adatum | Another IT blog focusing on Azure management and surrounding areas

Recording available: ARM template deployment scripts

23/10/202023/10/2020
by Martin Ehrnst

In our Infrastructure as code live stream series, Marcel Zehner and I covered a new feature in the Azure IAC space. Namely deployment scripts. With deployment scripts for Azure, you can run PowerShell or Bash (CLI) scripts within your ARM templates.

You may have heard of Custom script extension for Azure Windows VMs, this is sort of the same thing. Making you able to call external systems during deployment, or perform the last-mile configuration to your infrastructure.

Deployment scripts recording

You can find all our recordings on youtube and all code examples on github

Azure

Recording available: Complex ARM templates

12/10/202012/10/2020
by Martin Ehrnst

Together with MVP and Regional Director, Marcel Zehner we are running four live streams on Azure Resource Manager deployments using ARM templates. Recording from our first live stream, Complex ARM templates is available now.

In this session, we covered how you should use parameters, functions, and dependencies to create more reusable code, and how to control the result of your user’s input.

You can find the recording on YouTube, and the script examples on GitHub

More ARM template live streams

We have three more ARM template live streams planned- hopefully we will see you there:

Nested & linked ARM templates
Date & Time: October 12, 2020, 5PM CEST
Registration: https://lnkd.in/deW4xXJ
Attendee Link: https://lnkd.in/dz_WgyW

Deployment scripts
Date & Time: October 19, 2020, 5PM CEST
Registration: https://lnkd.in/dhEYeMr

Code release using pipelines
Date & Time: October 26, 2020, 5PM CEST
Registration: https://lnkd.in/d_JuDuv

Community

Microsoft MVP 2020-2021

01/07/202001/07/2020
by Martin Ehrnst

Almost a year has passed since I received my first MVP award in the Azure category. Although it has been a challenging year personally, and with the ongoing pandemic. I am delighted to share that I was renewed as Microsoft MVP for 2020-2021.

As things hopefully normalize I hope to get back on the community saddle, and contribute more in person and virtually.

A big thanks to my family, fantastic colleagues at Intility, and my community friends. Have a great summer!

Automation

Remediate Azure Policy with PowerShell

11/06/202011/06/2020
by Martin Ehrnst

Azure Policy is there to help us with properly governed and secure infrastructure. However, Azure Policy requires management as well.

Lately, I have built a new set of policies to ensure diagnostic logs are forwarded to Azure Monitor Logs. Multiple policies and a policy initiative were deployed to multiple subscriptions and multiple customers. All this was made possible since we manage through Azure Lighthouse.

Automatic remediation of Azure Policy

The challenge faced after deploying the policy was how to remediate them. Since policies with effect ‘deployIfNotExists’ only apply to new or modified resources, I faced the job with clicking in the portal or figure out a way to do this with PowerShell.
I actually started with the portal, as I thought it would be a quick job. After doing one or two subscriptions I realized how much time I would use.

Given the fact that the imitative it self contained around 50 individual policies, and at the time 19 subscriptions. I figured spending some time in PowerShell was well worth it. There is also a pretty good chance I will find my self in the same situation pretty soon.

Create remediation task with PowerShell

To create a remediation task for a policy set you can use this script. It will connect to your subscription and get all non-compliant policies. Then start a policy remediation task for the individual policies.

Summary

Policies with effect “deployIfNotExist” only work for resources that are updated or created after the policy was applied. To remediate existing resources you will have to create the remediation tasks manually through the portal, or by using PowerShell (and REST API)

By the way, fellow Azure MVP Tao Yang has created everything you need in order to enable these policies your self. Please see GitHub for complete ARM templates. And please help him maintain everything by contributing.

Conferences

IT Pro announcements from Microsoft Build

20/05/202003/09/2020
by Martin Ehrnst

Microsoft Build is Microsoft prime developer conference, where Microsoft Ignite is the conference for your traditional IT pros. However, the traditional IT pro role has changed significantly in recent years, and Build is therefore interesting to us, and a lot of great “infrastructure” announcements were released at Build this year. Below I have picked out a few announcements I find most interesting.

Azure Resource Manager templates

ARM language improvements

Azure resource manager templates are very powerful. However, one of its Achilles heels is its verbosity. At build we got a small sneak peek on how Microsoft is looking in to improve ARM template language. Sign up here to get more information.

What-If analysis

I have deployed a lot of templates in recent years. And when I first saw a preview of the new what-if command I was thrilled. The ability to check what impact your template would make is a very important feature that is now available.

PowerShell or CLI inline in the templates

I’m not sure I like this one- the ability to actually write PowerShell or CLI scripts within ARM templates via Deployment Script is now in Public Preview.

ARM templates tend to be very complex already. And while this feature will solve a lot of issues, I am pretty sure we can manage to create a lot of new ones as well. I suggest a very humble approach to this feature.

Azure infrastructure

Azure Peering service generally available. Providing the fastest route from on-premises to your Azure resources. At first this looks like a new name for Express Route, but Azure Peering is not private. Instead it uses the largest ISPs around the world to quickly get you on Microsofts backbone.

Azure Arc enabled kubernetes

Azure Arc provides a range of capabilities for managing servers, Kubernetes, and Azure data services across clouds, datacenters, and edge locations.

Azure Arc was introduced at Microsoft Ignite in 2019. At build, Microsoft announced Arc for kubernetes in preview. With Arc for Kubernetes, we are able to use management tools in Azure like Azure policy and Azure monitor. For clusters running on-premises or in another cloud, public or private. For companies using for example RedHat OpenShift on-premises, and AKS in Azure. You can have a unified experience for both environments.

Azure Security and Azure AD

Azure AD now has a feature called ‘external identities’ in public preview. I’m not sure about all the news. But it seems to be a revamped Azure AD B2c. I will look more in to it later.

Azure Security Center is updated with a secure score API. To me this is great as integration to internal portals will be much easier. In other news, the ability to suppress alerts is now publicly available!

More Azure AD news can be found here

Build 2020 book of news

I will continue to update this list throughout Build and hopefully test drive some of the new features. In the meantime, you can find the complete list of Build 2020 announcements in the book of news

Recording available: ARM template deployment scripts

Deployment scripts recording

Share this:

Recording available: Complex ARM templates

More ARM template live streams

Share this:

Microsoft MVP 2020-2021

Share this:

Remediate Azure Policy with PowerShell

Automatic remediation of Azure Policy

Create remediation task with PowerShell

Summary

Share this:

IT Pro announcements from Microsoft Build

Azure Resource Manager templates

ARM language improvements

What-If analysis

PowerShell or CLI inline in the templates

Azure infrastructure

Azure Arc enabled kubernetes

Azure Security and Azure AD

Build 2020 book of news

Share this: