so you've deployed your Landing Zone in the cloud and you think you're ready to start your migration
but not so fast there are seven things that you need to do or migrating into your new Dream Home
in the cloud is going to turn into a nightmare now part of your Landing Zone deployment was to set up
your express route or site to site VPN or v-win but that's just the Azure side of the equation
you still need to set up your on-prem side for these connections or things will be over before
they even start if you chose an express route you'll need to work with your provider to set
up your express route circuit and then connect that circuit to Azure and back to on-prem with
your gateway if you've gone down the VPN path you'll need to set up the Gateway connection and
the local network in order for those things to communicate and vwan has its own Gateway
connections that you need to do as well once you finally get everything connected with on-prem and
the cloud there's six more things to think about and I've even brought some other experts in to
help you out and it's all covered here in this new dock which I'll have Linked In the video
description below you don't want to migrate your workloads to the cloud without thinking
about your domain controllers first unless you are transitioning to a cloud only environment you are
going to need to extend your DCs to Azure because you don't want to have to authenticate all the way
back to on-premises since you would increase your latency and logo on times and of course
decrease reliability there is no secret sauce to make a domain controller in the cloud you just
need to build a VM and promote it to be a domain controller don't forget you will need to have a
VPN or express route to connect on-premises to the cloud so DCs can talk to each other and then we
need one more thing create a new site in ad sites and services and add your Azure subnets to it
which will tell the other VMS in Azure that the new DC is the closest one to make authentication
as fast as possible unless you just upload a cloud only Landing Zone you're going to need to get your
existing users into the cloud and when do that with the new Cloud sync tool or Azure ad connect
you install these tools on a server on-prem and it syncs your users to the cloud along with all
their ad properties and metadata but what about your password we protect them with a feature
called password sync it generates a hash of the password and only speaks the hash not the password
this keeps everything secure and your users use the same password on-prem and in the cloud when
the user signs in a reverse of the hash is done and if everything matches up you get signed in
active directory domains needs DNS to work and we have two parts to this puzzle we have
the cloud side and the on-prem side we already talked about setting up your virtual Network so
all your VMS in the cloud can find your DCs but if you're on Prem and you want to get to Azure
past services like Azure files or private endpoint you need something called a conditional forwarder
here in your DNS server at the bottom you have a conditional forwarders adding a new
one needs a fully qualified domain name and the IP address that it resolves to you which is always
168.63.129.16. now what about resolving from the cloud back to on-prem
to make that happen we need the Azure DNS private resolver
set up an outbound endpoint with the targets on Prem and you are good to go as part of deploying
your Landing Zone it is important for you to monitor your new Cloud resources as well as Azure
service health so you know everything is running in the cloud as it should be the easiest way to do
this is deploying the Azure monitor Baseline for landing Zone this will use to show policy to set
up the monitoring alerts we all need for Learning Zone management like your VM and cloud services
Health that way you can get notified on anything that goes wrong so you can deal with it fast
just having your Azure firewall deployed it doesn't actually do anything in order for it to
be effective you need to Route traffic to it and set up the rules for the traffic that you want to
control if any traffic needs to leave your spoke Network then it should be sent to the firewall for
inspection to do this every Subnet in your spoke networks needs to have a route Table and there
should be a route for 0.0.0.0/0 which will send all your outgoing traffic to your firewall now you
can have additional routes that are more specific as needed for example if you want traffic that is
going to on-prem to be inspected by the firewall you'll also need to plan for its routing and you
do this in two parts first the spoke route tables need BGP propagation disabled otherwise it'll try
to go to the Gateway directly second the Gateway subnet needs a route table you'll need to add
every cider block used by your spoke networks and before you ask no you can't SuperNet them because
it will use the most specific route now that all of your traffic is headed to the Azure firewall
it's going to block everything by default so you need to add your rules to allow the traffic that
you want to flow and those rules can be set up either as a Network rule or as an application rule
Azure can protect your new Landing Zone with Defender for cloud
you need to enable it for the different aspects of your subscription and Defender for cloud helps you
improve your security posture with a security score which evaluates your Cloud resources
against Microsoft security Baseline and suggest improvements and you should keep checking back
for New recommendation as you begin migrating your resources into Azure so everything stays secure
thanks for your help everybody now that you have these seven key areas all set up
and ready to go you're ready to start your migration which itself has five keys that
you need to get everything right and you can learn about that right over here happy learning