Azure Resource Mover makes it really easy to move your resources, like Azure VMs, across regions. There are some minor details you need to take care to have the whole process run smoothly.

Let’s see how we can move our VM from a region to an other with simple steps

1. At the Azure Portal search for “Azure Resource Mover”

2. At the Azure Resource Mover” wizard click “Move across regions”

3. Select the source & target region

4. select the resources you want to move

5. Accept the notification and start he process and go to the “Across Regions” option and press “Validate dependencies” button in the middle

6. After the validation, check the Issues column of all resources and resolve if any.

7. First we need to move the Resource Groups only. The move process has four steps, the Prepare, the Initiate Move , the Commit move and finally delete the source resources.  So, select only all the “resources groups” and press “Prepare”

8. Select again the Resource Groups and press “Initiate Move”

9. Select gain the Resource Groups and press “Commit Move”

10. Now the Resource Groups are created at the target region, and is at pending deletion at the source. We can proceed with the rest resources. Select the rest resources and go through the same process, the Prepare, the Initiate Move , the Commit move and finally delete the source resources.

At the Prepare state, the Azure Site Recovery agent is installed at the VM and the data are replicated to the target region. This takes a lot of time, depending on the size of the data but it does not affect the VM.

Sneak peak: You can view the process of the VM, by navigating to the VM blade and go to the Disaster Recovery setting

11. Once all resources are in “Initiate move” pending state, select them and press “Initiate Move”. ATTENTION: at this state, there will be downtime to move the VMs. The source VMs will show down, a final data sync will be performed and finally the target VMs will start.

12. Wait until all resources are at the Commit Move state, select them and press “Commit Move”

at this state, we can see that we have two resource groups, the source and the target:

At the source resource group, the VMs will be stopped and at the target started. Note here that the target IP is not the same as the Source. Your Public IPs will be altered.

13. After the commit move, you will need to delete the source resources manually.

More info at: About the move process in Azure Resource Mover | Microsoft Docs

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Move your Azure VM across regions appeared first on Apostolidis Cloud Corner.

Resource Graph Explorer is part of Azure Governance. You can find more guides about Azure Governance at my posts like How to limit the Azure VM Sizes and How to enforce tags for resources creation using the Azure Governance tag.

Create a chart showing the number of VMs by Operating System at my tenant.

Open the Azure Portal and search for the Resource Graph Explorer and open it

The window that will open looks familiar because it uses the same query language like Log Analytics, the Kusto. On the right side, at the Resource Window, you can search for any resource type, click it and it will be added to the Query Window. We will start with the “resources” that will bring us all resources

Then we will search for virtual machines to find the correct type

clicking the microsoft.computer/virtualmachines it will automatically change the query to narrow the search to bring only the Virtual Machines

To see the results just press “Run Query”. At the Resources window you can see all the VMs properties, like name, location, tags, resourcegroup and a property named “properties”. If you open this you will see all the details of the VMs.

The Operating System property is under “storageProfile” / “osDisk” / osType. So we need to alter our query like this:

resources
 | where type == "microsoft.compute/virtualmachines"
 | summarize count() by tostring(properties.storageProfile.osDisk.osType)

Running the above query will bring the VMs by OS. Next Results you can click Charts to select the Chart you like.

You can save the query to add a name and also reuse it. The name will appear once we add the chart to the Azure Dashboard, it will be the title.

For our Dashboard I will use a Donut chart. To add it to the Azure Dashboard click “Pin to dashboard”

And this is the dashboard view

We can add more resources, like Public IP Addresses

Change the query to this:

Resources
 | where type == "microsoft.network/publicipaddresses"

To expand the properties, add the ” | project properties ” at the query and  click the “see details” link.

View the properties details and find the name of the ip address key

To create a chart with all Public IP Addresses run the below query

Resources  
| where type == "microsoft.network/publicipaddresses"
| summarize count() by tostring(properties.ipAddress)

And this is the result, pined to Azure Dashboard

Add a chart to show the location of all of my resources

summarize count() by location | project  location, total=count_| order by total desc 
| where total > 1

Now at my Azure Dashboard I have VMs per OS, all Public IP Addresses and the location of all of my resources

Find more at the Azure Resource Graph documentation

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Dashboard using Resource Graph Explorer appeared first on Apostolidis Cloud Corner.

Azure Storage Advanced Threat Protection is a new security feature, currently in Preview. It monitors the Azure Blob Storage accounts. It detects anomalies and uncommon access to the Storage Account and notifies the admins through email.

All the Azure Storage Advanced Threat Protection monitoring and logs are integrated to the Azure Security Center, including the well known ASC recommendations.

It’s so easy to enable, just go to the Azure Portal, navigate to your storage account’s Advanced Threat Protection setting and switch it ON!

After that you can view the alerts at the Security Center, under Threat Protection’s Security Alerts.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Storage Advanced Thread Protection appeared first on Apostolidis Cloud Corner.

In this post series we will go through some basic steps on how to start with Microsoft Azure. At this post we will see how we can create Point-to-Site VPN connection with Azure.

If you don’t have an Azure Subscription, you can easily create a free trial by just going to https://azure.microsoft.com/en-us/free/

Create typical a VIrtual Network

In order to create Point-to-Site VPN connection it needs a Virtual Network Gateway. Go to the Virtual Network, Subnets and add a Gateway Subnet.

FInally we can add the Virtual Network Gateway. From the portal, create a Virtual Network Gateway resource and add it to the previously created Virtual Network.

The Virtual Network Gateway can take up to 45 minutes to be created.

Once the Virtual Network Gateway is created we need one more step. To configure Point-to-site. Open the Virtual Network Gateway and press configure.

We will need a root and a client self-signed certificate to complete the setup. Using a WIndows 10 or Windows Server 2016 machine we can make use of the New-SelfSignedCertificate cmdlet that makes the process easy. The whole process is described here: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

For the root certificate run the below PowerShell using ISE:

$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `
-Subject "CN=prodevrootcert" -KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign

For the client certificate run the below PowerShell using ISE:

New-SelfSignedCertificate -Type Custom -DnsName ProDevChildCert -KeySpec Signature `
-Subject "CN=ProDevChildCert" -KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" `
-Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")

Export the root certificate in cer format using MMC, open the Certificates snap-in and select “current user”. Find the root certificate under Personal –> Certificates and right click –> All Tasks export

Select to “not export the private key” and use Base64 encoded.

Now you have the prodevrootcert.cer

After that, export the client certificate by selecting “export the private key” , select the “include all certificates in the certification path” and the “enable certificate privacy”. Add a password and export it to pfx file.

Now you have the prodevchildcert.pfx. This pfx file must be installed to all the client computers that will use this Point-to-Site connection.

Now lets go back to the Point-to-Site configuration page. Add an address pool that the VPN clients will use. This subnet must be different from the Virtual Network address space.

Then open the root certificate, the cer file, using notepad, copy the text between the Begin and End marks.

Paste the certificate text to the “Root certificated” –> Public certificate data” field and add a name to the “Name” field.

Press Save and the “Download VPN Client” button will be enabled and we can download the VPN client.

In order to establish the VPN connection we need to install the VPN Client and the Client “pfx” certificate to the workstation.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Start Point | Point-to-Site VPN appeared first on Apostolidis Cloud Corner.

In this post series we will go through some basic steps on how to start with Microsoft Azure. For start we will create a Web App.

If you don’t have an Azure Subscription, you can easily create a free trial by just going to https://azure.microsoft.com/en-us/free/

Let’s create our first Web App. Go to the Azure Portal by navigating to https://portal.azure.com and click “+ Create a resource”

At the search box write “Web App” and press enter

At the search results. click the “Web App” and at the next screen just press “Create”

The “Web App Create” wizard will open.

Enter a name for the App. This will be the Public name of your App. Azure by default provides the domain *.azurewebsites.net for free. So in my example the prowebdev.azurewebsites.net will be the URL of my App Select the Azure Subscription that will used to bill the Web App and a Resource Group. The Resource Group is used to organize the resources and provide role based access control among other. OS: Select the Operating System platform that will host your Web App. This can be Windows, Linux or a Docker Container. For the test I will select Windows.

As you can see the wizard has selected an App Service Plan by default with a random name and location. The App Service Plan is actually the Web Server that will host out Web App. Click on the “App Service Plan/Location”

Add a name for the Web Server, select the Location that is nearest to you (or your clients) and the Pricing Tier.

By pressing OK you will return to the Web App create wizard and press Create. Now you can monitor the creating process of the App form the “Notifications” option at the top right of the portal, it is the button that has a ringing bell image. First you will see the “Deployment in progress…” message and as soon as the App is ready you will see the “Deployment completed” message.

Now if you go to the Resource group you will see two resources. The App Service and the App Service Plan. In high level, the App Service Plan is the web server and the App Service is the Web Application.

Now click the App Service and at its blade you can see your applications URL.

Click the URL and you will see the Demo page

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Start Point | Your first Web App appeared first on Apostolidis Cloud Corner.

Remember all that red alerts when comes to deleting blobs? Ah, forget them! Microsoft Azure brought the Windows Recycle Bin to Azure and named it Soft delete.

The soft delete feature basically is similar to the Windows recycle bin. Deleting a file from the Windows explorer, the Operating System instead of actually removing the file it moves it to the recycle bin. The file stays there and it can be undeleted at any time. The soft delete feature in Microsoft Azure does the same thing for blob storage. When data is deleted or overwritten, the data is not actually gone. Instead, the data is soft deleted, thereby making it recoverable if necessary.

It’s not enabled by default, but it’s very easy to enable it. Go to the Storage Account, scroll down to the Blob Service and select “Soft delete”. Select the Retention policy and Save, that’s all!

Let’s delete and test. Browse a container and click the “Show delete blobs”. The current blob will show as active.

deleting the blob it will change the status to “deleted”

Click the three little dots and you can undelete, the blob, in Azure!!!

Active again!

Be careful, if you delete the whole container, the storage account or the Azure Subscription there is no return. The Soft delete feature is at blob level inside a container.

For more deltails visit the docs: https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-soft-delete

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Blob Storage… Recycle Bin!!!!!!! appeared first on Apostolidis Cloud Corner.

Have you checked the update management system for your Azure and On-Premises server that supports both Windows and Linux operating systems? And it is completely free! Please find the full list of supported operating systems and prerequisites here: https://docs.microsoft.com/en-us/azure/operations-management-suite/oms-solution-update-management#prerequisites.

Lets get started. The easiest way is to start from an Azure VM. Go to the VMs blade and find “Update management”. You will see a notification that the solution is not enabled.

Click the notification and the “Update Management” blade will open. The “Update Management” is an OMS solution, so you will need to create a “Log analytics” workspace, you can use the Free tier. If you don’t have a Log analytics workspace the wizard will create a default for you. Also it will create an automation account. Pressing enable will enable the “Update Management” solution.

After about 15 minutes, at the “Update Management” section of the VM you will see the report of the VM’s updates.

After that process the Automation Account is created and we can browse to the “Automation Accounts” service at the Azure Portal. There click the newly created Automation Account and scroll to the “Update Management” section. There we can see a full report of all VMs that we will add to the Update Management solution. To add more Azure VMs simply click the “Add Azure VM” button.

The Virtual Machines blade will open and will list all Virtual Machines at the tenant. Select each VM and press Enable.

After all required VMs are added to the Update Management solution click the “Schedule update deployment” button. There we will select the OS type of the deployment, the list of computers to update, what type of updates will deploy and the scheduler. More or less this is something familiar for anyone that has worked with WSUS.

Press the “Computers to Update” to select the Azure VMs for this deployment from the list of all VMs enabled.

Then select what types of updates will deploy.

If you want to exclude any specific update you can add the KB number at the “Excluded updated” blade.

And finally select the schedule that the update deployment will run.

Back to the “Update Management” blade, as we already said, we have a complete update monitoring of all Virtual Machines that are part of the “Update Management” solution.

You can also go to the “Log Analytics” workspase and open the “OMS Portal”

There, among other, you will see the newly added “System Update Assessment” solution.

and have a full monitoring and reporting of the updates of your whole environment.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Update Management appeared first on Apostolidis Cloud Corner.

Web Application Firewall was always a big investment for a small or growing company as most of the top branded companies are charging a lot of money  A Web Application Firewall protects your application from common web vulnerabilities and exploits like SQL Injection or Cross site scripting. Azure provides enterprise grade Web Application Firewall through the Application Gateway. It comes in two pricing models, Medium and Large. More about sizes and instances you can find here, and more about pricing here

We can add the Application Gateway Web Application Firewall to protect our Azure Web App (PaaS) and our Web Application inside a VMs web server (IaaS). At this post we will see how to protect them both.

One difference in order to fully protect the Azure Web App (PaaS) is to integrate the App Service to a Virtual Network (VNET). In order to integrate an App Service to a Virtual Network it requires a Standard, Premium, or PremiumV2 pricing plan and requires the Virtual Network to have a Virtual Network Gateway that is configured with Point to Site VPN.

Virtual Network

First things first, create a VNET. The VNET must have at least two subnets. One subnet to deploy the Virtual Machine that we will use to publish an IIS Application and one dedicated for the Application Gateway WAF.

Once the VNET is created enable the Point-2-Site VPN. More details can be found here: https://www.e-apostolidis.gr/microsoft/azure/azure-start-point-point-to-site-vpn/ 

Web App

Create a Web App from Azure Portal. For more details check here: https://www.e-apostolidis.gr/microsoft/azure/azure-start-point-your-first-web-app/

VNet Integration

Once the Web App is ready, go to Networking and select “Click here to configure”

Add VNET, select the VNET and press save

Then go back to the Networking blade of the App Service and go to Firewall in order to disable public access and allow only access from the VNET. To do this click the “Configure Access Restrictions”

create an allow IP Restriction and add the WAF’s IP. Once you create an Allow rule, all other access to the app service is restricted automatically. If you try to browse the public URL of the App Service it will return “Error 403 – This web app is stopped.”

Web Application Firewall

Lets create the Secure public entry point for our Web App. Create an application gateway, select WAF Tier, select the required SKU, add it to the WAF subnet we created before, select Public IP configuration and WAF enabled.

When the Application gateway is ready we need to do some configuration. First at the Backend pools, open the default created backend pool, select “App Service” and browse to the required web app.

Then add a health probe. For host add the FQDN of the Web App.

at the HTTP settings check the “Use for App service”

Add a rule to bind the Listener, Backendpool and HTTP settings

And that’s all. Now we can try our Web App from the Internet. In order to do so we need to browse to the Web App’s URL, that is now published by the Application Gateway, from the Internet. So, we need to create a Public DNS record to point the FQDN to the Application Gateway’s FQDN. In this case we need to crate a CNAME papwaf3app.funniest.gr to point to the 8b0510c1-47e9-4b94-a0ff-af92e4455840.cloudapp.net. In order to test the app right now we can just add a host file to our computer pointing to the Public IP Address of the application gateway and we can access the Web App behind the WAF.

Logging

In order to be able to see the Application Gateway and Web Application Firewall logs we need to turn on diagnostics. The easiest way to see the logs is by sending them to Log Analytics (OMS).

With the Firewall at “Detection” mode, if we try an SQL Injection (?id=10||UTL_INADDR.GET_HOST_NAME( (SELECT user FROM DUAL) )–), the Web App still servers the landing page.

By switching the Firewall to “Prevention” mode, the same SQL injection attach stops by the WAF before accessing our Web App.

Protect an IaaS Web Application

To add a Web Application that runs inside a VM behind the Application Gateway Web Application Firewall, first add the VM as a Back End Pool. Create a new Backend Pool and select “Virtual Machine”. Select the Virtual Machine that runs the Web Application.

Then create a new probe adding the URL of the Web Application

next add HTTP settings and add custom probe the new created probe “vmsite”

Next step is to create two multi-site listeners, one for each host name

After the listener, add a Basic rule using the Listener, Backend Pool and HTTP settings we created for the VM Web Application,

Finally one extra step is to change the default rule1 to listen to the WeB App listener

Finally the Application Gateway Web Application Firewall provides secure access to both the Web App (PaaS) and the VM Web Application (IaaS)

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Protect your Web App using Azure Application Gateway Web Application Firewall appeared first on Apostolidis Cloud Corner.