Technical Blog | REBELADMIN

Learn about Active Directory and Various Azure Services

Archives for September 2020

How to replicate Azure VM to a secondary Azure Region?

Last Updated on September 21, 2020 by Dishan M. Francis

When it comes to Disaster recovery solutions, most of the time we select a different physical site as a backup/replication target. This is because if the primary site is down, we still have a copy of data safe on different site. We also can do the same with Azure VM. By using Azure Site Recovery Service, we can simply replicate existing Azure VM to a secondary Azure Region.

Let’s go ahead and see how we can do this.

For the configuration process, I will be using PowerShell as well as GUI. Therefore, please make sure you have an Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-3.8.0

Create an Azure VM to use as Source

I like to begin the configuration process by creating a Test VM. To do that,
1. Launch PowerShell console and connect to Azure using Connect-AzAccount
2. Then create a new resource group using,

New-AzResourceGroup -Name REBELRG1 -Location “East US”

Azure resource group for Source Azure VM

In the above, REBELRG1 is the resource group name and its created-in East US Azure region.

3. The next step is to create a new virtual network under REBELRG1 resource group.

$vmsubnet = New-AzVirtualNetworkSubnetConfig -Name vmsubnet -AddressPrefix “10.0.2.0/24”
New-AzVirtualNetwork -Name REBELVN1 -ResourceGroupName REBELRG1 -Location “East US” -AddressPrefix “10.0.0.0/16” -Subnet $vmsubnet

Azure virtual network for source

In the above, REBELVN1 is the new virtual network name. It has 10.0.0.0/16 address space. It also has a new subnet 10.0.2.0/24 (vmsubnet) for virtual machines.

4. As the next step of the configuration, I am going to create a new virtual machine under REBELRG1 resource group. This will be used for testing purposes.

$mylogin = Get-Credential
New-AzVm -ResourceGroupName REBELRG1 -Name “REBELTVM01” -Location “East US” -VirtualNetworkName “REBELVN1” -SubnetName “vmsubnet” -addressprefix 10.0.2.0/24 -PublicIpAddressName “REBELVM01IP1” -OpenPorts 3389 -Image win2019datacenter -Size Standard_D2s_v3 -Credential $mylogin

Create Azure VM

In the above, I am creating a virtual machine called REBELTVM01 in East US Azure region. It is running windows server 2019 data center edition. I have specified it using -Image parameter. It also using Standard_D2s_v3 vm size. For networking, it uses REBELVN1 virtual network and subnet 10.0.2.0/24.

5. Then I log in to the VM and created a folder and a file to use later for testing.

New-Item -Path ‘C:\REBELTest’ -ItemType Directory
New-Item -Path ‘C:\REBELTest\Test1.txt’ -ItemType File

Create test files for Azure replication testing [Read more…] about How to replicate Azure VM to a secondary Azure Region?

How to setup Azure AD Connect cloud provisioning?

Last Updated on September 9, 2020 by Dishan M. Francis

User names and passwords are the most common way of controlling access to applications. Nowadays we use more and more applications. These applications can be from on-premises or cloud. Unless there is a central identity management system, users will have to maintain different usernames, passwords to access these applications.
Azure Active Directory is a powerful, reliable cloud-based identity and access management service. It can use to manage identities and access for cloud applications as well as on-premises applications. If we already have a Windows Active Directory environment, using Azure AD connect we can sync on-premises identities to Azure AD. Azure AD Connect supports various Windows Active Directory topologies. More information about these supported topologies can be found here.
However, In Azure AD connect, synchronization and provisioning from AD are managed in the on-premises level. This can be a complex task especially if you have multiple AD forests. To simplify the hybrid identity synchronization process, Microsoft now has Azure AD Connect cloud provisioning. With this solution, Microsoft will manage provisioning from AD and synchronization as part of the service. In on-premises we only need to install light-weight agents which will act as a bridge between Azure AD and Windows AD.

Apart from the simplicity, Azure AD Connect cloud provisioning gives the following benefits,

• Allow Azure AD synchronization from multiple disconnected on-premises AD forests.
• Multiple agents will provide high availability for password hash synchronization.

What are the differences between Azure AD Connect and Azure AD Connect cloud provisioning?

Feature Azure AD Connect Azure AD Connect cloud provisioning
Synchronize multiple disconnected on-premises AD forests NO YES
Synchronize single on-premises AD forest YES YES
Synchronize multiple on-premises AD forests YES YES
Synchronization Based on Agents NO YES
Multiple Agents for High Availability NO YES
Synchronize with LDAP YES NO
Synchronize Users, Groups, Contacts YES YES
Synchronize device objects YES NO
Synchronize Exchange online attributes YES YES
Synchronize extension attributes 1-15 YES YES
Synchronize customer defined AD attributes YES NO
Support for federation YES YES
Seamless Single Sign-on YES YES
Support for Pass-Through Authentication YES NO
Support for Password Hash Sync YES YES
Support for writeback (passwords, devices, groups) YES NO
Azure AD Domain Services support YES NO
Exchange hybrid writeback YES NO

Azure AD Connect cloud provisioning Setup

In this blog post, I am going to demonstrate how to set up Azure AD Connect cloud provisioning with Windows AD. In my demo environment, I already have Windows AD configured with domain M365x620957.onmicrosoft.com

windows active directory configuration

Let’s go ahead and start the configuration process by installing the Azure AD Connect provisioning agent. [Read more…] about How to setup Azure AD Connect cloud provisioning?

Step-by-Step Guide: Azure Active Directory Domain Services resiliency with replica sets

Last Updated on September 1, 2020 by Dishan M. Francis

In an Active Directory Environment, we keep additional domain controllers to improve resiliency. In this way, if one domain controller fails it will not make a big impact. We can further improve the resiliency of infrastructure by keeping an additional domain controller and mission-critical servers in a different location. So, in the event of a site failure, we will still have a domain controller and mission-critical servers running on a remote location. When we create the Azure Active Directory Domain Services managed domain, we provide a unique domain name. In the back end, Azure will deploy two domain controllers with this unique domain in your selected Azure region. This setup is called a “replica set“. Now, to improve resiliency, we can create additional replica sets in other Azure regions.

Each replica set uses a virtual network. All these virtual networks must be peered to create a mesh network to support the replication between replica sets.

Azure Active Directory Domain Services replica sets have the following characteristics.

• This feature is still in the preview stage.
• Each replica set contains the same data. You can’t use different domains for different replica sets.
• All replica sets will be placed in the same Active Directory site. Because of that the replication between replica sets is faster.
• All replica sets should create under the same subscription. You cannot have replica sets between different subscriptions.
• In the preview, you can have up to four replica sets.
• Replica sets only ensure the availability of the authentication services. But to use the full benefits of it, you need to consider how your Azure VMs, applications will work during a site failure.

In this demo, I am going to demonstrate how to create a replica set of existing Azure Active Directory Domain Services managed domain.

In my current setup, I already have Azure Active Directory Domain Services managed domain configured.

Azure Active Directory Domain Services managed domain properties

This is using REBELVN1 virtual network and aadds-subnet.

Azure Active Directory Domain Services managed domain properties page

REBELVN1 virtual network is set up under REBELRG1 resource group. This resource group is using “East US” Azure region. The Virtual network is using 10.0.0.0/16 address space. It has two subnets.

vmsubnet – 10.0.2.0/24 for virtual machines
aadds-subnet – 10.0.0.0/24 for Azure Active Directory Domain Services managed domain

Azure Active Directory Domain Services managed domain virtual network settings

In this demo, I am going to create a new virtual network in “West US” Azure region. Later this will be used to host the additional replica test. [Read more…] about Step-by-Step Guide: Azure Active Directory Domain Services resiliency with replica sets