8. Easily migrate existing applications as-is to the cloud Assist New Cloud App Development by Integrating IaaS and PaaS Functionality Set up new virtual machines in Windows Azure with only a few clicks. Agentless Deployment for Windows Servers Start from a pre-built image from our image library Upload your own VHD from on- premises. Create Your Own Customized Images Support for community and commercial versions of Linux Move images back on premise as necessary Run enterprise applications such as SQL Server, SharePoint or Active Directory in the cloud Easily create hybrid cloud and on-premises solutions with VPN connectivity between the Windows Azure Data Center and your own network. SLA for Virtual Machines 99.95%* Flexible SolidOpen

10. Software-as-a-Service SaaS Platform-as-a-Service PaaS Infrastructure-as-a-Service IaaS

11. On-Premise Storage Servers Networking O/S Middleware Virtualization Data Applications Runtime You manage Infrastructure (as a Service) Storage Servers Networking O/S Middleware Virtualization Data Applications Runtime Managed by vendor You manage Platform (as a Service) Managed by vendor You manage Storage Servers Networking O/S Middleware Virtualization Applications Runtime Data Software (as a Service) Managed by vendor Storage Servers Networking O/S Middleware Virtualization Applications Runtime Data

15. Windows Azure Storage VM with persistent drive

16. Windows Azure Storage VM with persistent drive

17. Windows Azure Storage VM with persistent drive

18. Reliable and always on Windows Azure Storage

19. Continuous storage geo-replication > 500 miles Windows Azure Storage

20. Base OS image for new Virtual Machines Sys-Prepped/Generalized/Read Only Created by uploading or by capture Writable Disks for Virtual Machines Created during VM creation or during upload of existing VHDs. Images and Disks

22. Disk TypeDefaultSupported OS DiskReadWriteReadOnly and ReadWrite Data DiskNoneNone, ReadOnly and ReadWrite Modify using Set-AzureOSDisk or Set-AzureDataDisk

23. (New AD) Create New VM Configure Data Disk for ReadOnly Cache Mode Place.dit on Data Disk (Existing AD) Upload Existing Domain Controller VHD(s) Create New VM with VHD(s) attached Configure Disk with.dit for ReadOnly Cache Mode

24. DEMO Configuring storage

27. Single Public IP Per Cloud Service

32. 10.0.0.10 10.0.0.11 131.57.23.120 10.2.2.0/2410.2.3.0/24 10.1.2.0/2410.1.3.0/24 65.52.249.2210.1.0.410.1.1.4

33. 10.2.2.0/2410.2.3.0/24 10.2.2.0/2410.2.3.0/24 65.52.249.2210.1.0.410.1.1.4

34. DEMO Configuring network

35. Plan and define your network before start Define your affinity groups to be close to your data consumers Define your DNS servers On Azure DNS, your first persistent IP will be X.X.X.4 On Premises, use your own DNS servers Define your local networks if you plan to use “Azure Gateway” Create you Gateway connection Deploy your VMs After you have deployed VMs to this network you cannot change you’re the network settings!

37. VM SizeCPU CoresMemoryBandwidth # Data Disks Extra SmallShared768 MB5 (Mbps)1 Small11.75 GB100 (Mbps)2 Medium23.5 GB200 (Mbps)4 Large47 GB400 (Mbps)8 Extra Large814 GB800 (Mbps)16 New A6428GB1.000(Mbps)8 New A7856GB2.000(Mbps)16

38. Cloud Management Portal >_ Scripting (Windows, Linux and Mac) REST API Boot VM from New Disk Server

39. Windows Azure Customer Data Center Other Service Providers Windows Virtual Machine

40. DEMO Moving a VM from “On Premise to Azure” Using App Controller

42. What’s included Compute Hardware failure (disk, cpu, memory) Datacenter failures - Network failure, power failure Hardware upgrades, Software maintenance – Host OS Updates Planned downtime – 6 day notice, 6 hour window, 25 minute downtime What is not included VM crashes caused by 3 rd party software, Guest OS Updates 99.95% for multiple role instances 4.38 hours of downtime per year

43. Roles not supported on Windows Azure Virtual Machines : Dynamic Host Configuration Protocol Server Hyper-V Remote Access (Direct Access) Windows Deployment Services Notable features that are not supported BitLocker Drive Encryption (on the OS disk – may be used on data disks) Failover Clustering Internet Storage Name Server Multipath I/O Network Load Balancing Peer Name Resolution Protocol SNMP Services Storage Manager for SANs Windows Internet Name Service Wireless LAN Service

44. DEMO They will be out Domain Controllers on Windows Azure Deploying our VM’s

46. Placing Active Directory domain controllers in Windows Azure equates to running virtualized domain controllers Hypervisors provide or trivialize technologies that don’t sit well with many distributed systems… including Active Directory Business drivers Support pre-requisites for other Applications or Services Serve as substitute or failover for branch-office/HQ domain controllers Serve as primary authentication for cloud only data center Design considerations Certain Active Directory configuration knobs and deployment topologies are better suited to the cloud than others

47. Is it safe to virtualize DCs? Placement of the Active Directory database (DIT) Optimizing your deployment for traffic and cost Read-Only DCs (RODC) or Read-Writes? Global Catalog or not? Trust or Replicate? IP addressing and name resolution Geo-distributed cloud-hosted domain controllers

49. Active Directory DIT’s/sysvol should be deployed on data disks Data Disks and OS Disks are two distinct Azure virtual-disk types they exhibit different behaviors (and different defaults) Unlike OS disks, data disks do not cache writes by default NOTE: data disks are constrained to 1TB 1TB > largest known Active Directory database == non-issue Why is this a concern? Write-behind disk-caching invalidates assumptions made by the DC DC’s assert FUA (forced unit access) and expect the IO subsystem to honor it FUA is intended to ensure sensitive writes make it to durable media can introduce USN bubbles in failure scenarios

50. Consider cost and deploy according to requirements Inbound traffic is free, outbound traffic is not Standard Azure outbound traffic costs apply Nominal fee per hour for the gateway itself Can be started and stopped as you see fit if stopped, VMs are isolated from corporate network RODCs will likely prove more cost effective

51. DC-locator and ISTG/ISM (intersite topology generator and messenger) Correctly defining and connecting Active Directory subnets and sites will influence your bottom-line sites, site-links and subnets affect who authenticates where and DCs’ replication topology Ensure the cost between any on-premises site and the cloud-sites are appropriately dissuasive i.e. the notion of “next closest site” (a common fallback in Active Directory) should not conclude that the cloud is the next closest Ensure replication is scheduled (not “Notify-”driven) Ensure it’s compressed (and crank it up—domain controllers offer aggressive controls around compression of replication traffic) Align replication schedule with latency tolerance DCs replicate only the last state of a value so slowing replication down saves cost if there’s sufficient churn

52. GCs are necessary in multi-domain forests for authentication Workloads in the cloud that authenticate against a DC in the cloud will still generate outbound authentication traffic without one used to expand Universal Group memberships less predictable cost associated with GCs since they host every domain (in-part) completely unpredictable cost if workload hosts Internet-facing service and authenticates users against Active Directory Could leverage “Universal Group Membership Caching” Predominantly replicates inbound only outbound replication is possible with other GCs

53. Choice Add replica DCs in the cloud or build a new forest and create a trust? Kerberos or Federated Motivators Security (selective authentication feature) Compliance/privacy (HBI/PII concerns) Cost replicate more or generate more outbound traffic as a result of authentication and query load Resiliency/fault-tolerance if the link goes down, trusted scenarios are likely entirely broken

54. Name resolution Deploy Windows Server DNS on the domain controllers Windows Azure provided DNS does not meet the complex name resolution needs of Active Directory (DDNS, SRV records, etc.) A critical configuration item for domain controllers and domain-joined clients must be capable of registering (DCs) and resolving resources within their own Since static addressing is not supported, these settings MUST be configured within the virtual network definition Azure VMs require “DHCP leased addresses” but leases never expire or move between VMs The non-static piece is the opposite of what most Active Directory administrators are used to using When an Azure VM leases an address, it is routable for the period of the lease The period of the lease directly equates to the lifetime of the service  so we’re good Traditional on-premises best practices for domain controller addressing do NOT apply Do NOT consider statically defining a previously leased address as a workaround this will appear to work for the remaining period of the lease but once the lease expires, the VM will lose all communication with the network  not good when it’s a domain controller

56. Site to Site VPN Tunnel AD Authentication + On-Premises Resources Contoso.com Active Directory Load Balancer Public IP

57. Load Balancer Public IP Site to Site VPN Tunnel On Premises Resources Contoso.com Active Directory AD Auth Extranet Active Directory

58. Site to Site VPN Tunnel AD Authentication + On-Premises Resources Contoso.com Active Directory AD Auth Load Balancer Public IP

59. DEMO Deploying DCs on Azure

60. 89 Australia Austria Belgium Brazil Canada Chile Colombia Costa Rica Cyprus Czech Republic Denmark Finland France Germany Greece Hong Kong Hungary India Ireland Israel Italy Japan Korea Luxembourg Malaysia Mexico Netherlands New Zealand Norway Peru Philippines Poland Portugal Puerto Rico Romania Russia Singapore Spain Sweden Switzerland Trinidad & Tobago UK United States New Countries: Algeria Argentina Belarus Bulgaria Croatia Dominican Rep Ecuador Egypt El Salvador Estonia Guatemala Iceland Indonesia Jordan Kazakhstan Kenya Kuwait Latvia Liechtenstein Lithuania Macedonia Malta Montenegro Morocco Azerbaijan Nigeria Oman Pakistan Panama Paraguay Qatar Saudi Arabia Serbia Slovakia Slovenia South Africa Sri Lanka Taiwan Thailand Tunisia Turkey UAE Ukraine Uruguay Venezuela Bahrain Azure countries and territories

69. http://www.facebook.com/TechNet.Spain http://www.twitter.com/TechNet_es TechNet Spain

70. PFE blogs Blog de PFE España: http://blogs.technet.com/b/pfespain Blog de PFE Plataforma WW (Inglés) http://blogs.technet.com/b/askpfeplat/ Azure Windows Azure MSDN Blog http://blogs.msdn.com/b/windowsazure/ Windows Azure YouTube Channel http://www.youtube.com/user/windowsazure

71. TechNet