Study Guide AZ-305: Part 8 – Design a non-relational storage solution

Hi Cloud Marathoners!

Welcome to the next blog post (Part 8/12) from the Az-305 series to help you get ready for the AZ-305 exam. This post is the first one that is covering the section – “Design Data Storage Solutions” for this exam.

Please, check the previous blog posts listed below, if you landed on this page for the first time 🙂

Table of content (blog series)

What is an non-relational data?

A non-relational data is a set of gathered or existing data that does not have a strict schema (structure) which is a required condition for a relational data. Of course, when we speak about data in business, the first thing that comes to mind is the database 🙂

In contrast to a relational database, a NoSQL database is one that is less structured/confined in format. Thus, we gain more flexibility and adaptability with non-relational data.

non-relational database is a database that does not use the tabular schema of rows and columns found in most traditional database systems. Instead, non-relational databases use a storage model that is optimized for the specific requirements of the type of data being stored. For example, data may be stored as simple key/value pairs, as JSON documents, or as a graph consisting of edges and vertices.

Non-relational data and NoSQL
AWS Non Relational Databases - Javatpoint

WHAT is non-relational data storage in azure?

In practice, “NoSQL” means “non-relational database,” even though many of these databases do support SQL-compatible queries. However, the underlying query execution strategy is usually very different from the way a traditional RDBMS would execute the same SQL query.

Non-relational data and NoSQL

Check out the following major categories for non-relational (NoSQL) databases below:

  • Document data stores
  • Columnar data stores
  • Key/value data stores
  • Graph data stores
  • Time series data stores
  • Object data stores
  • External index data stores

Microsoft Azure offers a number of services that help you to build these NoSQL databases, and in this post we will cover all of them.

Relational And Non-Relational Datastores In Azure

Part 8: Design a non-relational data storage solution

The references below are taken from official Microsoft docs and focused on designing the non-Relational Data Storage solutions in Azure. You could also find it helpful to check the Microsoft docs and learning paths with [Tutorials] below 😉.

This collection of links are gathered with a focus toward the exam objectives of AZ-305 certification exam.

Storage account overview
Hot, Cool, and Archive access tiers for blob data
Blob rehydration from the Archive tier
Time-based retention policies for immutable blob data
Legal holds for immutable blob data
Azure Storage redundancy
Announcing Ultra SSD – the next generation of Azure Disks technology (preview)
Managed Disks pricing
Azure managed disk types
What is Azure Files?
Create an Azure file share
Azure Files scalability and performance targets
What is Azure File Sync?

Security recommendations for Blob storage
Overview of Azure page blobs
Compare access to Azure Files, Blob Storage, and Azure NetApp Files with NFS Storage Accounts and security

[Tutorial] Explore Azure Storage for non-relational data
[Tutorial] Explore fundamentals of Azure Cosmos DB
[Tutorial] Introduction to Azure Cache for Redis
[Tutorial] Implement Pub/Sub and Streams in Azure Cache for Redis

Multi-region web application with Cosmos DB replication
Introduction to Azure managed disks
Azure Storage redundancy
What is Azure Blob storage?
Azure premium storage: design for high performance
Azure Disk Encryption for Linux VMs
Azure NetApp Files
Server-side encryption of Azure Disk Storage
Configure Azure Storage firewalls and virtual networks
Use private endpoints for Azure Storage

SUMMARY

Thank you for visiting the AZ-305 Study Guide and checking the Part 8: Design a non-relational data storage solution.

The next blog post will be continuation with Part 9: Design a data storage solution for relational data.

Study Guide for AZ-305: Part 7 – Design a migration solution

Hi friends!

Welcome to the next blog post (Part 7/12) from the Az-305 series to help you get ready for the AZ-305 exam. This post is special and will finalize one of the biggest sections – “Design Infrastructure Solutions ” for this exam.

Please, check the previous blog posts listed below, if you landed on this page for the first time 🙂

Table of content (blog series)

What is an IT Migration?

An IT Migration is basically a movement of data or software from one system to another. Also, depending on the complexity of the project, an IT migration involves data migration, application migration, operating system (OS) migration, and others.

A typical migration project usually involves the movement of data too, which is called – Data Migration. Here is the definition of data migration from Wikipedia.

Data migration is the process of selecting, preparing, extracting, and transforming data and permanently transferring it from one computer storage system to another. Additionally, the validation of migrated data for completeness and the decommissioning of legacy data storage are considered part of the entire data migration process.[1][2] Data migration is a key consideration for any system implementation, upgrade, or consolidation, and it is typically performed in such a way as to be as automated as possible, freeing up human resources from tedious tasks. Data migration occurs for a variety of reasons, including server or storage equipment replacements, maintenance or upgrades, application migration, website consolidation, disaster recovery, and data center relocation

Data Migration, Wikipedia

In last few years we also have new type of migration – called cloud migration.

WHAT is the migration solution in azure?

There are many different ways you could run your migration projects.
Microsoft Azure provides specialized tools to help you migrate your IT solutions from on-premises and other cloud platforms into Azure. Thus, you could take advantage of  Azure Migrate offers to you..

Azure Migrate provides a centralized hub to assess and migrate on-premises servers, infrastructure, applications, and data to Azure. It provides a range of tools to help you in the migration process. Please, check an official Microsoft documentation on Azure Migrate services here.

Shifting customers to the cloud with Microsoft Azure Migration - MachSol  Blog

Part 7: Design a migration solution

The references below are taken from official Microsoft docs and focused on designing Migration solutions in Azure. You could also find it helpful to check the Microsoft docs and learning paths with [Tutorials] below 😉.

This collection of links are gathered with a focus toward the exam objectives of AZ-305 certification exam.

Azure migration guide overview
Azure cloud migration best practices checklist
What is Azure Import/Export service?
Overview of Data Migration Assistant
About Azure Migrate
Total Cost of Ownership (TCO) Calculator
Azure Pricing calculator
Use Storage Migration Service to migrate a server
What is the Microsoft Cloud Adoption Framework for Azure?

[Tutorial] Implement a hybrid file server infrastructure
[Tutorial] Accelerate your migration and modernization journey to Azure
[Tutorial] Prepare on-premises workloads for migration to Azure
[Tutorial] Migrate your relational data stored in SQL Server to Azure SQL Database
[Tutorial] Set up Azure Migrate for server migration
[Tutorial] Applications and infrastructure migration and modernization
[Tutorial] Design your migration to Azure


What is Azure Database Migration Service?
Using Service Map solution in Azure
Azure Data Box documentation – Offline transfer
Cloud Adoption Framework migration model

SUMMARY

Thank you for visiting the AZ-305 Study Guide and checking the Part 7: Design a Migration solution.

The next blog post will start the “Designing Data Storage Solutions” section with the Part 8: Design a non-relational data storage solution.

What you need to know about Azure AD security defaults?

Hello Cloud Marathoners,

The following post is going to be covered in the Azure Spring Clean 2022 event’s website too. Thus, you might be wondering what the Azure Spring Clean is?

Note: This post is not finalized yet 😉 and will include a video session too.
Thus, please be patient with ongoing progress. Thanks!

Azure Spring Clean 2022 Overview

The Azure Spring Clean is a community-driven event focused on Azure management topics and gradually publishes content from March 14-18, 2022.

I would like sincerely Thank – Joe Carlyle and Thomas Thornton for putting time and effort in organizing this event. From a #cloudmarathoner ’s perspective it’s been enjoyable to contribute and be a part of this event. This topic specifically outlines how to understand the pros and cons of your initial Azure AD settings that will be aligned with your project’s expectations.

Azure Spring Clean 2022
Azure Spring Clean 2022 site

WHY azure ad security defaults are important?

Indeed, this is a very legit question and I would like to address it with the following quote from Alex Weinert:

…our telemetry tells us that more than 99.9% of organization account compromise could be stopped by simply using MFA, and that disabling legacy authentication correlates to a 67% reduction in compromise risk (and completely stops password spray attacks, 100% of which come in via legacy authentication)…

Alex Weinert – Director of Identity Security at Microsoft

The main purpose behind these default settings is to make sure that all organizations using Azure AD have a basic level of security, and it is enabled at no extra cost according to Microsoft.

New Azure AD Bug Lets Hackers Brute-Force Passwords Without Getting Caught

Azure AD security defaults are something you need to enable at the tenant level. Once you do this, the rules will apply to all users in your tenant without any exceptions.

If you are looking for enforce rules more selectively ( or exclude some users ) then security defaults won’t be a fit solution for you. For this scenario, you would need to look at getting some P1 or P2 licenses and use the conditional access instead.

How can I set up my Azure AD Security Defaults?

The Microsoft Azure AD team did a fantastic job by simplifying this option. You need to navigate int0 Azure AD -> Properties -> and click on link Manage Security defaults.

You will end-up with the following window on the right panel of Azure portal:

Enabling Security Defaults in Azure AD

What is baked inside the security defaults in azure ad?

There are a number of things baked into the “Security Defaults” by Azure AD team. You could read about an official and detailed description here – Security defaults in Azure AD.

One of the BIG incentives for the security defaults is that it brings Multi-Factor Authentication (MFA) to your users for #free. Of course, there are some limitations around this which I will cover later on, but this option does allow you to get an MFA with no additional cost.

Previously, you would have to have either Azure AD P1 licenses, or pay per use for MFA functionality. Thus, this is a big game changer benefit that you are getting for free in your tenant and will bring a significant extra level of security. And this defaults includes both Azure and Office 365 services.

Along with MFA, security defaults are enforcing several policies that make your tenant more secure:

  • Requiring all users to sign up for MFA (for free)
  • Requiring those in Azure administrator roles to perform MFA
  • Blocking legacy authentication protocols – this includes clients that don’t use modern authentication and so don’t support MFA, and older mail protocols like IMAP, SMTP and POP3
  • Requiring MFA authentication when undertaking privileged actions using the Azure portal, PowerShell or CLI

Will Security Defaults replace my Azure AD licenses ?

In short, the answer is No. Your Azure AD licenses provide more security protection services than what you get from “Security Defaults”.

Think of a “Security Defaults” as a security design approach for users on a free Azure AD tier. Because, if you are already using P1 or P2 licenses you would want to look at using conditional access to perform this (and more) rather than security defaults.

Azure Ad Premium P1 | Azure Active Directory Premium Pricing & Licensing -  USA | IOTAP Online US
Azure AD Premium licenses

What you need to know before deploying the Security Defaults?

Based on Microsoft security guidelines, every organization should have at least two emergency access accounts configured. These accounts are intended for use when your regular administrator account’s can not be used. A typical example is: when person with the most recent Global Admin access has left your company.

What are the emergency access accounts ?
Well, following three criteria defines it pretty well:

  • Aren’t used on a daily basis
  • Are protected with a long complex password
  • Has an assigned Global Administrator rights in Azure AD
Break the Glass Admin no longer compliant? - Microsoft Partner Community

These emergency access accounts and credentials are very sensitive and should be stored in a secure location like a fireproof safe. And only authorized people in your organization should have access to these accounts.

You are also encouraged to disable password expiration to for these accounts using Azure AD PowerShell.

Check out this Microsoft article – Manage emergency access accounts in Azure AD, as it provides more detailed information about emergency access accounts.

What to do when switching from Security Defaults to azure ad Conditional Access Policies?

In order to provide more productivity and better security to your users, you could replicate the policies created by Azure AD Security Defaults. First, your customer’s tenant must be licensed with Azure AD Premium P2. However, the majority of policies can also be accomplished using the Azure AD Premium P1 license.

Check out the following Microsoft documented guides on how you can use Conditional Access to configure equivalent policies to the once that get set by the security defaults:

All these policies could be implemented with Premium P1 license, except the last one. The last policy requires Azure AD Identity Protection feature of the Azure AD and could be provided via Premium P2 license.

Summary

Thank you so much for reading this post and learning about the Azure AD Security defaults. I tried my best to provide my perspective on this important topic while using availiable Microsoft docs and resources.

Please, keep up the good work by securing your and customer’s cloud environments!

Study Guide for AZ-305: Part 6 –Design a network infrastructure solution

Hi Cloud Marathoners!

Welcome to the new blog post (Part 6/12) from the Az-305 series to help you get ready for the AZ-305 exam.

You could also check the previous posts listed below, if you landed on this page for the first time 🙂

Table of content (blog series)

What is a Network Infrastructure?

A Network Infrastructure is the physical equipment (also known as, hardware) as well as the software applications that support your company’s services to run. Types of network infrastructure include foundational hardware, software, services and facilities.

The physical network infrastructure requires cabling, routers, switches, and other pieces of equipment which help support them and make sure they are connected internally and externally. However, most Cloud Solution Providers (CSPs) virtualize this physical infrastructure and provide software defined, virtual networks.

Architecture: Global transit network architecture - Azure Virtual WAN |  Microsoft Docs
Click and check the Azure Virtual WAN

WHAT are the network infrastructure solution in azure?

Azure network infrastructure connects and delivers your hybrid and cloud-native applications with low-latency, with Zero Trust based networking services.

The networking services in Azure provide a variety of networking capabilities that can be used together or separately. Those key capabilities are grouped into four services and described on Azure networking services overview :

Front Door Service overview
Click to check the Azure Front Door Service

Part 6: Design a network infrastructure solution

The references below are taken from official Microsoft docs and focused on designing Network Infrastructure solutions in Azure. You could also find it helpful to check the Microsoft docs and learning paths with [Tutorials] below 😉.

This collection of links are gathered with a focus toward the exam objectives of AZ-305 certification exam.

Azure Virtual Network frequently asked questions (FAQ)
Azure subscription and service limits, quotas, and constraints
Virtual network peering
Create, change, or delete a virtual network peering
Load-balancing with Azure’s application delivery suite
What is Traffic Manager?
Traffic Manager Frequently Asked Questions (FAQ)
How Traffic Manager Works

Traffic Manager routing methods
Network security groups
Create a Network Security Group
Microsoft.Network networkSecurityGroups
Azure network security overview
What is Azure Bastion?
[Tutorial]: Introduction to Azure Bastion
[Tutorial]: Configure Bastion and connect to a Windows VM
Azure Bastion FAQ
Using S2S VPN as a backup for ExpressRoute private peering

SUMMARY

Thank you for visiting the AZ-305 Study Guide and checking the Part 6 – Design a network infrastructure solution.

The next blog post will cover the Part 7: Design a migration solution.

Study Guide for AZ-305: Part 5 – Design an application architecture solution

Hello friends!

Welcome to the new blog post (Part 5/12) from the Az-305 series to help you get ready for the AZ-305 exam.

Please, check the previous post(s) listed below, if you landed on this page for the first time 🙂

Table of content (blog series)

What is an Application Architecture ?

An application architecture is a structural map of how an organization’s software applications are assembled and how those applications interact with each other to meet business or user requirements. An application architecture helps ensure that applications are scalable and reliable, and assists enterprises identify gaps in functionality.

The Techtarget

Generally speaking, application architecture defines how applications interact with components such as middleware, databases and other applications. There are many different application architectures like; N-Tier, Web-Queue-Worker, Service-Oriented (SOA), Event-Driven, and others.

Cloud Application Architecture Guide

WHAT are the characteristics of APPlication Architecture in azure?

The Azure Application architecture requires a structured approach while designing applications that are capable to operate with the following characteristics; scalable, resilient and highly available.

The cloud is changing how applications are designed and secured. Instead of monoliths, applications are decomposed into smaller, decentralized services. These services communicate through APIs or by using asynchronous messaging or eventing. Applications scale horizontally, adding new instances as demand requires.

Microsoft Docs
Diagram that shows the structure of this guide, with the sections of this article represented in a flow diagram.
Azure application architecture fundamentals

Microsoft has provided a very valuable resource on Azure architecture that you could check on Azure Architecture Center. Check this resource for best practices and patterns for your current or upcoming application that you plan to design and run on Azure.

Part 5: Design an application architecture solution

The references below are taken from official Microsoft docs and focused on designing Application solutions in Azure. You could also find it helpful to check the Microsoft docs and learning paths with [Tutorials] below 😉.

This collection of links are gathered with a focus toward the exam objectives of AZ-305 certification exam.

Choose between Azure messaging services – Event Grid, Event Hubs, and Service Bus
What is Azure Queue Storage?
Service Bus queues, topics, and subscriptions
Storage queues and Service Bus queues – compared and contrasted
Azure Event Hubs — A big data streaming platform and event ingestion service
Features and terminology in Azure Event Hubs
Use Azure Event Hubs from Apache Kafka applications
Capture events through Azure Event Hubs in Azure Blob Storage or Azure Data Lake Storage

[CASE STUDY] Migrate to a microservices architecture / Microsoft Azure and Microsoft Azure Cosmos DB
What is Azure Event Grid?
IoT Concepts and Azure IoT Hub
Connecting IoT Devices to Azure: IoT Hub and Event Hubs
About Azure Cache for Redis
[Tutorial] Introduction to Azure IoT Hub
[Tutorial] Introduction to Azure Cache for Redis

About API Management
Feature-based comparison of the Azure API Management tiers
What are ARM templates?
What is Bicep?
[GitHub] AWESOME Azure Bicep 💪
Comparing JSON and Bicep for templates
Frequently asked questions for Bicep
Use infrastructure automation tools with virtual machines in Azure
What is Azure App Configuration?
[Tutorial] Fundamentals of Bicep

SUMMARY

Thank you for visiting the AZ-305 Study Guide and checking the Part 5 – Design an application architecture solution.

The next blog post will cover the Part 6: Design a network infrastructure solution.

I am now a Microsoft Azure MVP. Thank you for a nomination & award!

Hello Cloud Marathoners!

March 2022 has been an exciting and special month in my life. I have received an email saying that I had been awarded with the Microsoft Most Valuable Professional 🚀 (MVP) award. WOW !!!

Microsoft MVP Award
Click on a image to learn more about Microsoft MVP Award 🙂

Who are MVPs?

Microsoft Most Valuable Professionals, or MVPs, are technology experts who passionately share their knowledge with the community. They are always on the “bleeding edge” and have an unstoppable urge to get their hands on new, exciting technologies. They have very deep knowledge of Microsoft products and services, while also being able to bring together diverse platforms, products and solutions, to solve real world problems. MVPs make up a global community of over 4,000 technical experts and community leaders across 90 countries/regions and are driven by their passion, community spirit, and quest for knowledge. Above all and in addition to their amazing technical abilities, MVPs are always willing to help others – that’s what sets them apart.

Microsoft MVP Program
mvp.png

As you might know, the Microsoft MVP program rewards  the “technology experts who passionately share their knowledge with the community”.  

There are many categories of MVP awards, and I am proud to become a Microsoft Azure MVP this year. You could check the rest of the award categories here:

  • Artificial Intelligence
  • Business Applications
  • Cloud & Datacenter Management
  • Developer Technologies
  • Data Platform
  • Enterprise Mobility
  • Microsoft Azure
  • Office Development
  • Office Apps & Services
  • Windows Development
  • Windows & Devices for IT

Wondering what it takes to become an MVP?

Interested in becoming an MVP ❓🤔
What does it take to become an MVP ❓🤔

Then => check an Official Microsoft page to get started on your journey 🗺 .

What is next?

I am still in a pleasant shock, and simply to say that “I am proud and humbled to receive this award” is an understatement.

Now, I am looking toward to take part in this awesome event – “Microsoft MVP Global Summit 2022” and meet legend #MVPs 🚀 🚀🚀

Image
Click on a image to learn more about Microsoft MVP Global Summit 2022 🙂


I am really excited about this new journey and invite you – the Cloud Marathoners ⛅🏃‍♂️🏃‍♀️ to be an important part of this journey !!!

Simplifying Azure IaC with Azure Bicep child resources

Hello Cloud Marathoners,

The infrastructure-as-code (IaC) is not a just a “buzzword”, it is brought by a necessity to manage your digital estate more predictably while source-controlling the changes that are introduced over time. In its turn, this approach makes it easier to keep your workload environments compliant and saves ton of time in troubleshooting, development and auditing your resources

In this post, we will look into the necessity of child resources in Azure and how Bicep language simplifies their management and declaration as a code.

why azure bicep child resources?

There are a number of scenarios where it makes perfect sense to declare resources within the context of their parent. For example; storage blob containers could not be declared and used without a parent storage account.

In addition to Blob containers, there are many other child resource types in Azure like:

  • Virtual network subnets
  • SQL databases
  • Azure Cosmos DB containers
  • SQL databases
  • VM extensions

How could you define child resources?

Unsurprisingly, there is more than one way to define Azure Bicep child resources. Each approach will depend on a specific use case that you or your team is looking forward to delivering.

Further we will use the example of a storage account resource to describe different options of child resource declarations. This will make it easier to describe the concepts and available options to you. However, these concepts could be easily used on other Azure services like VMs and VNets that do have child resources too.

All the options and sample codes are available on Learn-Bicep GitHub repo page.

Option-1 : Child resource created with reference to parent

Our first option is declaring a child Blob container resource as a separate independent resource with a reference to a parent resource. Like, it is illustrated on the example screen-shot from the Learn-Bicep repo.


For this option to work, we would need to declare an Azure Storage Blob service too. Let’s look into how it could be done while considering a second option.

Option-2 : Including a child resource in the declaration

Our second option is declaring a Storage Blob service resource as a separate independent resource with a reference to a parent Storage Account resource. Then it has an inner declaration for a container child resources within the Storage Blob service.

Let’s look at the example screen-shot from the Learn-Bicep repo.

This option might be an ideal approach if you have few child resources in your declaration. However, it would not be the most efficient one to use, if the number of child resources you are required to deploy is in dozens, hundreds or even thousands.

Option-3 : Automation and looping with enumeration 🙂

The final option will serve you well, if you have 100s of pre-defined containers that should be deployed into your Azure environment.

By leveraging the “iterative loops” in Bicep we can easily iterate over these containers while creating them in a compact and repeatable manner, like in the following screen-shot from the repo code.


Looking for more Bicep goodness?

A community of developers and engineers started a great initiative – to help everyone to learn Azure Bicep for #free by sharing & contributing to the AWESOME-Azure-Bicep GitHub repo.

Please, like ⭐ subscribe 🍴 & fork it 👍
As always #SharingIsCaring

summary

In this post, you have learned about three different options to declare Bicep child resources.

All code samples and presented Bicep files are placed in “Learn-Bicep” GitHub repo 👉 https://github.com/ElYusubov/Learn-Bicep/blob/main/samples/14-deploy-child-parent-scenarios.bicep 👍

Would you be interested in a recorded short video that demonstrates these capabilities ?