3 things you wish you knew about before moving to Azure (Microsoft Ignite)


(energetic music) – Welcome to Microsoft Mechanics Live! (audience applauds) Woo! (applause continues) Coming up whether you’re
on-prem in the cloud, CVP Erin Chapple shares her perspective on what you should know about when moving and operating your infrastructure and apps in the cloud. We’ll take a look at
real-world best practices and the latest tools and services that can help you to be successful and avoid the most common pitfalls. So please join me in welcoming Erin Chapple to the show. – Thanks Matt, it’s great to be on. (audience applauds) – It’s good to have you. Now most people know
you as the former leader of the Server Infrastructure Team so I think that you can empathize
with some of the audience that may still be trying
to get their head around the best ways to use the cloud and just looking for ways to improve what they have running now. – Yeah, I absolutely do empathize. I think, you know, having
run the windows server and now being in Azure Compute, I’ve made my own migration to the cloud. And like many of you,
I’ve been figuring out the path to connect the
two worlds of on-premises and the cloud where it makes sense. And I think it’s a normal
inclination to think that you need to take the
cloud in its entirety. Like, it’s just a binary thing
that I’m moving to the cloud. And that can be intimidating
because it’s different than what you have on-premises. But it’s not an
all-or-nothing decision, Matt. You know, you probably aren’t gonna move everything to the cloud. You’ll have things that are
gonna be running on the edge, in your data center, and remote offices, branch offices, et cetera. And so the cloud is really
a tool box in many ways. Both in terms of the services that it has but also the tools that it provides for you to be able to consume. And so you can use what you need and it’s very about being thoughtful about how you can engage with the cloud and where you choose to use it. – Now this is an interesting vantage point because you of all people
understand what it takes to make on-prem operations
successful, and now cloud. So where should people start? – Yeah well, as I mentioned, shifting to the cloud isn’t binary. It’s not a binary decision. And also the good news that
I know from my experience is that running, you know, the Server Compute and now Azure Compute, is that there’s a set of
expertise that all of you have in what it takes to
deliver infrastructure, and management and security
that is completely transferable. So let me kind of talk
about what I mean by that. How many of you are familiar
with the Windows Admin Center? Right. Awesome. Great tool if you aren’t
familiar with it go check it out. Jeff Woolsey I know did a
great session on it earlier. But that’s a great way that
you can take a small step to start to leverage the cloud and then use Azure as your end point. Right, so you can get into this
WAN from any server in Azure and use the hybrid services that you need. So here, let’s take a look. We have the Windows Admin Center here. Here’s the Azure hybrid services. I’m gonna click on
Discover Azure services. You can see I have all of
these Azure services integrated so I can connect my network
using the Azure Network Adapter. I have Monitor; I can use
Azure Monitor from right here. I can use Azure Update Management, integrate that into my
on-premises for patching. I can simplify with Azure backup. And then what’s not in
here and not shown today is that we actually have Azure Arc as well that’s been integrated into WAC in the GA version that just
went live earlier this week. – Yeah, so we’ve seen file sync,
we’ve seen security center. All sorts of great integrated
capabilities through. And I’m glad you show this
Windows Admin Centers, it’s an amazing cross-cloud
and infrastructure environment for managing Windows servers anywhere. On-prem, in the cloud,
virtual, physical, well. It’s a great example of how you can start to incrementally leverage those key capabilities in Azure. And we encourage everyone here, as you called out rightly there, to check out the show that
we did a few days back with Jeff Woolsey on the Admin Center. Now what are some of the things that people need to be cognizant of then as they take those first
steps toward the cloud? – Yeah, well, I just
showed you how you can extend what you have with Azure. And in fact you have
more options than ever. Whether you want to expand
upon what you have on-premises or have Azure come to you. And we’ll talk about
Azure Arc a little later. So the first tip that I will say is don’t treat your distributed
infrastructure as islands. You need to find ways to
connect what you’re doing so you can extend and evolve. – So how do people solve for that? – Well, if you already
have your own data centers, think of it as another site that you need to connect your resources to. This means thinking about
connecting things bidirectionally so that you can bring Azure capabilities into your data center. Now, foundational to all these bidirectional capabilities is networking. Even if you have just one percent of your network in the cloud, you’re redefining that perimeter. And so here’s how our network in Azure can become your network. You know if you think about your on-premises data centers and across Azure how we have a global footprint of regions and edges and sites, now we can literally
connect your WAN for you. And as you start to build that
bidirectional connectivity, this gets you out of the expense and the complexity of
running your own WAN. You can really take advantage
of Azure’s backbone, our network backbone, and use Azure’s global fabric Azure WAN so that you only have to pay for that last mile connection into Azure. And there are lots of options
and ways to do this, right? ExpressRoute allows you
to establish your own resilient and secure private connection to Azure for your main sites. This also gives you the ability to leverage Azure’s global network and connect your sites together. You can also connect to
thousands of branch offices by automating the
configuration and connectivity of your branch and sites at scale with the Azure’s Virtual WAN service. – And we often take the network
connectivity for granted, but it’s not actually gonna
take that much time to set up… – I think you’re gonna show us. – I’m gonna try my best. Thank you, no pressure here.
– (laughing) – So here we are in the Admin portal. This is the foundation, the network is the foundation, for all things cloud experiences. So here we are in the Admin portal. And if I click on Virtual Networks and we scroll down to find
one that I prepared earlier, ContosoAzureVNET the famous company, and we’ll immediately see a
big list of network devices, network interfaces, NICs, that are attached to this particular VNET. And you’ll also see things like Virtual network gateways
and application gateways where we start to integrate
with our on-prem network. And if we scroll back up and across here and look at DDoS protection, this is incredibly important
because Microsoft runs and protects some of the largest online services in the world
like Xbox Live, Microsoft 365, and as a result you can
benefit from the same levels of protection and scale
for your virtual networks. Now basic DDoS protection’s
on automatically but you can switch to standard to provide additional mitigation capabilities that are tuned specifically to Azure Virtual Network Resources. So awesome stuff. Now let’s take a look at security. Quite important I’d say. And then when we click on
it you’ll see immediately there’s a and number of recommendations directly associated to the network. So it’s telling me here that I should be locking down my internet facing VMs and I should be adding those
to Network Security Groups. Seem like a good idea. And if we drill into one of
these particular recommendations around subnets associated with an NSG you’ll see it’s providing
me with guidance around what we’re going to be protecting against, specific threats, and how
I can start to remediate. Now if I click on the Take action button in the bottom left corner here, I’m presented with some of the controls that I can use to make those
appropriate adjustments. Now one other area that’s important to talk about here is Firewall. And we could have configured
an individual firewall for this VNET but we’d like
to do this all centrally. And something we just
announced in Public Preview is Azure Firewall Manager. As you accumulate more
networks and firewalls, this Public Preview is gonna enable you to centrally deploy and configure multiple Azure Firewall instances that span different Azure
regions and subscriptions. You can create secured hubs, as we’ll look into in a minute, to essentially define and
control network traffic destined for private IP addresses, Azure Path Services, and the internet. And traffic’s routed to
the firewall automatically so there’s no need to
create user defined routes. And you’ll see here there
are three simple steps to get started. And so we’re gonna dive
into what it looks like to create one of these
secured virtual hubs. It actually builds on
what you said earlier around the Azure Virtual WAN. Because this is essentially
an Azure Virtual WAN with associated security
and routing policies configured by Azure Firewall Manager. And we use these to easily create Hub-and-Spoke and transitive architectures with native security services
for traffic governance and protection. Now all I need to do is
provide some basic information, choose a resource group, give
it a name, an address space, and I can choose whether or not to utilize an existing WAN that we created already or create a new one here. I can associate Azure Firewall policies. I’ve not got any just yet. We’ll go through those in a second. And I can also integrate with
Trusted Security Partners for familiar, best in breed,
third-party security offerings to protect internet access for users. Now with this Secured virtual hub created I can then start to create
my firewall policies that I’m gonna apply across
a broad range of services within my environment. So all I need to do here is again, provide some basic information, name, select a resource group, and then I can go into what should be familiar to many of you out there who have managed firewalls
within your environment. So we go into rule collection here. And you’ll see all I need to provide here is some very basic information; name, the collection types. So whether it’s gonna be a, I’m just typing a name here. The collection type, the priority, highest priority obviously. Network application specific rules. And then I mean to just allow or deny and choosing the specific
rules that I wanna define, of which I can define many
as part of this collection. And finally once I’ve
finished this particular step and defined these particular rules, I can then start to configure
the routing of traffic to my secured hub for
filtering and logging. So you see very quickly we’ve configured this virtual network and the
surrounding infrastructure for a solid foundation to build on as you do more in Azure. And now that we’ve built the
foundation and the house, what’s your perspective
on building out services and migrating services
within the environment? – The first common mistake that I see is that people take and
apply their existing notion of what it takes to run
on-premises infrastructure and apply that to the cloud.
– Right. – So if you’re coming from
an on-premises mindset the first inclination
you will typically have is that you’ll wanna over-provision applications, servers, et cetera, because things aren’t elastic on-premises. You know, it takes you time
to roll out that new server and you don’t wanna get that 3 AM alert that a service is down.
– I don’t. – Yeah, I don’t either.
– (laughing) – And so you’ll likely
need less infrastructure when you think about
that move to the cloud. And you’ve primarily architected things for that on-prem world. So my second tip is to really assess your environment for the cloud. Now we have a free tool that you see here that’s called Azure Migrate to help you figure out the right configuration
for your cloud world. You could also use Azure
Migrate to integrate with the most popular third-party tooling, things that you might be familiar with, as you go through the steps
of assessment and migration. And as you bring more and more of your mission critical workloads
like SAP to Azure, you can scale out. That’s one of the things
the power of the cloud does and we just launched the largest sized VMs with 12 TB of RAM. – That’s huge. – Pretty amazing.
– Yeah. Now once you’re in the
cloud or if you’ve got a hybrid setup running for
a few apps and workloads, have you got any tips
about how to feel good about the operational state
and how you manage costs? – Yeah so one thing you see a lot, both on on-premises and in the cloud is once a workload has been
brought over and running, you have the tendency to
just declare victory, right? – Yep, I’ve made it. – And I’m not saying don’t celebrate. You know, it’s exciting. You’ve made the move, you’ve
gone through that migration. But it’s important to capitalize on all the cloud-native capabilities where they make the most sense. – Right and one of those
benefits of the cloud is that is does make it easier
to optimize what you’ve got. But this is a huge
surface area to explore, so practically speaking,
where should people start? – Well, Matt, the answer
typically is it depends. There’s infinite
optimization opportunities and there’s lots that you can do with your data, for example,
with advanced analytics and AI, and tons of dev opportunities once you’ve advanced your footprint and
connectivity in the cloud. That being said I’m gonna keep these tips scoped to the compute area. And so here if you have
apps that have those fluctuating capacity, which are perfect in
the cloud environment, and you might wanna look at containers. Containers and Kubernetes open up a lot of optimization opportunity here and especially if you like things like HA clustering for servers, this takes it to a new level. And plus if we’re used to VMs, the efficiency of containers
is much, much better. And then on the process side, you can leverage DevOps
to be more flexible and provide flexible deployment and develop in environments. – Right. – Imagine a world where you
have no maintenance windows and you can make those changes and roll them back
without breaking anything. – And that sounds like a nice place to be. And with cloud-native and
elastic infrastructure like Kubernetes, as you mentioned, the agility of apps and services, it’s on a new level, too. I’m gonna show people here
just what that looks like. So what we’ve got on my screen
here is Visual Studio Code at the bottom half of my screen, and I’m gonna launch Cube Control to list the nodes within my environment. Now, if you’re not familiar, nodes are essentially workers, and in our case they are VMs
but they could be physical, and I’ve got three of them. And then we’re gonna enumerate the pods within my environment, which is a higher level structure containing one or more containers. And then we list the services here and we’ll see what
we’ve got going on here. Now you’ll notice here
if I go back to pods I’ve got four running. Three for the front-end
of our application. One for the back-end. If you look at these services
the middle one’s the key here because that’s our LoadBalancer that we’ve got within our environment that’s used for essentially
distributing traffic to the front-end pods. Take a note of that IP address there. That’s the external IP address of our particular application, our web application. I’m gonna bring that up in the browser. So I’m gonna go to that
particular web address there. And this is our Contoso
Freight application. Built it this morning myself. A lot of work. (talking over one another) But we’re going to actually
upgrade that application. We’re gonna refresh it now in real-time while users are using it. So what we need to do is firstly, I’m gonna drag down in
Visual Studio Code here, and I’m going to point
this particular app, this particular environment
at a new indexed HTML page. So I’ve made some edits to
this front-end previously. I’m gonna save that, and I’m gonna use a number of git commands to actually start to merge that code with what we’ve got at the
back-end in our repose. So I’m going to do a git add to merge, I’m gonna do a commit with
the message of “updating UI” so you’ll see that in a
bit more detail later on, And then gonna push it to github. So I’ve got a private repo up in github where this is all gonna be stored. You’ll see that’s been
pushed up now very quickly. And that’s all done. So, what I’m going to do now is establish essentially a monitor that’s gonna watch the changes to the pods
as things are happening. So while that’s happening
in the background, let’s open our github. Let’s go to our repo
for the Contoso Freight. You’ll see the four pods
running at the bottom there so nothing changing just yet. But not everyone realizes that github’s more than just a repo. It actually has workflow, build processes, actions in there. And what you’ll see here
in this pipeline view is we’ve actually started the actions that are gonna kick off based on that push that we’ve made. So we see things happening in github. As we refresh we see things happening at the bottom here with the pods. Things are just starting to kick off so let’s just refresh the page, and all of the build jobs
are now actually kicking off. So because of that push we’re redeploying additional containers. We’re gonna replace the
ones that are there. So as we see, things happening
in the background there. A lot’s happening at the bottom there. Containers are being created, previous containers are
being removed and replaced, and as we continually
refresh the page here, so we’ll continue to
refresh our web front-end. Remember, we’re replacing
this in real-time while users are using it. Here we go, boom. We’ve now updated the
front-end of the application, straightforward, easy, and those containers and
those pods have been replaced all through that push command
that we published to github. So Kubernetes, an incredible solution. It extends obviously to
on-prem and other clouds, it’s not just in Azure. And we’ve been hearing a lot
this week about Azure Arc. So how does that help all of this? – Well, Azure Arc really
brings us full circle. Earlier we talked about ways
to extend on-premises to Azure, now Azure Arc enables you to extend the Azure control plane on-premises to deliver that cloud
agility and management in your on-premises environment. And so it provides a consistent management and services
layer that applications can then layer on top of. And it provides you the more is choice in terms of where you want to run your workloads applications, whether they be
on-premises or multi-cloud. – Awesome. Well, there’s some great tips here whether you’re just
beginning your cloud journey or whether you’re looking to
expand on what you’ve got. So, where can we learn more? – Well of course, check out azure.com, it helps you get to the right place and explore the information you need. It’s also your source for
great technical documentation. And I want to call out azure.com/Migrate which is our central migration
portal that gives you all of the guidance around
migration and tooling for you to start your
journey to the cloud. – Yeah, lots of amazing resources there. And of course keep watching
Microsoft Mechanics for all the updates. Subscribe and follow us on Twitter. Thanks so much for watching. Bye for now. (audience applauds) (energetic music)

Leave a Reply

Your email address will not be published. Required fields are marked *