>> Welcome back to another episode of the Azure Enablement Show.
This is the third episode of our short series on how you can
deploy Azure landing zones using bicep.
Make sure you check out the descriptions for all the resources and
link and subscribe to the channel so you don't miss an episode.
[MUSIC]
>> Welcome back. My name is Thomas and I'm
joined by Jan and Jack for deferred episodes
of the Azure Enablement Show on how to
deploy your Azure landing zones using bicep.
In the last two episode,
we basically established and built
all the required Azure landing zone platform components
such as the networking lock analytics,
the policy assignments, as well as
obviously the management group hierarchy.
But before we actually go in to how
we enable the application landing zones,
and just like subscriptions for that,
can anyone of you tell us a little bit what are
the differences between the platform and
the application landing zones and
other different types of application landing zones as well.
>> Yeah, fantastic question Tom, wasn't that?
If I just share my screen here,
we actually recently updated our documentation about this.
If you go to the Cloud Adoption Framework page
and you go to what is an Azure landing zone.
If you scroll down here,
you'll see that there's a section
here called platform versus application landing zones.
If we just navigate to that part of the document,
we actually detail and document what the differences are here.
You're absolutely correct.
There is a difference between platform
and application landing zones.
Platform landing zones would
contain the things that we've deployed in
previous episodes like the hub network logging,
the security modules,
and automation accounts and those things.
Maybe your identity services or Active Directory.
Then the application landing zones are where
your application or workload teams deploy that workload.
Things like Azure Virtual Desktop or
the Azure VMware solution or SAP,
all of those things would live in here.
There are different types of application landing zones,
whether it's centrally managed,
whether it's a technology platform,
a bit like your VMware solution or Azure Kubernetes service,
or whether it's just a standard workload like
a new modern application that doesn't really
have a type is just a workload.
We also have some documentation and some guidance around those.
>> Thank you very much Jack for clarifying
the differences between the application
and the platform landing zones.
Jan now since we notice now,
can you tell us and show us how we can
enable these application or workloads landing zones?
>> Definitely. I actually prepared this File 1 presentation
because the thing is that
once a platform team has created subscription,
it's not by any means done.
The platform team will need to
place the subscription in the correct management group.
Can be either call for online or another flavor of the same.
They may need to create a virtual networks.
They need to create the configure DNS.
They may need to peer the virtual network back to the virtual hub
if on-premises connectivity is
required or they may need to connect it to a Virtual WAN,
which would occur, so basically the same thing.
They may need to create a route table and
add a user-defined route to connect to
either add virtual appliance for
firewall services or Azure Firewall for that matter,
if we're running a health virtual network.
They need to create role-based assignments for
the application team owners to be able to
actually access what they would like to.
>> Okay, that's great, but that sounds
like a lot of [inaudible] steps.
Do we have easier way of doing that?
>> We do actually, we are fortunate
enough and you can see here we've go to the GitHub repo.
We do actually have a community
contributed module which we'll do quite a lot of those steps.
You're in infra-as-code/bicep/orchestration hubPeeredspoke
and just goes through the Read Me here.
What it does is it places the subscription
in the correct place in the management group hierarchy.
It creates a virtual network,
it creates a UDR.
It creates hub to spoke peering and spoke to hub peering.
It creates a virtual Wan network connection
if it's that kind of scenario.
Let me just show you how that works.
The whole README is build up the same as the other modules.
I'll just go to here and I have my trusty command line here.
I'll copy that. Then I'll go to my Cloud Shell.
Actually, I have the subscription,
which will play the part of that platform
subscription now, completely empty.
Now start the Cloud Shell and I will on this.
It goes through hub peered spoke parameters.
You'll notice I already changed
some of these parameters in the interest of time.
The top-level management group prefix was changed.
The subscription, which the subscription ID
of subscriptions that needs to go to another management group.
Where their management,
which management group it needs to go to the name of
the Vnets and the resource ID of the hub virtual network.
That's already been changed.
I now just need to choose this to aes.
End-of-life. That will take between 5-10 minutes to deploy.
>> Okay, absolutely great.
Jan is actually is deploying.
We have seen all these different modules.
I want to ask, I do
create additional modules or addition to different modules,
like for example, Active Directory domain controller,
VMs for the identity module, and much more.
Are you working on things like that?
>> We absolutely are working on things like that.
However, I want to make it clear delineation.
So actually, the module that Jan has just showed and deployed
store it offers a request for an active Directory module.
We very much deem the deployment
of Active Directory and the VMs and
all of the associate configuration that goes with
that as the application side.
Whereas Azure landing zone is very
much focused on the platform side.
If I asked three different customers,
what's your setup for Active Directory domain controllers,
I'm pretty sure I'd get
three different answers because everybody is very different.
We don't want to get
involved in saying this is what should be done.
We want to establish that landing zone subscription
connected to virtual network back to
the hub and make sure the policies are assigned to
it to govern what must be true for that landing zone.
Then hand over to maybe the identity team
or the Active Directory team in that business to go and do it.
But we are creating other orchestration modules
to help customers do these more complicated steps,
to have a lot of individual components in
a more seamless one deployment style method.
>> Well, it sounds absolutely fantastic that we
helped customers do accelerate even more.
But also, again looking at their legacy,
they already, as you mentioned,
they're probably have already their structure.
They already have a setup for certain things and
obviously we don't want to interfere with that,
so that makes absolutely sense.
>> Okay, so the deployment
finished and now let's go and see what happens.
As you'll notice, we now have
the subscription I mentioned before in the aes-landingzone-corp.
If we go here, it's created a resource group.
Then the resource group is
a route table and Vnets and spoke Vnets.
Then I'll group these spoke
Vnet and [inaudible] there is a peering to the hub,
which goes both ways.
>> That's fantastic. Again, I love that we can
do this all using infrastructure as code,
especially by sap to deploy all
this and how everything works together from
building the Azure landing zones like
the platform ones as well as the ones for applications and
workloads and that they didn't even connect
together like the hub and the spoke network.
That's absolutely fantastic.
Thank you Jan for that demo.
Jack, if I now again want to go and dive
into this and learn more about this. Where do I go?
>> Well, obviously we've done another two episodes before this,
so if you found the third episode go and watch Number 1 and 2.
If not, go and check out the repo at
the short link of aka.ms/alz/bicep.
>> Fantastic. I know we talked earlier about this.
The community can also contribute to this project,
so can you tell me a little bit how that works?
>> Yeah, absolutely. That module that Jan has just used there,
the hub peered spoke was actually mainly contributed by
an external contribution from somebody
completely outside of Microsoft, which is fantastic.
If you do have more ideas or even if you swap bug or you would go,
Hey, how would we do this?
You've got a general question,
then head to the same repo on the link that we just shared.
Go to the "Issues tab" and create a new issue and you'll see
three types there feature requests, questions, and bugs.
Select the one that is appropriate to you and we'll be in touch.
>> Fantastic. Thank you very much Jan and
Jack for doing this video series with us.
Again thank you for everyone watching and make
sure you check out aka.ams/adopt.
[MUSIC]