Agenda  Why Azure Resource Manager  What has already been enabled  Questions/Feedback

Today’s Challenge It’s difficult to…  Deploy or update a group of resources, repeatedly  Manage permissions on a group of resources  Visualize a group of resources in a logical view, including monitoring/billing

Singleton s  Deploy becomes more complex  Proper use of resources becomes more abstract  Isolation makes communication a challenge VIRTUAL MACHINE STORAGE SQLDATABASE

Resource Centric Views 6

Introducing Resource Manager Application Lifecycle Container Declarative solution for Deployment and Configuration Consistent Management Layer

Resourc e Groups  Tightly coupled containers of multiple resources of similar or different types  Every resource *must* exist in one and only one resource group  Resource groups can span regions

Coupling for Resources Resource Group is a unit of management  Lifecycle: deployment, update, delete, status  Identity: resources can talk to each other  Grouping: Metering, billing, quota: applied & rolled up to group  Access Control: Scope for RBAC permissions

Resource Group Lifecycle Question: Should these resources be in the same group or a different one? Hint: Do they have common lifecycle and management? Answer: Up to you.

Azure Templates can: Ensure Idempotency Simplify Orchestration Simplify Roll-back Provide Cross-Resource Configuration and Update Support Azure Templates are: Source file, checked-in Specifies resources and dependencies (VMs, WebSites, DBs) and connections (config, LB sets) Parametized input/output Instantiation of repeatable config. Configuration  Resource Group Power of Repeatability SQL - AWebsite Virtual Machines SQL-A Website [SQL CONFIG] VM (2x) DEPENDS ON SQL SQLCONFIG

Add your own Power Some resources can be extended allowing more code or data inside the resource AV agent inside a VM WordPress Webdeploy package on a Website Allow for Scripting or Imperative configuration of resources Extensible solution (Windows and Linux): VMM Agent DSC (in-VM PowerShell) Chef Puppet 12

Consistent Management Layer AZURE RESOURCE MANAGER API

So, what does this all mean… Application Lifecycle Container  Deploy and Manage your application as you see fit Declarative solution for Deployment and Configuration  Single click deployment of multiple instantiations of your application Consistent Management Layer  The same experience of deployment and management whether you go from the Portal, Command Line, or Tools

Demo Let’s see that work

Azure RM Capabilities Centralized auditing of operations Simple tagging and grouping of resources Consistent access control (e.g. RBAC) 16

Supported Resources and Roadmap Websites SQL Azure DB Classic Compute Classic Network Classic Storage Redis Cache … all existing Azure services are coming on-line 17

Audited Management Operations Create / Update / Delete operations are audited Rich querying capabilities Available at subscription, resource group and resource 18

Detailed Audits 19 Rich information about the who, what and when Correlation id groups related operations (e.g. templates)

Resource Tags Name-value pairs assigned to resources or resource groups Subscription-wide taxonomy and complete for tag consistency Each resource can have up to 15 tags

Tagging Tips Notes: attach notes to resources via tags Creator: track who is the “owner” or responsible for a resource Department/Cost center: record who is responsible for paying for a resource Environment: group resources in production vs. pre-production vs. test

22 Organizational concepts Resource groups Tightly coupled to a container of resources Follows RBAC rules 1 resource group Tags Loosely coupled user or system defined categorization Arbitrary boundaries 15 tags to use as needed Resource groups and tags are the building blocks from which users define applications.

Access Control: RBAC Allows secure access with granular permissions to resources Assignable to users, groups or service principals Built-in roles make it easy to get started 23

Two Key Concepts 24 Role Definitions describes the set of permissions (e.g. read actions) can be used in multiple assignments Role Assignments associate role definitions with an identity (e.g. user/group) at a scope (e.g. resource group) always inherited – subscription assignments apply to all resources

Role Based Access Control

Granular Scopes /subscriptions/{id}/resourceGroups/{name}/providers/…/sites/{site} subscription level – grants permissions for all resources in the sub resource group level – grants permissions for all resources in the group resource level – grants permissions to the specific resource

Demo Let’s see that work

Recap  Next generation of Azure management  Templates provides predictability / efficiency  Audits, Tags, Access Control & more  Works Everywhere (public + private clouds) 28

References MVA Azure RM session: API docs on MSDN: Template docs on MSDN: Azure RM cmdlets: Available on 29

Questions/Feedback 30