Technical Blog | REBELADMIN

Learn about Active Directory and Various Azure Services

Archives for February 2020

Step-by-Step Guide to Azure Private Endpoints (PowerShell Guide)

Last Updated on February 29, 2020 by Dishan M. Francis

Azure Private Link provides secure access to certain Azure PaaS services such as Azure SQL Database, Azure Storage, Azure Vault Services, MySQL Databases, Azure Cosmo DB via Microsoft backbone network. This will prevent sensitive data been transfer over the public internet. There are mainly two components in Azure Private Link.

Azure Private Endpoint – Azure private endpoint is a network interface that has a private ip address from a VNET. This allows us to connect to Azure services such as Azure vault, Azure Cosmo Database, Azure SQL database, Azure Storage etc. via Azure Private Link.

Azure Private Link Service – Azure Private Link service allows us to enable private access to our services which are placed behind Azure standard load balancer. Customers/Consumers can connect to these services via private endpoints placed in their own VNETs.

In this demo, I am going to demonstrate how to create Azure private endpoints and how we can access the Azure SQL database using it.

For the configuration process, I will be using PowerShell. Therefore, please make sure you have Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-2.6.0

Let’s go ahead and start the configuration process by creating a new resource group.

1. Launch PowerShell console and connect to Azure using Connect-AzAccount

2. Then create a new resource group using,

New-AzResourceGroup -Name REBELRG -Location “East US”

In the above, REBELRG is the resource group name and East US is the resource group location.

3. The next step is to create a new virtual network.

$vmsubnet = New-AzVirtualNetworkSubnetConfig -Name vmsubnet -AddressPrefix “10.0.2.0/24” -PrivateEndpointNetworkPoliciesFlag “Disabled”

New-AzVirtualNetwork -Name REBELVN1 -ResourceGroupName REBELRG -Location “East US” -AddressPrefix “10.0.0.0/16” -Subnet $vmsubnet

In the above, REBELVN1 is the new virtual network name. It has 10.0.0.0/16 address space. It also has a new subnet 10.0.2.0/24 (vmsubnet) for virtual machine and private endpoint. In the above -PrivateEndpointNetworkPoliciesFlag is set to disable. This will disable applying network policies on private endpoint in the subnet.

4. We now have the virtual network ready. The next step is to create a new virtual machine for testing.

$mylogin = Get-Credential

New-AzVm -ResourceGroupName REBELRG -Name “REBELTVM01” -Location “East US” -VirtualNetworkName “REBELVN1” -SubnetName “vmsubnet” -addressprefix 10.0.2.0/24 -PublicIpAddressName “REBELVM01IP1” -OpenPorts 3389 -Image win2019datacenter -Size Standard_D2s_v3 -Credential $mylogin

In the above, I am creating a virtual machine called REBELTVM01. It is running windows server 2019 data centre edition. I have specified it using -Image parameter. It also using Standard_D2s_v3 vm size. [Read more…] about Step-by-Step Guide to Azure Private Endpoints (PowerShell Guide)

Step-by-Step Guide to Azure AD Access Package

Last Updated on February 18, 2020 by Dishan M. Francis

In an organization, we add users to roles, groups, and applications to allow them to do certain tasks. Some of these tasks may not be carried out frequently. Is there a better way to handle these types of access, how we can ensure a user only have the relevant permissions when they required?

Azure AD Access packages allow administrators to manage access permissions to groups, applications and SharePoint sites in a more efficient way. Internal and external users will have relevant permissions to do their tasks only when they required. It will reduce the manual review of the user account permissions. The relevant policies will ensure who can request access, how the access requests are handled and when the access permissions will be revoked.

Azure AD access packages can use to,

• Manage membership of Azure AD groups
• Manage membership of Office 365 groups
• Manage membership of SharePoint sites
• Mange membership of Azure AD applications

In this post, I am going to demonstrate how we can manage access permissions using Azure AD Access Package.

In my demo environment, I have a user called Debra Berger. She is going to work on a new recruiting campaign. As part of her job, she has to access LinkedIn application. At the moment only members of sg-Finance & sg-Sales and Marketing groups have access to it. Debra Berger is not a member of both groups. She only needs this app for the new campaign. So, let’s go ahead and create an access package for this.

To do this,

1. Log in to Azure Portal as Global Administrator https://portal.azure.com/

2. Go to Menu and click on Azure Active Directory

3. Then click on Identity Governance

4. Click on Access packages

5. Then click on New access package

6. It will open a new wizard to create access packages. Provide name, description, and catalog for the new access package. By default, the catalog is set to General, if required you can create your own. Once settings are in click on Next: Resource roles >

[Read more…] about Step-by-Step Guide to Azure AD Access Package

Step-by-Step Guide: DNS based traffic load balancing with Azure Traffic Manager (PowerShell Guide)

Last Updated on February 8, 2020 by Dishan M. Francis

In my previous blog post, I explained how to setup an Azure Traffic Manager. In there, I used GUI method to set it up. In this post I am going to show how we can set up Azure Traffic Manager using Azure PowerShell.

In this demo, I am going to demonstrate how we can use Azure traffic managers to improve the application/service performance by pointing users to the closest endpoint. This demo includes the following tasks,

1. Setup two new resource groups (East US, UK South)
2. Setup two new windows VM (East US, UK South)
3. Setup IIS with sample web page
4. Create a Traffic Manager profile
5. Add endpoints to Traffic Manager profile
6. Testing

Setup two new resource groups (East US, UK South)

Let’s go ahead and start the setup process by creating a new Azure resource group.

For the configuration process, I will be using Azure PowerShell. Therefore, please make sure you have an Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-2.6.0

1. Launch PowerShell console and connect to Azure using Connect-AzAccount
2. Then create a new resource group using,

New-AzResourceGroup -Name REBELRGEUS -Location “East US”
New-AzResourceGroup -Name REBELRGUKS -Location “UK South”

In the above, we are creating two resource groups. The first one called REBELRGEUS and it is created on East US Azure region.
The second group is called REBELRGUKS and it is created on UK South azure region.

Setup two new windows VM (East US, UK South)

1. In this demo, I am going to use two back end servers. Before VM setup, let’s go ahead and create a new virtual network in REBELRGEUS resource group

$vmsubnet = New-AzVirtualNetworkSubnetConfig -Name vmsubnet -AddressPrefix “10.0.2.0/24”

New-AzVirtualNetwork -Name REBELVN1 -ResourceGroupName REBELRGEUS -Location “East US” -AddressPrefix “10.0.0.0/16” -Subnet $vmsubnet

In the above, REBELVN1 is the new virtual network name. It has 10.0.0.0/16 address space. It also has a new subnet 10.0.2.0/24 (vmsubnet) for virtual machines.

2. Then let’s go ahead and create another virtual network under REBELRGUKS resource group.

$vmsubnet2 = New-AzVirtualNetworkSubnetConfig -Name vmsubnet2 -AddressPrefix “10.1.3.0/24”

New-AzVirtualNetwork -Name REBELVN2 -ResourceGroupName REBELRGUKS -Location “UK South” -AddressPrefix “10.1.0.0/16” -Subnet $vmsubnet2

In the above, REBELVN2 is the new virtual network name. It has 10.1.0.0/16 address space. It also has a new subnet 10.1.3.0/24 (vmsubnet2) for virtual machines.

3. As the next step of the configuration, I am going to create a new virtual machine under REBELRGEUS resource group. This will be used for testing purposes.

$mylogin = Get-Credential

New-AzVm -ResourceGroupName REBELRGEUS -Name “REBELTVMEUS” -Location “East US” -VirtualNetworkName “REBELVN1” -SubnetName “vmsubnet” -addressprefix 10.0.2.0/24 -PublicIpAddressName “REBELTVMEUSIP1” -OpenPorts 3389,80 -Image win2019datacenter -Size Standard_D2s_v3 -Credential $mylogin

[Read more…] about Step-by-Step Guide: DNS based traffic load balancing with Azure Traffic Manager (PowerShell Guide)

Step-by-Step Guide: DNS based traffic load balancing with Azure Traffic Manager

Last Updated on February 1, 2020 by Dishan M. Francis

In my previous blog post, I explain how we can use Azure load balancer to distribute network traffic to endpoints in the same Azure region. It can be accessed using https://www.rebeladmin.com/2020/01/step-step-guide-setup-azure-load-balancer/ . But we can’t use the same method to distribute traffic to different Azure regions. For that, we have to use the Azure Traffic Manager.

The azure traffic manager is a DNS based traffic load balancer. It does have the following characteristics,

• Based on the traffic-routing method, it can route traffic to the closest endpoints to the user. This will improve the application/service performance.
• When an endpoint is not available, the traffic will automatically route to the most appropriate endpoint.
• Application/service maintenance can be done without any downtime. During the maintenance, traffic can redirect to other available endpoints.

In this demo, I am going to demonstrate how we can use Azure traffic managers to improve the application/service performance by pointing users to the closest endpoint. This demo includes the following tasks,

1. Setup two new resource groups (East US, UK South)
2. Setup two new windows VM (East US, UK South)
3. Setup IIS with sample web page
4. Create a Traffic Manager profile
5. Add endpoints to Traffic Manager profile
6. Testing

Setup two new resource groups (East US, UK South)

Let’s go ahead and start the setup process by creating a new Azure resource group.
For the configuration process, I will be using Azure PowerShell. Therefore, please make sure you have an Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-2.6.0

1. Launch PowerShell console and connect to Azure using Connect-AzAccount
2. Then create a new resource group using,

New-AzResourceGroup -Name REBELRGEUS -Location “East US”

New-AzResourceGroup -Name REBELRGUKS -Location “UK South”

In the above, we are creating two resource groups. The first one called REBELRGEUS and it is created on East US Azure region.

The second group is called REBELRGUKS and it is created on UK South azure region.

[Read more…] about Step-by-Step Guide: DNS based traffic load balancing with Azure Traffic Manager