>> Hey everybody. Stay tuned where
I'm going to be joined with Rob and we're going to be
talking about Enterprise Scale landing zones and how
they can help with your Cloud deployments.
[MUSIC]
Welcome to the Azure Enablement Show.
In this show, we're going to be talking to
Microsoft experts to tackle some of
the questions and obstacles that you
may have on your Cloud adoption journey.
Now in a previous episode,
we've mentioned landing zones,
which are there to help
organizations speed up their Cloud deployments,
and also give them a consistent redeployable environment as well.
Now, to dive even deeper into the Enterprise Scale landing zones,
were welcoming back Rob to the show. Rob, welcome back.
>> Thank you, Sarah.
Really happy to be back today.
>> Awesome. Now, with Enterprise Scale landing zones,
are they only designed for
our customers who identify themselves as Enterprises?
>> So that's an excellent question.
I get asked that one all the time,
especially from just different sized customers that are
looking to really build a foundation to be successful in Azure.
Here, let me share a quick screen with you right here,
where I first want to quickly just catch everybody up,
that maybe hasn't seen one of
the previous conversations that
we've had and just bring us up to speed.
So the Enterprise Scale is
an architectural approach for
implementing your landing zone at scale.
The cool thing here is,
it comes with two buckets.
It comes with the Enterprise-scale Architecture,
which you would find in the Cloud Adoption Framework,
and we also have the Enterprise Scale Reference Implementation
that we have on Azure GitHub,
where we have three reference implementations.
You could think of them as different starting points
to go ahead and build
out your Enterprise Scale foundation for your landing zones.
>> So you mentioned three reference implementations, Rob.
Could you dive a little bit deeper into those for us please?
Because they seem quite interesting.
>> Absolutely. What I'm going to do here on my screen is,
I'm actually going to take you over
to the Cloud Adoption Framework.
From the Cloud Adoption Framework where I am,
just so we're all on the same page in
case you're following along with me is,
I'm in the Ready Methodology
under Azure landing zones implementation options.
What you're going to find in those implementation options are
three reference implementations for Enterprise Scale.
If you'd like to learn more about, "Well, hey.
All right, I've read through them.
These are very interesting to me.
But I want to go and understand even some more depth or details."
You can actually go ahead and click the "Deploy" link,
which is going to take you over to our shortcut in GitHub,
where you'll find detailed information
on those reference implementations.
For example, here I am in GitHub,
you could see Deploy Reference Implementations,
I'll select the first one here,
which is our Contoso reference implementation,
and you're going to find very detailed around what this is,
the full architectural diagram, and of course,
we've got some implementation notes in here
around our areas of design to get just started,
and there's a Deploy button at the top
for when you're ready to go ahead and give it a try.
>> Okay. So that Deploy button,
that takes us to an arm template.
Is that right; Rob? Or where does that take us?
>> Yes, absolutely.
So when you hit the Deploy button,
what it will do is will actually go
ahead and take you into the Azure portal.
So if I click on it now,
it's going to go ahead and have me log in real quick,
and then it will take you through
a templatized experience through deploying Enterprise Scale.
What we do is, we try to align as much
as we can to the eight areas of design that we've
talked about before and take you through
those decisions through this templatized experience.
So in this case, if I wanted to go through this,
in my example here,
I would probably, well,
for example, pick off like US East because I'm located over there,
I would hit "Next" here.
I need to provide a prefix so we know when we deploy this,
we have a way to find it within
our list of management groups in our tenant.
So I'll just do "AzDem" for this example here.
Then, what you'll see is we'll
actually go through and ask you questions.
For example, platform management, security and governance.
Here Sarah, what we're going do is we're going to ask you,
"Do you want to enable Log Analytics?"
You can say yes or no,
we're going to leave the default as yes.
It's going to say, "What do you want for retention? 30 days."
I can pick the little slider here,
take it up to whatever I want.
I think for maybe this example here,
let's just do, I don't know.
Let's do like 180 days.
Let's do like half the year.
Now an important thing it's going to
ask when you go through this is,
"What subscription would you like to deploy
this landing zone to for the management?"
So where do you want Log Analytics to go?
So let's just do, I don't know.
We'll do a subscription number 102 for us here.
You'll see we'll enable solutions out of the box for you.
Of course, if you're a customer and you say, "All right,
there's a particular solution I'm not going to use here."
Maybe I'm not using update management,
you could say no to that and you could continue on.
The other thing at the bottom here is,
you want to make sure that we turn on Azure Defender.
If you want to use Azure Sentinel,
you have an opportunity to deploy that as
well using this templatized experience.
For connectivity, for this one that I'm showing you here,
for this reference implementation,
it's using the Virtual WAN.
So you could say, "Do you want to enable the Virtual WAN?"
I could say, "Yes."
What subscription would you like that one to go to?
So this will be a different subscription,
so I'll pick 103 for this one,
and then it's going to say, "What address space do you want
and where do you want the hub to be for the virtual WAN?"
Let's just keep everything in the US East for me.
Of course, "Do you want to use VPN gateway?"
Maybe you are an ExpressRoute customer
and do you want to deploy Azure Firewall.
So I'm going to say Yes to
Azure Firewall and I'm going to go ahead and say
Yes to deploy an ExpressRoute for this particular scenario here.
The last thing is the landing zone itself.
You need to pick a subscription for your landing zone,
so let's see here.
I'm going to pick 104 for that one,
and this is where my workloads themselves are going to
live when I go ahead and finish the deployment.
Again, it's going to ask us a lot of
questions about what you want to turn on for your landing zone.
Do you want to enable monitoring for your Windows VMs?
Do you want to enable monitoring for your scale sets?
Check this one out here, we're going to have backups.
Do you want to turn on backups are for your VMs?
So that means, anytime a VM is deployed within that subscription,
we're going to automatically turn backups on for you,
and you could just continue to work your way through these,
and these are all called out in
our Enterprise-scale Architecture in
the Cloud Adoption Framework in our eight areas of design.
So when you're all done, Sarah,
you just hit "Review and Create."
It's going to attempt to validate the template,
make sure it's all good to go.
Of course, I just picked in this case,
just a bunch of subscription.
So I may had some duplicates there,
but it looks like I got lucky on my selections and we picked
ones that I don't have something previously deployed to,
so our validations have passed.
When I'm all done here,
I just say go ahead and create, and away it goes.
Takes about 5-10 minutes.
When it's all done, I'm not going to make you
sit here Sarah and wait for that to deploy.
So when it's all done, login to the portal,
go to your tenant and here you could actually see AzDem,
that's a top level management group,
and if you take a look,
here's the structure for
the management groups, here's landing zones.
My landing zones that I selected to be deployed
will show up in the Online Management Group.
In fact, here they all are right here.
I actually have five landing zones that
I've built out in this example here.
>> That looks pretty cool,
it looks like it's such an enabler for our customers.
Now, I will be honest,
I did a little bit of homework before you came on the show,
and I remember reading that there are things
like design ideas and design principles,
I think you even mentioned it when you
were walking through the template.
Now, should I be thinking about those before
I do the template or thinking about the template first,
and then the design ideas.
Which when comes first, Rob.
>> Absolutely. When you go ahead and do this,
you really need to make sure that when you're
thinking about what does the design look like,
and before you even go into that template, into your deployment,
the first thing we want you to look at in
the Cloud Adoption Framework for
Enterprise Scale landing zones is the design principles,
and those design principles actually are
five core principles that we'd like you to bear in mind.
In here, what we're going to do is I'm going to
build these slides out real quick for you,
and I'll give you a quick primer on this.
When you go ahead and think about the design principles,
you would put this in the context of
every decision you make in the eight areas of design.
So whether it's management,
security, identity, it's going to be DevOps.
Whatever of those design areas that you go through,
you want to make sure that you're
thinking about these design principles and
the impacts of the decisions you're
making and how they may affect the design principles here.
For example, one of
our big design principles is policy-driven governance.
We want to use Azure Policy to drive governance and make sure
that your foundation is compliant and secure at all times.
We use Azure policy for this.
In this scenario, Sarah, think of it like this.
If you were to go ahead and use NVA,
which is the Network Virtual Appliance.
That is not a Azure native,
like our App Gateway would be something that is native to Azure.
So say you said, "I'm going to go with a third party NVA."
Now, that's great.
You may have some extra licenses for that and
that makes a lot of sense for your environment,
but because you've made that decision,
you may have strayed outside of one of
our design principles where you can no
longer use policy to govern that particular resource in Azure.
Then you have to ask yourself,
maybe "The savings or
the skills that I all ready have available using the NVA,
does that outweigh the fact that I can no longer govern
that particular resource in Azure we're
policy and how could that impact me long term?"
Those are the types of trade offs or considerations
we want you to think through as you go through the network,
like I said, security,
identity, management, through those eight areas.
You should also always bear these in mind.
Another one here is around subscription.
As you saw, I used
a bunch of different subscriptions as I went through the template,
and we really do use that subscriptions as our way,
think of it as our way to control the unit of
scale and management for your environment.
So we can govern who has access and make it very,
very tailored and restrictive by making sure
all workloads go into separate subscriptions.
Now that's not a hard and fast rule,
obviously there's going to be some cases where you can have
multiple applications in a single subscription.
But for the most part,
we do want to get people in a pattern to really
think through using subscriptions
for each of their major line of business applications and
workloads as that unit of scale and management.
>> Awesome. It seems
like Enterprise Scale landing zones really give our
customers a great journey to go through when they're
thinking about deploying workloads in the Cloud.
Rob has told us a lot of
information and pointed to a lot of great resources.
What we are going to be doing is pointing
those in the description box below,
so make sure you're checking those out and having
some further reading of that.
Thank you again Rob for coming on the show,
and please do join us for
future episodes of the Azure Enablement Show.
[MUSIC]