AAtsushi's Blog
Azure

AZ-104 Study Notes

→ 日本語版を読む

Contract Types

  • Azure Direct
  • Azure EA
  • Azure in Open
  • CSP

Benefits of Multiple Subscriptions

  • Split invoices
  • Separation of access rights
  • Separation of quota management

Resource Manager and Resource Providers

Resource Manager accepts API requests, and resource providers create the resources.

Resource providers include Microsoft.Compute, Microsoft.Storage, Microsoft.Web, and others.

Immediately after obtaining a new subscription, resource providers are not registered. Creating a resource will automatically register the resource provider. However, some resources require manual registration.

Moving Resources

Most major resources can be moved to a different resource group or subscription group.

Management Tools

  • Azure Portal
  • Azure CLI
  • Azure PowerShell
  • Azure Cloud Shell
  • Azure Mobile App

ARM Templates

Template structure:

  • $schema
  • contentVersion
  • parameters: Parameters that can be input at deployment time
  • variables: Variables used within the template
  • resources
  • outputs

Azure AD

Editions:

  • Azure AD Free
  • Azure AD Office 365 Apps
  • Azure AD Premium P1
  • Azure AD Premium P2

Tenant

Organizations are managed in units called tenants. One subscription is associated with one tenant.

Main features:

  • Object management
  • MFA
  • Conditional access
  • Self-service password reset

Device registration:

  • Azure AD device registration
  • Azure AD Join
  • Hybrid Azure AD Join

Environment Management

  • Tags
  • Locks
  • Quotas
  • Azure Advisor: Recommends deleting unused resources, etc.
  • Azure Policy
  • RBAC
  • Management groups: Group multiple subscriptions

Cost Management

Main costs:

  • Virtual machines
  • Storage
  • Network: Outbound traffic incurs costs

Tools:

  • Pricing calculator: Simulate costs
  • Cost analysis: Can leverage tags for aggregation
  • Budget: Prevents excessive costs from occurring

Cost reduction:

  • Use reservations
  • Azure Hybrid Benefit
  • Use Azure credits for Visual Studio subscribers

Azure Policy

Scope (can be applied to all except resources):

  • Tenant
  • Management group
  • Subscription
  • Resource group

※ Policies assigned to higher levels are inherited

Policy definitions:

  • Types of resources that can be used
  • Types of resources that are not allowed
  • Allowed locations
  • Allowed virtual machine size SKUs
  • Storage accounts must be restricted to allowed SKUs
  • Add tags and their values to resources

Initiative definitions:

  • Group multiple policies together

Other:

  • Policy definitions are evaluated against existing resources as well

RBAC

Characteristics:

  • JSON format
  • Built-in roles and custom roles
  • Roles can be assigned not only to users and groups, but also to service principals (applications)

Representative built-in roles:

  • Owner
  • Contributor: Has full control access like Owner, but cannot grant permissions to users
  • Reader
  • User Access Administrator
  • Virtual Machine Contributor

Role structure (partial):

  • actions
  • notActions
  • assignableScopes

Role evaluation:

  • When multiple roles are assigned, the actual permissions are the union of the assigned roles. However, notActions from each role are not added together.

Virtual Machines

What is a virtual machine?

  • Hyper-V servers (hosts) run on blades installed in racks at Microsoft data centers
  • The Azure virtual machine service runs virtual machines on these hosts

Components:

  • CPU
  • Memory
  • Disk
  • Network interface

Disks:

  • By purpose:
    • OS disk
    • Temporary disk: Defaults to D drive
    • Data disk
  • By type:
    • Standard HDD
    • Standard SSD
    • Premium SSD
    • Ultra Disk

Images:

  • Broadly divided into Windows and Linux OS
  • Not just the OS alone — middleware and specific applications can also be installed

Availability Sets:

  • Fault domains
    • How many racks to distribute across
    • Maximum value is 3
  • Update domains
    • How many server groups to distribute across
    • Maximum value is 20

Availability Zones:

  • Place multiple virtual machines in separate data centers

Representative extensions:

  • Custom Script
  • PowerShell DSC extension

Monitoring:

  • Diagnostics agent: The Diagnostics agent. Collects logs and performance data generated by the guest OS and applications into a storage account.
    • The Linux Diagnostic Extension should be used which downloads the Diagnostic Extension (LAD) agent on Linux server.

Connection methods:

  • RDP
  • SSH
  • Bastion

Bastion connection:

  • Connect to a virtual machine through the Azure portal using port 443 without exposing RDP or SSH ports externally.
  • Create a dedicated subnet for Bastion only in the same virtual network where the virtual machine is placed. The subnet name must be "AzureBastionSubnet". The subnet address prefix value must be /26 or smaller.
  • Then create the Bastion and assign a public IP address. There is no need to assign a public IP address to the virtual machine.

Scale Sets:

Scale set configuration items:

  • Initial instance count
  • Scaling policy
  • Scale-in policy
  • Upgrade mode: 3 types — manual, automatic, rolling
  • Overprovisioning: When enabled, starts more virtual machines than actually requested. Deletes excess machines when provisioning is confirmed successful. This shortens deployment time.

Scaling settings:

  • Scale-out rules execute if any of them are met
  • Scale-in rules execute only when all of them are met

Storage Accounts

Storage service types:

  • Blob containers
  • Azure Files
  • Azure Queue Storage
  • Azure Table Storage

Storage account types:

※ The supported storage services differ depending on account type.

  • Standard general-purpose v2
  • Premium block blob
  • Premium file share
  • Premium page blob

Replication options:

  • LRS
    • Copies to 3 disks within a data center
    • Unavailable if the data center is destroyed by fire or flood
  • ZRS
    • Copies data to 3 zones
  • GRS
    • Copies to 3 disks within a data center
    • Also copies to 3 disks within a data center in a different region
    • Total of 6 disk copies
    • Under normal conditions, only the primary region is accessible
  • RA-GRS
    • Even under normal conditions, the secondary region is readable
    • Can load balance
  • GZRS
    • Copies data to 3 zones
    • Also copies to 3 disks within a data center in a different region
    • Total of 6 disk copies
    • Under normal conditions, only the primary region is accessible
    • Differs from GRS in replication within the primary region
  • RA-GZRS
    • Even under normal conditions, the secondary region is readable
    • Can load balance

Storage security:

  • Secure transfer option
  • Soft delete
  • Service endpoints
  • Shared Access Signature (SAS)
  • Storage Service Encryption (SSE)

Azure Blob Storage (Blob containers)

Storage formats:

  • File storage
  • Block storage
    • Storage managed and accessed in block units
  • Object storage
    • Amazon S3 is also this. No hierarchical structure.

Blob Storage resources:

  • Hierarchical structure: Storage account > Container > Binary large object

Container public access levels:

※1 The following settings are at the container level

※2 To allow access via the internet, "Allow Blob public access" must be enabled in the storage account settings

  • Private
    • No access via internet
    • Only access from within Azure is possible
  • Blob
    • Access via internet is possible
    • However, file listings cannot be retrieved
  • Container
    • Access via internet is possible
    • File listings can be retrieved

Blob types:

When uploading files to a container, you need to select a "Blob type" parameter.

  • Block blob
    • Suitable for uploading general files
  • Append blob
    • Can append blocks to the end of a blob. Cannot update or delete existing blocks.
    • Suitable for storing logs
  • Page blob
    • Collection of 512-byte pages
    • Used when you want to upload VHD files created in an on-premises Hyper-V environment for use in Azure virtual machines

Access tiers:

  • Hot
  • Cool
  • Archive
    • Cannot be read or modified
    • To read, you need to switch to Hot or Cool (rehydrate), which can take several hours or more

Lifecycle management:

  • Set a lifecycle management policy to automatically change access tiers or delete files

Azure Files

Characteristics:

  • File sharing service accessible via SMB protocol or NFS protocol

Storage tiers:

  • Premium
  • Transaction optimized
  • Hot
  • Cool

Connection:

  • Port number 445 must be allowed

Azure File Sync:

  • Synchronizes (copies) files to a Windows file server
  • 1-to-many sync configuration is possible
  • Can be used for disaster recovery

Components:

  • Storage Sync Service
    • The top-level object for registering servers used with Azure File Sync
    • Manages sync groups
  • Registered server
    • The target Windows server registered with the Storage Sync Service
  • Azure File Sync agent
    • An agent program installed on the Windows server
  • Cloud endpoint
    • A pointer to an Azure file share
  • Server endpoint
    • Represents a directory path on a registered Windows server
    • The directory contents are synchronized with the Azure file share
  • Sync group
    • The sync relationship between cloud endpoints and server endpoints

Implementation steps:

  1. Deploy the Storage Sync Service
  2. Prepare the target Windows server for sync
  3. Install the File Sync agent on the Windows server
  4. Register the Windows server with the Storage Sync Service
  5. Create sync group and cloud endpoint
  6. Add server endpoint

Service Endpoints

  • Blocks access via the internet
  • Allows access only from specified virtual networks
  • Works between virtual networks and service instances in the same region

Encryption Keys

Types:

  • Microsoft-managed keys
    • Stored in the Microsoft key store
  • Customer-managed keys
    • Stored in Azure Key Vault or Key Vault HSM

Network Services

Types:

  • Virtual network
  • VPN gateway
  • Express Route
  • Azure Firewall
  • Azure DNS
  • Load Balancer
  • Traffic Manager
  • Application Gateway

Virtual network:

  • Communication across virtual networks is not possible
  • For cross-VNet communication, use peering or VPN gateway
  • By default, all subnets within the same virtual network can communicate
  • Address space can be expanded later
  • If peering is configured, temporarily delete peering, change the address space, then reconfigure peering

Private IP:

  • Automatically assigned by Azure's internal DHCP service
  • Static assignment is also possible with a specified address

Public IP:

  • Static assignment is possible. The address cannot be specified.
  • DNS name can be set
    • <DNS label name>.<region name>.cloudapp.azure.com
  • SKU
    • Basic
    • Standard
      • Availability zones are supported in addition to Basic

Network Security Group

  • Can be associated with a network interface (NIC) or subnet
  • When NSG is associated with both NIC and subnet, both rules must allow the traffic
  • Only one NSG can be associated with a single NIC (or subnet)
  • The NSG region and the associated NIC (or subnet) region must be the same
  • Divided into inbound/outbound security rules
  • Rules are checked in priority order; if a higher-priority rule matches, lower-priority rules are not applied

Application Security Group

  • Groups the NICs of multiple virtual machines
  • ASGs can be used as source and destination in NSG rules

Azure Firewall

  • Azure Firewall is superior to NSG for network filtering across entire virtual networks
  • Multiple virtual networks can be associated with Azure Firewall

Implementation steps:

  1. Create a virtual network and subnet for placing Azure Firewall. It can also be created on an existing virtual network. The subnet name must be "AzureFirewallSubnet" and the prefix must be /26 or smaller.
  2. Deploy Azure Firewall
  3. Create a route table and associate it with the subnet. Configure the route table so that outbound traffic goes through Azure Firewall.
  4. Create firewall policy and rules

Rules:

  • Network rules
    • Applied to both outbound and inbound
    • Specify IP protocol and port number to allow/deny matching traffic
  • Application rules
    • Applied to outbound only
    • Specify destinations accessible from the virtual network by FQDN
    • Applied only when no matching network rule exists
  • DNAT rules
    • Applied to inbound
    • Performs address translation and filtering of incoming traffic
    • Translates the firewall's public IP and port to a private IP and different port
    • For example, translates packets arriving at port 2000 of the firewall's public IP to port 3389 of 10.0.0.4

Azure DNS

Purpose:

  • External name resolution (DNS zone)
  • Internal name resolution (private DNS zone)

DNS zone (DNS delegation):

  • For example, if the domain name is xxxx.work, DNS queries for the domain must be delegated from the parent domain "work" to Azure DNS in order to reach Azure DNS.
  • Specifically, an NS record referencing Azure DNS must be created in the parent domain's zone (the domain registrar who sold the domain registers the NS record).

Private DNS zone:

  • Resolution virtual network
    • Records are not dynamically registered
  • Registration virtual network
    • Records are dynamically registered (IP address and VM name=FQDN are registered as A records)
    • Dynamic registration only occurs when the virtual machine is running

Peering

Since communication between different virtual networks is not possible, peering is needed.

  • Virtual network peering
    • Peering within the same region
  • Global virtual network peering
    • Peering between different regions

Characteristics and notes:

  • Peering is possible across different subscriptions and different tenants
  • Peering is not possible if the virtual network address spaces overlap
  • Peering requires configuration in both directions
  • Peering is not transitive. When three virtual networks are chained with peering, you cannot cross through the middle virtual network. One-to-one peering connections are always required.
  • To change the address space of a peered virtual network, you must temporarily delete the peering.

Peering options:

  • VPN gateway sharing
    • Place a VPN gateway in a subnet of a different VNet and use that VPN gateway
    • Both the side lending and the side borrowing the VPN gateway need to configure settings
  • Traffic forwarding for service chaining
    • Place a router in the hub VNet, and spoke VNets configure peering to the hub VNet
    • Install a router in the hub VNet so that traffic can be forwarded from spoke VNets to other spoke VNets
    • To achieve this, in addition to installing a router, you also need to configure user-defined routes and allow "Traffic forwarded from remote virtual network" in the VNet

VPN Gateway

Characteristics:

  • The actual implementation is a software gateway on a virtual machine

Configurations using VPN gateway:

  • Site-to-site connection
    • Connect on-premises to VNet
  • Point-to-site connection
    • Connect a PC to VNet
  • VNet-to-VNet connection
    • Goes through the Azure backbone network, not the internet

Site-to-site VPN connection steps:

  1. Create VNet and subnet
    1. Subnet is dedicated to the VPN gateway; subnet name must be GatewaySubnet. Recommended address prefix length is /27 or /28.
  2. Create VPN gateway
  3. Create local network gateway
    1. Create a resource called a local network gateway to register the on-premises VPN device
  4. Create a "connection"
    1. Creating a resource called "connection" connects the VPN gateway and the on-premises VPN device

VPN gateway types:

  • VPN
  • ExpressRoute

VPN types:

※ Cannot be changed once created. Requires deletion and re-creation.

  • Policy-based
    • Sends packets based on IPsec policy
    • Can only be used for site-to-site connections; SKU is limited to Basic SKU for testing/evaluation
  • Route-based
    • Sends packets based on routing
    • Route-based is used for most VPN gateways
    • Supports site-to-site, point-to-site, and VNet-to-VNet connections

VPN gateway SKUs:

  • There are SKU types for each generation. Basic SKU is for testing/evaluation.
  • BGP is supported for all SKUs except Basic SKU

Availability modes:

※ When a VPN gateway is created, internally two instances are deployed. These two instances are by default active/standby.

  • Active/standby
    • Switchover takes about 15 seconds for maintenance
    • Switchover takes about 3 minutes for failures
  • Active/active
    • Can be enabled except for Basic SKU
    • Can also be changed after creation
    • A second public IP must be assigned to the VPN gateway
    • The on-premises VPN device must be configured to accept two public IPs and two VPN tunnels

Express Route

  • With VPN gateway, site-to-site connections go through the internet
  • There may be communication delays and packet loss
  • Express Route connects on-premises to Microsoft data centers over a dedicated private network

Options:

  • Connection provider
  • Supported bandwidth
  • Redundant connectivity
  • Connectable cloud services
  • Billing model
    • Metered
    • Unlimited
  • SKU
    • Local
    • Standard
    • Premium

Connection methods:

  • Point-to-point Ethernet connection
  • Co-location at a cloud exchange
  • Any-to-any network

Two types of Express Route peering:

  • Azure private peering
    • Used for connecting to VNets
    • Can connect using the VNet's private IP address
  • Microsoft peering
    • Used for connecting to Azure PaaS services
    • Public IP only
    • On-premises side must use NAT to convert private IPs to public IPs

Implementation steps:

  1. Create Express Route circuit
  2. Configure Express Route peering
  3. Create Express Route gateway
  4. Create connection

Virtual WAN

Skipped

Route Tables

System routes:

  • By default, system routes are assigned to subnets
  • System routes include several route entries by default
  • Enabling peering or service endpoint features adds route information to system routes

User-defined routes:

  • Route information independently defined by the user
  • Higher priority than system routes
  • Duplicate routes are overridden by user-defined routes

Creating user-defined routes:

  1. Create a route table
  2. Add routes
  3. Associate with a subnet

Service Endpoints

  • Access PaaS services from within Azure without going through the internet
  • VNet-side settings
    • Select the service you want to use a service endpoint for on the desired subnet (Microsoft.Storage, Microsoft.Sql, etc.)
  • Service-side settings
    • For storage, select the VNet and subnet to allow access from in the storage account's network management screen
    • For SQL Database, select the VNet and subnet to allow access from in Overview > Server Firewall settings

Private Endpoint (Private Link)

  • Both service endpoints and private endpoints allow access to PaaS without going through the internet
  • The difference is that service endpoints use a public IP for access, while private endpoints use a private IP

Implementation:

  • Create a private endpoint from Private Link
    1. Select the private endpoint name
    2. Select the resource to connect to
    3. Select the VNet and subnet where the private endpoint will be placed

Azure Load Balancer

Skipped

Azure Application Gateway

Skipped

App Service

Characteristics:

  • Easily build execution environments for web applications and REST APIs
  • PaaS. Supports load balancing and auto-scaling. Easy version upgrades.

Available languages:

  • .NET
  • Node.js
  • PHP
  • Java
  • Python
  • HTML

App Service Plan:

  • App Service is the compute environment for running web apps
  • Create an App Service plan, then create App Services that run on top of it
  • Multiple App Services run on top of one App Service plan

App Service plan pricing tiers:

  • Determined by size and SKU
  • Free, Shared, Basic
    • For development and testing. No auto-scaling.
  • Standard, Premium
    • For production environments
  • Isolated
    • Mission-critical workloads running in a high-speed network environment

Deployment slots:

  • Available at Standard pricing tier and above
  • Add a staging slot separate from the running production slot, and switch by swapping

Scaling:

  • Scale up/down and scale out/in are possible
  • Custom auto-scaling is possible at Standard tier and above

Backup:

  • Available at Standard pricing tier and above
  • Backups are stored in a storage account's Blob container
  • A storage account must be created in advance

Container Services

  • A container is an app and its execution environment packaged together

Azure container services:

  • Azure Container Instances (ACI)
    • Easily create Windows or Linux containers
  • Azure Kubernetes Service (AKS)
    • Container orchestration with Kubernetes

Azure Container Instances (ACI)

Characteristics:

  • Fast startup (seconds)
  • Supports both internet exposure and Azure-internal only
  • Flexible CPU and memory specification
  • Data persistence with Azure Files
  • Supports Windows containers and Linux containers
    • Windows containers: Host OS is Windows, with Docker runtime and Docker containers running on Windows
    • Linux containers: Host OS is Linux, with Docker runtime and Docker containers running on Linux

Creating a container instance:

  • Select the container image source (choose from a container registry)
  • Specify the number of CPU cores and memory
  • Select network type (public or private)

Azure Kubernetes Service (AKS)

Creating a Kubernetes cluster:

※ Set the following parameters when creating the cluster:

  • Preset configuration (Standard, etc.)
  • Kubernetes version
  • Node pools
  • Enable virtual machine scale sets
  • Network configuration
    • kubenet
      • Assigns IP addresses to nodes
      • Pods communicate outside the cluster using NAT
    • Azure CNI
      • All pods obtain IP addresses from the subnet
      • Pods can be accessed directly via private IP from the VNet

Adding pods:

  • Use kubectl to interact with the cluster when loading a YAML file to add pods
  • kubectl is installed by default in Azure Cloud Shell
> az aks install-cli
> az aks get-credentials --resource-group <RG name> --name <cluster name>
> kubectl get nodes
> kubectl apply -f <YAML file name>
> kubectl get pod
> kubectl get svc

Azure Backup

  • Azure VM disks are VHD files
  • These VHD files are stored in a storage account
  • Azure Backup performs incremental backups
  • Backup data is stored in a Recovery Services vault
  • Recovery Services vaults are configured with GRS, resulting in 6 copies of backup data

Three scenarios:

  • Protection of files, folders, and system state
    • Install the MARS (Microsoft Azure Recovery Services) agent on computers running Windows OS
    • Protects files, folders, and system state
    • MARS agent is also called the Azure Backup agent
  • Virtual machine protection
    • Strictly speaking, backs up the VHD files that are the VM disks
    • Can recover at the file level, not just the entire virtual machine
  • Workload protection
    • By deploying MABS (Microsoft Azure Backup Server), based on System Center Data Protection Manager (DPM), on the network, protects workload data running on Windows computers on the network

Recovery Services vault:

  • Storage location for Azure Backup data
  • Recovery Services vault must be in the same region as the resources being backed up

Backup behavior:

  • A snapshot of the VM is created and transferred to the Recovery Services vault as backup data
  • When backing up a running Windows VM, it works with VSS to obtain an app-consistent snapshot
  • On Linux, application consistency is not guaranteed, so you need to either stop the service before backing up or use a script provided by Microsoft

Implementation steps:

  1. Create a Recovery Services vault
  2. Select VM backup
  3. Configure the backup policy (backup execution time and retention period)
    1. Can retain for a maximum of 9,999 days
  4. Select the machine to backup

※ To delete a Recovery Services vault after backup is enabled, you must stop the backup and completely delete the backup data.

Scenarios other than "virtual machine protection":

  • Protection of files, folders, and system state
    • Select "On-premises" for workload execution location, and select "Files and folders" for backup content
    • Steps are shown along with downloading the MARS agent and container credentials file
  • Workload protection
    • Select "On-premises" for workload execution location, and select "Microsoft SQL Server" or "Microsoft Exchange" for backup content

VM restore options:

  • Create a new virtual machine
  • Restore disks
  • Replace disks on an existing virtual machine

Azure Site Recovery

Skipped

Azure Monitor

Monitoring data collected by Azure Monitor:

  • Application monitoring data
  • Guest OS monitoring data
    • Need to install Azure Monitor agent, or extensions such as Windows Azure Diagnostics or Linux Azure Diagnostics, on the VM
  • Azure resource monitoring data
  • Azure subscription monitoring data
  • Azure tenant monitoring data

Data types:

  • Metrics
    • Can be viewed in Monitor > Metrics
  • Logs
    • Can be viewed in Monitor > Activity log
    • Activity log retention period is 90 days and cannot be changed
    • To retain longer, download in CSV format or send to a Log Analytics workspace or storage account

Alerts:

  • Specify conditions for metrics or logs, and execute actions when conditions match
  • Specify 3 elements: scope (target for alerts), conditions, and actions
  • Actions are specified as action groups
    • Action groups can run Automation Runbooks or send notifications
    • Notifications have rate limits
      • Email: 100 or fewer per hour
      • SMS: 1 or fewer per 5 minutes
      • Voice: 1 or fewer per 5 minutes

Log Analytics

Characteristics:

  • Integrated as part of Azure Monitor. New name is "Azure Monitor logs."
  • Execute queries against log data for filtering and analysis
  • Can also monitor on-premises
  • Billed based on volume of data stored. However, no charges until collected data exceeds a certain amount.

Log Analytics workspace:

  • First create a Log Analytics workspace to use Log Analytics
  • Once the workspace is created, send activity logs and other data to the workspace
  • Using the Log Analytics agent, data generated by the OS can be sent to the workspace

Log Analytics agent:

Connecting to Activity Log:

  • Activity Log > Diagnostic settings > Add diagnostic setting
  • Select the activity log category to collect and choose the Log Analytics workspace as the destination

Connecting to Azure resources:

  • For cases connecting to Azure Storage, Azure Load Balancer, etc.
  • Target resource's "Diagnostic settings" > Add diagnostic setting > Select Log Analytics workspace as the destination

Connecting to Azure virtual machines:

  • Install the Log Analytics agent on the target virtual machine
  • In the Log Analytics workspace screen, select Virtual Machine > Connect to select the target machine and install the Log Analytics agent
  • Other methods include using ARM templates or PowerShell

Configuring the Log Analytics agent:

  • To collect monitoring data with the agent, you must separately select what monitoring data to collect with the agent, in addition to installation
  • Log Analytics workspace > Agent configuration > Specify data to collect

Searching monitoring data:

  • Managed in separate tables by type of monitoring data
  • Table types include:
    • Event
    • Syslog
    • Perf
    • AzureActivity
    • AzureMetrics
  • Data retention period up to 730 days
  • Can search using Kusto Query Language: Event | search "error" Event | where EventLog == "System"

Network Watcher

Q&A

  • How to restore a VM infected with ransomware?

    • Create a new VM based on a backup taken with Azure Backup, or replace the existing VM's disks with the backup.

  • How to provide authentication to an AKS cluster with Azure AD?

  • Who can access the tenant root management group?

  • What is an example of a conditional access policy setting in Azure AD?

    • For a requirement that all users are prompted for MFA when accessing the Azure portal, the settings would be as follows:
      • Select Users & Groups: Where you have to choose all users.
      • Select Cloud apps or actions: to specify the Azure portal
      • Grant: to grant the MFA.

  • How to set up an external partner employee to access Azure with a Microsoft account?

  • Which storage accounts can use the Azure Import/Export service?

    • Storage account types:
      • Standard General Purpose v2 storage accounts (recommended for most scenarios)
      • Blob Storage accounts
      • General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments)
    • Storage service types:
      • Import supports Azure Blob storage and Azure File storage
      • Export supports Azure Blob storage

  • Which storage account supports the Table storage service?

    • General Purpose v1 storage
    • General Purpose v2 storage

  • What should be checked if a Recovery Services vault cannot be deleted?

    • Confirm that backup has been stopped

  • Can the Recovery Services vault and the protected VM be in different regions?

    • The protected VM must be in the same region as the Recovery Services vault

  • Which storage services can be backed up with Azure Backup?

    • File shares only
    • Other things that can be backed up with Azure Backup:
      • Azure VM
      • SQL on Azure VM
      • SAP HANA on Azure VM
      • Azure file shares
      • Azure Backup agent
      • Azure Backup Server
      • System Center DPM

  • What storage services can AzCopy copy?

    • Azure Blob storage
    • Azure File storage

  • How to output alerts from logs collected with the Azure Monitor agent?

    • Output logs from the Azure Monitor agent installed on the VM to a Log Analytics workspace. Configure the Log Analytics workspace as the alarm source in Azure Monitor.

  • How to move a VM to a different VNet?

    • Moving is not possible.
    • If necessary, delete the VM and create a new VM in a different VNet with the attached disks.

  • Can DNS zone files be imported/exported?

Important Notes

  • When creating an ARM template for VM creation, the resource group alone cannot be included in the template. Therefore, it must be entered at deployment time.

  • When managing VM software with Desired State Configuration (DSC), the VM needs to be running.

  • If the Public IP displayed on the NIC is a name rather than an IP address, the VM is offline.

  • Only virtual machines in a backend pool with standard SKU public IP configurations or no public IP configuration can be connected to a Load Balancer. Since the VM's public IP is dynamic, the IP must be a Basic SKU IP. Such VMs (using Basic SKU IP) cannot be added to a Standard SKU load balancer. Unless the public IP is removed or converted to a Standard SKU IP, the VM will not appear in the backend pool portal for selection.

    • Standard SKU public IP: Static IP
    • Basic SKU public IP: Dynamic or static IP

  • A public load balancer will not deliver traffic to VMs in the backend pool unless an NSG is configured.

  • No more than 20% of the Scale Set upgrading at any time, then 2 machines out of 10 will have maintenance, the 8 remaining VMs will be up.

    • Virtual machine scale sets are created with five fault domains by default in Azure regions with no zones. For the regions that support zonal deployment of virtual machine scale sets and this option is selected, the default value of the fault domain count is 1 for each of the zones. FD=1 in this case implies that the VM instances belonging to the scale set will be spread across many racks on a best effort basis.

  • Each availability set can be configured with up to 3 fault domains and 20 update domains.

  • Zone-redundant gateways and zonal gateways both rely on the Azure public IP resource Standard SKU. The configuration of the Azure public IP resource determines whether the gateway that you deploy is zone-redundant, or zonal. If you create a public IP resource with a Basic SKU, the gateway will not have any zone redundancy, and the gateway resources will be regional.

← Back to articles