(upbeat music)
Hi, my name Prasidh Arora,
and I'm a product manager
on the Azure Edge and Platform Team, here at Microsoft.
In this session,
we'll cover how you can use the Azure portal,
to get under the hood of your Azure Stack ATI cluster.
and fix issues using Windows Admin Center.
Windows Admin Center has been around,
as an on-premise use management tool
for the last five years.
It provides centralized and simplified management,
for your Windows server, Windows client,
and Azure Stack HCI clusters,
through a user-friendly interface.
It features deep monitoring, such as performance monitor,
event viewer, packet monitoring,
to help troubleshoot and investigate problems,
and then granular configuration,
with tools such as certificate manager, firewall manager,
volume manager, and dozens of others,
to help fix these problems.
In this session, let's explore how you can perform
an end-to-end drill down management
of your Azure ARC-enabled infrastructure.
all within the Azure portal,
with Windows Admin Center in Azure.
Let's look at an example of a hypothetical company,
Contoso, a retail company which stores all around the world.
Most of their infrastructure runs in the Azure public cloud.
But there are a few applications
that need to run on-premises.
Being a retail store,
they need their point-of-sale applications,
and their video monitoring applications,
all running on-premises.
Because these applications
are critical to their daily sales,
it's absolutely crucial that these applications
have resiliency and redundancy.
Therefore, Contoso has deployed either two, three,
or four node Azures Stack HCI clusters
in all of their stores: one in New York,
one in Bogota, Stockholm, Beijing, Brisbane, and many more.
They have a centralized IT team,
that manages all of these clusters remotely,
based here in Seattle, Washington.
Because all of Contoso's infrastructure runs in Azure,
their IT administrators are very well versed
in using the Azure portal for all of their management,
and are excited to continue to use the Azure portal
for managing their clusters.
So how can their IT team
monitor, and manage, their on-prem infrastructure centrally?
So Contoso uses Azure Monitor
to manage all of their existing cloud infrastructure,
and continue to use Azure Monitor
to manage their on-premises infrastructure too.
Because all of these clusters are Azure ARC-enabled,
they're able to leverage the power of Azure ARC
to monitor all of their infrastructure centrally,
via Azure Monitor.
They're able to centrally monitor
all of their infrastructure,
build custom visualizations and dashboards,
and scale to monitoring hundreds of servers and clusters,
as their retail business grows.
While their IT team was monitoring their clusters,
they recently got a health alert,
that one of their clusters was in a critical state,
and they needed to remedy the situation as soon as possible.
So they opened up the Azure portal
to their monitoring dashboard,
and see that one of their clusters is indeed
in a critical state,
and the faulting resource is the volume.
So within Azure Monitor,
they're able to navigate to the storage tab,
and see one of their volumes of their cluster
is actually down.
How do they fix this?
Now, traditionally, you would have to perform a few steps
to remedy a situation like this,
on your on-premises infrastructure.
You would need to first establish line of sight
to your infrastructure.
This could mean setting up a VPN,
which is generally an expensive,
time-consuming and painful process.
Or if you have absolutely no inbound network connectivity
to your on-prem infrastructure,
usually to prevent and attack service,
you would have to fly someone out to your retail store,
or send someone out to this retail store,
in order to actually investigate
or troubleshoot the issue,
or ask someone to actually open some inbound connectivity
to your infrastructure,
opening you up to some amount of unknown attack service.
Once you do establish this line of sight,
you would need to have the administrator credentials
of this cluster,
and ensure that those administrator credentials
are well secured.
Whether you're passing that off from person to person,
or securing it through Azure Key Vault,
you do need to have local administrator credentials
to manage the server.
And then lastly,
you need to use some set of external tooling,
like remote desktop, or server manager, Hyper-V manager,
or even Windows Admin Center deployed locally,
in order to look at the environment,
and troubleshoot it, to bring the volume back up.
For a company like Contoso,
who has spent the entire lifespan in the Azure portal
for their end-to-end management,
this is a rather painful process,
which requires the learning of many new technologies.
For one, they have to use a different management tooling,
leaving the comfort of the Azure portal,
whether it's RDP, server manager, Hyper-V manager,
to actually manage this particular server.
You have to establish line of site through VPN,
or sending someone onsite,
both being pretty expensive processes.
And lastly, they can't use Azure AD authentication,
or Azure 2FA, Azure two-factor authentication,
to manage the cluster anymore.
They have to worry about local administrator credentials,
to run any sort of local commands.
Fortunately, Contoso has Azure Stack HCI,
and they don't have to worry about any of these problems.
They can manage their Azure ARC-enabled infrastructure
directly from the Azure portal,
With the Windows Admin Center extension.
They get all of the tools that they're familiar with,
for monitoring and management,
with the Windows Admin Center,
all available natively in the Azure portal.
Access to this management tooling
is controlled by a Azure role-based access control,
so there's no need to worry
about any local administrator credentials.
It's all available from anywhere,
as long as they have access to the Azure portal.
Their centralized IT team sitting in Seattle,
is able to access any sort of set of tooling they need,
to access their cluster.
Let's look at how this works,
and how Contoso can bring back this volume of their cluster
sitting in New York, while staying in Seattle.
Let's navigate to this cluster in the Azure portal.
On the left, there's a blade for Windows Admin Center.
Since this is the first time
that Contoso is using Windows Admin Center,
to manage this cluster from Azure,
there's a short one-time setup process.
Let's click setup and install,
and have Azure deploy Windows Admin Center on this cluster.
The process for setting up Windows Admin Center
is very similar to the process
of deploying Azure Monitor, for example,
on this cluster.
It deploys a small agent onto this cluster,
that communicates with the Azure control plane,
to collect logs, and performer operations.
In the future,
Contoso could use Azure CLI, or PowerShell,
or Azure Policy, to deploy Windows Admin Center at scale,
across all of their Azure ARC-enabled infrastructure.
So it's always accessible when they need it.
Once installation is complete, I can connect to my cluster.
Connection to Windows Admin Center is controlled
through an Azure RBAC group,
called Windows Admin Center Administrator Login,
and I am already part of this group,
but let's check it out In the access control tab.
I must be a part of this group
in order to access Windows Admin Center,
and thus, access my cluster using Azure AD credentials.
Now let's actually go back to Windows Admin Center,
and hit connect.
And Windows Admin Center begins to load.
And here's the beauty to all of this.
I have no access to the cluster,
no VPN, no public IP address.
Actually all inbound connectivity to this cluster
has been blocked.
But with Windows Admin Center,
I'm able to start managing the operating system
of this cluster.
Here on the dashboard,
I see the same alert that Azure Monitor reported to me.
One of my volumes is inaccessible.
Let's go find out why.
It seems it went offline some time ago,
and I can navigate to the built-in event viewer
in Windows Admin Center to troubleshoot why.
But for now, Contoso needs this cluster up immediately.
So let's navigate to the volume tool,
and click the online button to remedy situation.
The volume will come back online, and in a few minutes,
Azure Monitor will once again report
that this cluster is in a healthy state.
On the left here, Contoso actually has a huge set of tools
that manage this particular cluster.
In this case, they only needed to open up the volumes tool,
where they can change granular settings,
manage their security,
manage granular settings of their virtual machines,
their individual servers, drives, and much, much more.
I can go to each individual node in this cluster,
and get an even deeper set of tools
for managing this cluster, from certificates,
to devices, to events, to PowerShell,
and even a native RDP session if needed,
all available in the Azure portal.
And this might seem like magic right now,
so let's look at the architecture
of Windows Admin Center in Azure,
to get a better idea of how this works.
First, the Azure portal securely retrieves
the entire front end of Windows Admin Center,
such as the styles, the PowerShell scripts, the font,
all from Azure CDN, globally cached for performance.
Next, the Windows Admin Center backend,
which is a small agent that is deployed
on each node of the cluster, for resiliency,
and issued a Microsoft-signed TLS certificate,
is deployed on every node of the cluster.
Since each of these agent gets HTTPS calls,
they must have a publicly signed TLS certificate
for your browser to be able
to securely communicate with them.
Then the Azure portal picks a node from your ACI cluster,
and sends remote PowerShell calls to that node.
It's these remote PowerShell calls that perform actions,
such as bringing a volume back up,
or viewing your disks, certificates, and so on.
The Azure ARC connectivity solution
provides inbound HTTPS access to Windows Admin Center,
without requiring any inbound ports at all.
It communicates entirely outbound.
Lastly, the Windows Admin Center backend
running on your ACI cluster, responds,
and can manage all of the nodes of the cluster,
since they're all part of the same network.
And all of these four steps working together,
light up the magic,
and allow you to access Windows Admin Center,
and thus your cluster, all from the Azure portal.
I hope you enjoyed the session.
Here's some resources
to start using Windows Admin Center in Azure,
to manage your Azure ARC-enabled servers,
and Azure Stack HCI clusters right from Azure.
Thank you.
(upbeat music)