube card up in the top corner for that and basically if you have
Software Assurance on your Enterprise Agreement then you can turn this on and
that way you won't be paying for the windows or sequel licenses in Azure and
then we'll hit next and add our tags and so we've added a cost center again so we
know who's paying for it our application environment maintenance window and we've
also added a business unit that way we know which department is running this
host and we'll hit the review button here and our validation has passed so
let's open up our arm template and I'm gonna take this template and add it to
my library and I'll hit save for that so I can provision my second host really
quickly and then we'll hit the create button and while that's provisioning
I'll go to my template library inside asier
and i'll open my template for my new host and hit deploy and then I just have
to fill out the appropriate parameters and now I can kick off that second
deployment will hit purchase and both of those should be done in just a few
moments
and now that our hosts are done let's open one of these guys up and check it
out and it looks very similar to our host group across the top we can see the
hosts ID as well as the host group it belongs to the VM a family how many VMS
are currently deployed and the number of fault domains and then we've got our
activity log access control and tags like on all azure resources and then we
have the instances and these are the particular BMS that we have deployed
which we can do from here or from the regular VM screen which I'll show you in
a moment and under the configuration tab we've got the ability to turn on the
azure hybrid use benefit if you did not have that at the time that you
provisioned but you do have that at a later point and then the properties
again where you can find the resource ID and then locks and exporting your
template now of course as I said we could deploy a VM from here so we'll do
that for one of our workloads and it looks just like the deploying a VM
screen always looks so we'll give this a name so called as dedicated VM 1 we'll
put it in east us and availability zone number 2 and then we have to pick a VM
size that is compatible with our hosts and so I'll pick F 2's underscore b2 and
hit select and then we do everything pretty much as usual so I'll give it a
name and a password I'm not going to have any inbound ports but I will enable
the azure hybrid use benefit I'll set the VM for standard SSDs we'll hit next
for the network here and I do want to change the network that we're using as I
want to use a different address space and since we're changing the address
space we also have to declare a subnet range and then we'll hit OK and I don't
need a public IP or network security group for this VM we'll hit next and the
management screen looks just like it always has and there's the link to
enable Azure Active Directory authentication and you missed our video
on that you can check that out in the YouTube card at the top and we'll hit
next for advanced and then here we can select our host group and then we've
found two hosts that are here I'll select host 1 and there's that link for
proximity placement group and subscribe if you want to see that
video so hit next for our tags and so we've set our cost Center our
environment will be dedicated host or the Azure Academy and our business unit
this time we'll be accounting so we had our host which was dedicated to IT and
now we're provisioning a workload for the accounting group as part of that
host and we'll hit next and again before we do the build we'll look at the
template and in general this is a normal VM build but looking at the virtual
machine resource we can see that there is a host ID that is here and that's
telling us that we can build on a particular host that's in a particular
host group so if you wanted to use this on your existing VM templates you can
just add this one parameter and I'll also show you how to do this on existing
VMs as well Oh hit create and that'll get underway so let's look at an
existing virtual machine and these are all the VMS that I have and we've got
two here that are labeled as existing at VM one and two and they're in a stopped
and D allocated state which is important because you cannot change a host setting
if you are running so I'll open one of these VMs and under the configuration in
the blade you can see we've got our host and hosting note that you cannot join a
host you must first join a host group and now you can select a host and I'll
choose host number two and hit save and I'll repeat that on the other virtual
machine under configuration host group and then host we'll save and looking
back at our host group resources under host number two under our instances
we've got our two hosts now listed here and note again that the virtual machine
family that the VMS are a part of needs to match the VM family that the host is
servicing and if we just check back with our original host group we can see both
of our dedicated hosts are listed here and if we click on our hosts link that
takes us to our dedicated host and then we can see our instance count we've got
our dedicated VM that we have deployed so I hope that you've enjoyed looking at
a dedicated hosts a way to create hardware isolation in the public cloud
I can have a physical server dedicated to my subscription to isolate myself
from anyone else that's running in the cloud and this will have real great
application in high security environments high regulatory
environments or just somewhere where you're concerned that you don't want
someone else's stuff running on the same physical host as you are so if you
thought that this video was good please give us a thumbs up and join us here at
the Azure Academy by clicking on our subscribe button and if you'd like to
get an email when our videos come out which is roughly once a week and you can
click on the email notification bell as well and we're here just to help
everyone learn all they can about Azure so if you'd like a video to be
created on a topic that we don't yet cover please give me some comments down
below and we'll be happy to do that thanks for joining us today and we will
see you in the next video happy learning