Azure Infrastructure Solutions: Full Course & Transcript

[00:08] is important, but using them correctly is even more important. The real question is, is your cloud infrastructure secure, scalable, reliable, or costefficient? Can your application handle more users? Can your

[00:20] data stay protected? Can your system recover quickly if something goes wrong? Welcome to the session on a 305 designing Microsoft Azure infrastructure solutions. In this course, we will understand how businesses design cloud

[00:34] infrastructure using Microsoft Azure. We will start with the basics of Azure infrastructure and understand why companies use cloud platforms to host applications, manage data and scale their services. Next, we will explore

[00:47] important Azure concepts like subscriptions, resource groups, regions, availability, zones and governance. Then we will explore compute services like virtual machines, containers, app services, and Kubernetes. These services

[01:01] help businesses run applications based on their workload needs. Next, we will look at Azure storage and database solutions where businesses store files, backups, application data, and structured information securely. We will

[01:15] also understand networking concepts like virtual networks, subnets, load balances, application gateways, and private connectivity. These help cloud resources communicate safely and keep applications available. Finally, we will

[01:28] explore monitoring, backup, disaster recovery, high availability and performance optimization because cloud architecture is not just about deployment. It is about designing systems that work reliably in the real

[01:42] world. So before we begin our session, just a quick information guys. Simply learn offers a certification program in cloud computing and DevOps in collaboration with triple IT Bangalore. This program helps you master genai

[01:55] This program helps you master genai devops and cloud tools across AWS, Azure and Google cloud through live online classes, integrated labs and real world experience with tools like Docker, Kubernetes, Terraform, Genkins and

[02:09] Kubernetes, Terraform, Genkins and Cibil, AWS, Azure and Google Cloud and even build your portfolio with 30 plus hands-on project and three industry oriented capstone project. Here learners will also receive a program certificate

[02:22] and transcript from triple Bangalore along with official Microsoft learn certificates in relevant Azure modules. The program also includes AI powered job assistance, réumé building, LinkedIn profile optimization, mock interviews

[02:37] and career support. All of this under just one course. So now before we begin, let's have a short quiz question. And the question is, what is the main goal of Azure infrastructure design? And your options are option A to randomly deploy

[02:51] cloud services, option B to design secure, scalable and reliable cloud solutions, option C to avoid cloud networking or the option D to remove security from applications. >> Started with basic services like email

[03:04] >> Started with basic services like email services. So if you say you're not using cloud, do you have email accounts or are you using the email services like Hotmail, Gmail,

[03:17] um back in the days, I don't know how old are you guys? We used to have Yahoo, right? So what are these services? These are nothing but the SAS services. These are the services using which you send your email. Are you saving those email

[03:31] your email. Are you saving those email in your laptop? How do you access Gmail? How do you access Hotmail or how do you access Google Drive, One Drive, Dropbox? So, we are using cloud in our day-to-day

[03:45] life. Even you're not using the cloud for your own infrastructure, but you're using cloud in a sense like uh email services, storage services, right? Movie on demand services. Are you using Netflix? Are you using Prime, Hot Star?

[04:01] So, these are the movie on demand services, right? This is also pay as you go. So depends on different plans you subscribe to. You you'll have to pay. If just cancel that subscription. You won't be paying for that particular month.

[04:15] accessible over internet. So what do you need? You just need an internet connection. Whether to use from laptop or to use from your phone, you just need an internet connection. If you have an internet connection, you can use cloud,

[04:30] right? on demand movies, on demand food, put banda or Swiggy, right? So these are nothing but cloud services, right? So what is cloud computing? In simple terms, cloud computing is

[04:45] simple terms, cloud computing is is a delivery of services uh over internet. Now what services are being delivered? When we specifically discuss cloud computing, it's nothing but delivery of services over the

[04:59] internet. Now which services is being delivered? Services like compute, delivered? Services like compute, storage, databases, network. So if you are accessing those services via the internet,

[05:11] internet, that means you are using cloud. So cloud computing is nothing but delivery of services. Now the first question that most of my student ask is why do we need these services? Compute,

[05:24] these services? Let's say there's no cloud. If there's no cloud and you want to host your website or an application, where do you host it? You want to host a website or a web

[05:38] application, where do you host it? So, if there's no cloud, we need to create a data center. Okay, we need to first have a data center before I or Windows Server, we need to have our data center. Now, what

[05:52] do you think? How much charge or how much cost will I have to bear as a company or as an organization if I want to have my own data center? [snorts] First of all, I have to pay for the infra. I need to find a place and

[06:07] infra. I need to find a place and imagine a uh imagine having a big big space in a city like Mumbai or Bangalore. how much you have to pay right before even starting your business. You'll have to pay for that

[06:21] infra. You need to buy that that place first. You need to buy that that place first. You need to put your racks, your servers there. Then you need to think about the the power power supply. You need to

[06:34] think about the redundant power supply since I don't want to rely on single since I don't want to rely on single power supply. Right? So this is the is power supply. Right? So this is the is the uh cost that you have to bear if you

[06:47] do not go for cloud but as har is mentioned that we har is mention mentioning that we can go for colo yes you can go for collocation as well but for that as well someone has to has a data center you can go for colo but

[07:01] someone has to has a data center right someone should build a data center for you okay yeah so that colo is like you're just renting spaces. So you're just renting the data uh you're just renting

[07:14] one or two uh servers or you're just renting entire rack in that particular data center and you're putting your own servers there. So that's that is the meaning of collocation. Right? So that was also possible before

[07:26] cloud but after that not everyone can afford of creating a or or developing or uh building a data center. So what happens the big companies like Amazon,

[07:39] Google and Microsoft and there are a lot of others or all right so these big companies what they did they created data centers and they started providing the

[07:54] computation services like compute storage database networking on rent. All right. So today when someone says that we need to

[08:06] move to cloud or we need to migrate to cloud or we want to use cloud computing to use the AWS infra GCP infra Google infra or Microsoft Azios infra or Oracle's infra depending on uh which part of world you are we need to use

[08:21] resources all right so what is why do we need this computation resources compute resources like for example let's Say you have an like for example let's Say you have an idea and you need to use information

[08:35] technology to bring that idea to life. That means you have a business. A simple example I can take is let's say Swiggy. So what is the idea behind this business? Deliver deliver food delivery service.

[08:48] So when you use Swiggy, are you making the food? Obviously no. Someone else is from their place, right? So what is this? This is like a food as a service. So it's again a uh cloud service right?

[09:02] kitchen from where you're ordering. So let's say you have an idea and you want to build something like this or whatever your idea is and you want to use uh your idea is and you want to use uh internet to deliver services.

[09:15] internet to deliver services. So in order to use internet in order to develop or in order to bring my idea to life first of all what I need I need to hire a developer. Why do we need a developer? Developer

[09:29] will write the application for you. So what is an application? Application is nothing but some files. So if you have ever developed a very simple HTML uh uh page or HTML website, static website, if

[09:44] application is nothing but list of files. There there will be lot of files. If you're writing application inn net or Java or whatever you're just coding. If better, right? You're just coding. So that code is saved in nothing but a file

[10:00] with some extension, right? So in order to make sure that my right? So in order to make sure that my website is is is reachable to to my customers or to my users who wants to deliver food or anything, whatever your

[10:16] idea is, I need need to keep this file somewhere and that somewhere is nothing somewhere and that somewhere is nothing but a server.

[10:29] you place that server? You need to place that server in a data center. So as as Har mentioned, you can collo col co uh you can get a collocation place in one of the data center. You'll be paying some rent or you can simply

[10:44] launch the server on a cloud company. Now tell me what what what do you think what will be the cost of buying a server from IBM or from HP? What will be the cost of buying one server? Around $1,000, right? Around one lakh or

[11:01] which company you go for and what configuration you want. Right? If you have never heard of server, what server is? Server is nothing but a computer. So if you go today to buy a new laptop, what do you

[11:17] today to buy a new laptop, what do you what do you see or uh which laptop you buy? So what do you see in that laptop? You'll see the config, right? You'll see the storage, what is the SSD given,

[11:30] you'll see the processor, what processor is being used or being uh installed in this laptop, right? You'll see memory, the RAM. So these are the three most important thing that we see. Similarly, server is like you can say a powerful

[11:45] computer which provides services. So you know the laptop is like for commercial use. That means for us just to uh do a meeting or do or or for entertainment

[11:58] purposes like I want to watch a movie, I can watch it on a on my laptop. I can do some of my business business things. But you cannot host your website on laptop. Technically you can but your laptop is not as powerful as server to provide the

[12:12] services. Okay. So similarly similar to laptop you'll have a server and then on top of that server you'll be having some operating system. In laptop you have an operating system right? You have Windows right? So

[12:26] system right? You have Windows right? So you you you go for Windows 11 nowadays or if you're uh fond of Mac you'll go for Mac. So Mac has their own Macintosh. Apple has their own Macintosh operating system like or there's another uh

[12:43] so on top of that server you'll be having an operating system what is an operating system operating system is the mediator between human system is the mediator between human beings and the uh hardware if I give you

[12:57] a hard disk can you just see that hard disk and try to figure out what do we have in that hard disk just like physically seeing that hard disk like Can you do that? [snorts] So right we need to connect that hard

[13:10] disk to the laptop. How does the the laptop reads hard disk? Laptop has the operating system installed and that operating system can detect and read the hard disk and then we can identify what kind of files we

[13:23] have in that hard disk. Right? So similarly here we deploy OS on top of our server and then we keep our files.

[13:39] like Swiggy and I also want to come up with a food delivery service, first of all I need to hire a developer or if you are a developer you can write your own code. But in order to host that application you need to have the server.

[13:55] So using that server only you can host right now. In order to buy that server you have to spend certain amount. let's say $1,000 and that amount is upfront cost that is an upfront cost. When you say

[14:09] now even before starting my business I have to invest like $1,000 for one server. Now tell me you're buying one server and Now tell me you're buying one server and if that server goes down what happens

[14:22] hosting your application on top of that server. If that server goes down, will will your user will be able to reach the application? Obviously, no. Right? If deliver, you won't be able to order anything from CD Swiggy.

[14:39] So, I cannot rely on one server. So, I need to buy another server as server? Just to make sure that if one server goes down, my application is server goes down, my application is reachable from the second server.

[14:52] So instead of $1,000, I need to spend $2,000 for two servers. So that's an upfront cost. And this upfront cost is nothing but capital expenditure for your nothing but capital expenditure for your business capex. Okay.

[15:08] Now for for an individual user who or for an startup for a startup investing this amount could be huge. So what they can do they can simply launch portal.azio.com

[15:24] portal.azio.com cloud create a server deploy their and that's all their their website is live. What is cloud computing? If you have a laptop and if you have an internet

[15:37] laptop and if you have an internet connection you can get the server the connection you can get the server the storage the networking through that all. So that's cloud computing. Cloud computing refers to the delivery of

[15:50] inter delivery of compute services over the internet. services are nothing but you want in order to host a website you would need uh storage, you would need RAM, you

[16:03] would need CPU. So all these services are given to you over the internet. You don't spend spend this much of amount up front. So you're saving already you're saving $2,000. Right? Now here you deploy two servers,

[16:17] five servers, doesn't matter. On cloud you deploy two servers, five servers, 10 server. You're not paying $2,000 upfront. That means right now I'm not paying $2,000. So when I'll be paying, I'll be paying as per my use. Pay as you

[16:32] go. So this month if I'm using five servers, I'll have to pay for the five servers. Next month if I don't require five servers, I'll remove two servers and I'll pay for three servers only. Pay as you go model.

[16:45] What is pay as you go? It's like your electricity, right? So, every month do you get the similar bill for your electricity? Depends on your usage, right? In summer, we use air condition, uh, coolers and

[17:01] all those stuff. So, we pay more in summer, but in winter, do we pay more? Totally depends on your consumption, right? So, that's nothing but the pay as you go approach. Pay as you go. As much as you use, you pay for that. If you use

[17:18] 10 servers, 20 servers, for that much, you'll pay more. If you use only one server, you'll pay for only one server. Okay. I hope you have understood what cloud computing is and why do why you will be

[17:32] using cloud computing. Okay. All right. [clears throat] What are the benefits of using cloud computing? Cost optimization. As I mentioned that uh if you want to use two servers, three servers, you use that. So

[17:47] requirement. You'll be using two servers, three servers, right? So it helps you to achieve the cloud uh uh achieve the cost optimization, right? Optimize the cost. I'm not paying upfront everything. I'll be paying

[18:01] according to my use. performance efficiency very quickly you can uh get the performance increase the performance of your app right I want two

[18:13] servers I want more CPU I can I can do that I want more RAMs I can change my change u the amount of RAM assigned to my compute service right so all those thing you can do very quickly apart from that accessibility

[18:29] if there was there's no cloud and you want to come up with your with your IT want to come up with your with your IT business or business using it. Where you'll be creating or deploying your server, you will be creating or

[18:41] deploying your server depends on wherever you you are. You let's say I stay in Mumbai and I want to I have an idea and I want to come up with a service. So I'll be searching a place in Mumbai itself

[18:55] and if my user base in is is in US I need to go to US and there I have to deploy my server in one of the data center right so with cloud it has become center right so with cloud it has become very easy I can deploy wherever I want

[19:10] depending on uh let's say I want to deploy a server so in cloud it's it's I'll click on create create virtual machine and Here you see if you want to

[19:22] deploy it in US, you can select US, East, US, West. If you want to deploy it in Australia, you can select Australia. you need? You just need an internet connection and you can deploy wherever

[19:36] you want. Wherever Azure has his presence, right? I want to deploy in Europe. I can go for Europe. I want to deploy in uh UK, I can go for UK. Right? So these are the different uh these are the benefits of using cloud computing.

[19:51] These benefits you cannot get when you are deploying everything on prem. Okay. are deploying everything on prem. Okay. Reliability So cloud is reliable. Why it's reliable? Because they by default monitor it.

[20:08] Okay. Uh by default monitoring as in it's not like that they will take actions on your behalf. only if you configure they can take actions on your behalf but if you don't configure uh they'll not they'll not take that action

[20:23] they'll not they'll not take that action right so cloud is reliable flexible you can deploy where similar to accessibility you can deploy wherever you want whatever size of uh server you want you want more CPU more RAM depends

[20:37] totally on your requirement and security whatever data you you are keeping on cloud uh by default is it is secured you don't need to worry about security. don't need to worry about security. Why? Because what I'm putting in my uh

[20:53] storage account in my storage Microsoft is automatically encrypting that. What is like uh a security algorithm which is making

[21:06] your data unreadable. Okay. Sorry. >> So sec uh encrypt encrypting is a way is a security algorithm which is making your data whatever data you're putting on cloud unreadable

[21:22] that means when I'm putting a data in in your own laptop where do you add your data where do you put or save your data where do you store your data we have hard disk right solid state drive or hard disk in that

[21:34] solid state drive or hard disk in that hard disk we keep our data so if you remove that hard disk from your laptop and attach it to another laptop. Can you read the hard disk or no? If I remove the hard disk that I have

[21:48] over here, remove it from laptop number one and connect it to laptop number two, will I be able to read my data? Yes. Right? I'll be able to read my data. So, cloud, what cloud is doing? Cloud is nothing new. Cloud is also using

[22:03] hardress drive or solid state drive to keep your data. So, what happens when you keep your data in cloud? it goes to the cloud data center within that data center they'll be having servers or sand storage and in that storage your data is

[22:16] stored. So if someone goes there who has the physical access to the data center if someone goes to that hard disk take out the hard disk connect it to our laptop where's the security then he or she will

[22:29] be able to read the data right similar to this scenario if someone goes to the cloud take out the hard disk where your data is stored connect that hard drive to its to his own laptop he'll also be be able to read that data right so to

[22:45] avoid this situation what every cloud cloud provider is doing is encrypting your data. What is the meaning of encryption? Whatever you're writing, you're writing ABC, so that is stored in an encryption format.

[22:59] Okay? So, if someone is removing that hard disk and connecting that hard disk to its own laptop, he or she won't be able to read the data unless and until able to read the data unless and until that data is decrypt.

[23:15] decryption we require the encryption and decryption keys. So Microsoft stores keys. The uh you have the option to use your own keys as well. Right? So this is one of the benefit that we have in the cloud. Even if the data is even if the

[23:30] device where your data is stored is stolen, the data is secure. No one will be able to read it unless and until they decrypt it. Okay. encrypted. Doesn't matter what cloud provider you're using.

[23:47] Okay. Now what is Microsoft Azio? Microsoft Azio as you know is the leading cloud provider from Microsoft. So Microsoft is the owner and Microsoft So Microsoft is the owner and Microsoft has created lot of data centers and

[24:00] those services are given to you as uh as a service. Whenever we talk about cloud you will be hearing something a term known as as a service.

[24:12] So Microsoft Azure is a cloud provider. It's a leading cloud provider which offers 200 products and cloud services to you to the users so that they can to you to the users so that they can bring their own idea to life. Okay.

[24:38] All right. Sorry guys, I'm not feeling well. So you you might uh see me going uh mute a lot of time. Okay. So just bear with me. Maybe tomorrow I I'll I'll feel better. All right. So what is Microsoft Azure?

[24:51] provider available in the market which offers around 200 products. So this is offers around 200 products. So this is the second I mean if you go 5 years back Microsoft Azio was the second leading cloud provider. But now if you see we

[25:06] cloud provider. But now if you see we have like 55 45 uh ratio in the market. The competitor to Microsoft Azure is AWS. Depends on which area or which part of world you are. You would see that AWS is

[25:22] used more or Microsoft Azure is used more depend on which part of land. I I stay in Malaysia. So in Malaysia I see a lot of opportunities for Microsoft Azure. Whereas if you stay in Bangalore side in India in Bangalore side you

[25:35] would see AWS requirement more. So totally depends on which part of area you are. If if you're staying in Middle East Saudi or Dubai you would see Oracle East Saudi or Dubai you would see Oracle being used for okay

[25:49] so totally depends on which part of area you are but it doesn't matter that uh which cloud you are learning. If you learn one cloud, you'll automatically understand the second cloud because services are are are same. The only

[26:03] few different services. AWS might be having few different services. The names for those services are changed. Like in Microsoft Azure we say virtual machine whereas in AWS they say uh elastic cloud compute

[26:19] in Google they say compute engine. So totally depends uh which cloud you're using. Services are same the names are different. Okay.

[26:39] whatever benefits we have we have discussed for cloud computing same benefits applies here as you can see security cost effective scalability data recovery flexibility. So all the benefits you'll get on every cloud

[26:54] you're using Microsoft Azure same benefits you have security cost effective data recovery scalability flexibility but then the question arise if all clouds have the same benefits

[27:09] uh why should I use Azure over AWS or why should I use AWS over Azure or why should I use GCP why should I learn Azure or why should I why should I learn Azure or why should I learn uh AWS Yes. So that question only

[27:23] I have only one answer to that question that if you are already familiar with Microsoft product or let's say as a company if I'm already using Microsoft products which most company are if I'm

[27:38] already using Microsoft product I can crack a good deal with Microsoft if I want to use Azure. If you're using Microsoft products, it's possible that your company is already Microsoft partner. So they can crack a

[27:54] good deal and they can get get a good discount uh with Microsoft uh they if if they want to use Azure, right? right? AWS benefits you like uh if you are

[28:09] already I mean Microsoft Azure started late as compared to AWS. AWS was the first cloud in the market. So that's why AWS has had lot of shares. If you go 5 years back. So if you are already with Amazon and if

[28:24] your sales team can crack a good deal with AWS, your company might be using AWS. If your Microsoft partner in your company can crack a good deal with Microsoft Azure, they will be using Microsoft Azure. Another way is if let's

[28:38] say your company is getting a new project and in that project they will be hiring few people so they will be hiring people and those people are familiar familiar with Azure so for that particular project your company will go

[28:53] with Azure if your company is launching another project and they're hiring people and they see that yeah we have lot of professionals who who understand AWS so for that project they'll go for AWS I've seen this in lot of companies.

[29:08] For my own company, we have few services on Azure, we have few services on AWS. When I raised this question to my manager, why do we why do I why are we using two different services? So, they said that whatever developer we have in

[29:21] this project, they are familiar with Azure, they're familiar with.net. So, they are familiar or more aligned to white m towards Microsoft project. So that totally depends on your comp on a company by company scenario which cloud

[29:34] company by company scenario which cloud you'll see more. Okay. But AWS and Azure you'll see more. Okay. But AWS and Azure are the top contender. GCP is also coming up. All right. So these are three these three are the top contenders in

[29:46] the market. So if you're choosing Azure uh you'll definitely land a job and you'll get a good good pay as well. Okay. So the two things that we didn't discuss in the benefit is scalability and data

[29:59] recovery. So what is scalability? Scalability is a way to add or remove the instances from your solution. So let's say I have from your solution. So let's say I have a website.

[30:18] >> How do I decide how many servers I should be uh launching on Azure and on how many servers I should be launching my website or installing my website? How

[30:33] do I decide that? I can't decide when when the website is new. You cannot when the website is new. You cannot predict the amount of traffic your product is going to receive. Can you predict that? Obviously no. So what

[30:46] you'll do you'll start with less number of servers. Let's say I'll start with two two servers and suddenly my marketing team has done and suddenly my marketing team has done a quite fantastic job and promoted my

[30:59] a quite fantastic job and promoted my website on on so on some popular show. So as soon as my as my website was promoted I saw the spike in the traffic.

[31:11] So in that case if the traffic is more can you can you u can your two servers handle all all all the all that traffic obviously no depends on what what

[31:25] configuration you have right so as soon as the traffic as the traffic increases I need to add extra servers so increases I need to add extra servers so that adding or removing of extra servers

[31:38] is known as scalability Either adding the services or removing the adding the services or removing the services is known as scalability. All right. So there are two types of scalability horizontal and vertical. So

[31:55] scalability horizontal and vertical. So you can increase the configuration that means you can scale up. Right now let's say you have 2 GB of RAM Right now let's say you have 2 GB of RAM and uh four virtual CPUs. So you want to

[32:09] increase the config that means I want now 16 GB of RAM and eight virtual CPUs. So this kind of scaling is known as scale up or scale down from 16 to 4 GB

[32:21] and two virtual CPUs. Right? So you are either increasing or decreasing. So that is known as scale up. If you're increasing that is known as scale up. If you're decreasing that is known as scale

[32:34] Similarly, if you're adding the number of instances, that means you're adding extra servers. So, you're scaling out, you're decreasing the number of servers, you're scaling in.

[32:49] Okay? When someone says scale up, that means you're increasing the size, the means you're increasing the size, the configuration, amount of RAM. configuration, amount of RAM. If someone says scale in sorry scale

[33:02] down then you are decreasing the amount you're decreasing the configuration. When someone says scale out you are adding number of instances. Someone says scale in that means you're removing the extra instances. Okay? Doesn't matter if

[33:18] just need to remember scalability. Scalability means adding extra instances or increasing the configuration or decreasing the configuration. That's decreasing the configuration. That's all. Okay. Data recovery.

[33:31] all. Okay. Data recovery. Uh by default there's no data recovery. You need to configure it. But when it comes to cloud, it's very easy to configure the data recovery. So as we progress in our Azure journey, we will

[33:45] have one chapter where you'll understand how you can recover your data in case uh there's a failure or in there in case there's a loss of data, how can you recover it? Okay. So data recovery is very simple when it comes to cloud.

[33:59] [snorts] Cost effective and security we have already discussed right. Salman is asking difference between scalability and flexibility. You are flexible to deploy in any region. So any cloud gives you option to deploy

[34:16] your ser services in different regions like I can deploy in India, I can deploy in US, I can deploy in Australia. So depends on my requirement I can deploy it anywhere wherever Azure has its presence. So that is flexibility. You're

[34:30] flexible enough to deploy in any region plus you are flexible enough to deploy plus you are flexible enough to deploy in any size of of the server any configuration which is provided right. Scalability is

[34:45] removing the extra instances. Now a very good example of scalability Now a very good example of scalability is

[34:57] for uh the Amazon e-commerce website for uh shopping? uh shopping? So every year Amazon comes up with a sale right. What? What that sale is known as great Indian

[35:13] What that sale is known as great Indian something? We have the sale, right? Great Indian festival or something, right? So during

[35:27] that sale, what do you think? the traffic will be more towards Amazon or traffic will be more towards Amazon or the traffic will be less.

[35:40] platform, do you think the internet traffic will be high or will be low? During the sale period, it will be high, right? So, when the sale when when sale is announced, you know that for 4 days, we need extra

[35:56] servers. Since that four days we have sales. So we might have lot of traffic. So we know we can predict. So if we have lot of traffic we can add the extra instances instances and then when sale is done after 4 days

[36:12] obviously the traffic will reduce to it normal. We'll have normal traffic. So we normal. We'll have normal traffic. So we can reduce the number of servers. I don't know uh how old are you but the first sale that Flipkart announced big

[36:25] billion something the first sale was a flop why because Flipkart didn't scale its servers and it was it it failed for the first day so they had to increase or add one more day there so they will be

[36:41] adding the scaling uh they they have to add the servers when when they are add the servers when when they are receiving lot of traffic Okay,

[36:59] screen. Okay. So, these are the Microsoft Azure benefits to the business when they are opting out for the Microsoft Azure. Sisha is asking horizontal vertical scaling bins. I just explained scale up

[37:15] >> So when you're scaling like this, what is this horizontal or vertical? This is horizontal, right? Or sorry, this is vertical, right? So you're adding or you're increasing the configuration of your your server. So earlier you are

[37:30] using let's say 2GB now you're using 4GB. That means you you now you're using 4GB. That means you you have added 2 GB RAM extra. So that is known as vertical scaling. Whereas horizontal scaling is you're adding

[37:44] extra instances. [snorts] You had one instance, you added two instance. So now you have total three instance. So now you have total three instance. This is known as uh horizontal scaling.

[37:56] This is known as uh horizontal scaling. Clear?

[38:24] So, what skills are we going to cover in A305? Now, AZ305 has a study guide. So, A305? Now, AZ305 has a study guide. So, let me just launch

[38:50] exam, I would ask you or I would encourage you to please uh go to this website. Okay, this is the official page from Microsoft.

[39:08] So whenever you are sitting before sitting for the exam just go to this. sitting for the exam just go to this. Okay, [snorts] just go to this page. So what this page is having this page if you go to this

[39:21] page you will see [snorts] the learn path. learning path is the modules, the flow or the topics that Microsoft

[39:37] expects you to know before sitting for the exam. So what skills are we going to cover? Now I'm not covering the skills from from the PPT. What skills I'm going to cover? I will be following this Microsoft learn path since this is up to

[39:52] Microsoft learn path since this is up to date as per the current exam. Okay. So what are we going to cover? We are going to cover all these uh topics whatever is mentioned like if I go for the first module which

[40:05] is design identity governance and monitor solution. If I click on it uh everything is mentioned here topic by topic what you should be knowing before sitting for the exam. Okay. Now if I go one page back and if

[40:24] you see here somewhere you should see the study guide. So what is the study the study guide. So what is the study guide? The study guide is uh is again a guide? The study guide is uh is again a web page where Microsoft has defined

[40:37] web page where Microsoft has defined uh what skills will be measured. Compute network storage monitoring security. If I scroll down, every skills is given certain percentage like every module is given a certain percentage. So

[40:52] from identity governance and monitoring solutions you can expect around 30% of questions from storage you can expect around 20 25 from business continuity you can expect expect around 15 to 20 right similarly

[41:07] from infrastructure solution you can expect around 35%. So what you should be knowing you should be knowing some logging solution like routing logs where you can keep the logs where you what monitoring solutions Azure has to offer

[41:21] what is an authentication solution right so all this topic by topic is is is provided in this study guide. Now same thing is for any certificate that Microsoft has to offer. So if you see every certificate is mentioned over

[41:35] here. So whatever certificate you are preparing for before sitting for an exam preparing for before sitting for an exam make sure you uh glance here to see if you know this if you know this if you know this right if you do not know this

[41:47] know this right if you do not know this please try to see what this topic is where [clears throat] you can see you can see it in the learn path right can see it in the learn path right all right

[42:03] Everything whatever mention is here we we are going to cover. Now why I I ask you to visit here because if you see Microsoft keeps on adding or removing

[42:15] something from their exam every 6 month or 1 year right so if you read this this note if you read this note says the exam will be updated on

[42:29] note says the exam will be updated on April 17 2026. When was the April 17th? April 17 2026. When was the April 17th? Yesterday. though something is changed.

[42:41] is changed, you should review this study guide. Okay? So if let's say next time, next year or after 6 month, if they don't want this particular topic uh in a 305,

[42:54] study guide. So you don't need to need that uh need to know that. So whatever Microsoft is making changes they will put that in the study guide. put that in the study guide. Okay. So I went through the old study

[43:09] guide and the new study guide but I don't see lot of things have been The only thing that Microsoft changed was audience profile. Okay. So it's a minor change from the syllabus wise. Nothing changed. Only

[43:25] audience profile change. So if you see the audience profile here, you should the audience profile here, you should have all the audience profile somewhere.

[43:40] here. So this part is only changed. Now what Microsoft added as as far as I know Microsoft only added this. This wasn't part of the old study guide. Okay. But that's that thing which is added. Course wise nothing is changed. the topic wise

[43:55] I have went through the old and new study guide nothing is changed everything is same from the course point of view okay uh there the link is shared if you see the chat box okay I already shared the

[44:10] the chat box okay I already shared the link

[44:22] now if you see the simply learn syllabus we have like uh we have divided this into 15 different topics but I'm not going to cover it topic by topic as everything I'll be covering or summarizing in 10 or 11 topics okay

[44:39] whatever is mentioned over here everything is summarized in 11 topics since we have 10 days so I' I've summarized everything whatever we have summarized everything whatever we have here from identity until uh infra

[44:53] everything I have summarized ized into 11 topics. Okay, since we have to do the the the uh projects as well. So, and we need to complete everything in 10 days. Whatever Microsoft is asking me to

[45:09] cover, we will be covering everything which is defined in the study guide. which is defined in the study guide. Clear?

[45:22] brings to you? the course uh is bringing you the u some projects, some co-ign projects, some assisted practices. So what these assisted practices are? Assisted practices is is the word documents that

[45:36] I'll be adding to the LMS. So you will be having access to that. You can download it. It's like a stepbystep guide on how to do the demonstration on how to do the hands-on. So those assisted practice I'll be adding. We

[45:50] will be having case studies. We will be having course and projects, ebooks. Microsoft has stopped providing ebooks. So your ebook is the learn path.

[46:02] So this is your ebook. Okay. The first link that I shared, please follow that link that I shared, please follow that link uh or simply search for easy 305 in your search engine and you'll be landed to that page. Okay. So here you can find

[46:15] your learn path. Now why I'm stressing on this learn path? Because in exam you have access to the learn path. So when you sit for the exam uh you can access the learn path learn path from there. So if you are stuck or if you don't know

[46:30] the learn path and you can try to read it there within the exam itself can try to find out the answer. So access is there. That's why I want you to go through the learn path. So you know in which page what service can get

[46:46] know in which page what service can get me the answer. All right. getting with this course. Now when it comes to the exam a305

[47:05] The name is design Microsoft as your infrastructure solution. You will be having around 60 to 70 multiple choice question. Totally depends on your set of paper that you're getting. So when I set for the exam I had like

[47:19] So when I set for the exam I had like for 53 questions multiplechoice question and rest of the questions were under case studies. Okay. The total 60 to 70 questions you'll be having including case studies.

[47:33] Then the uh the time that you'll be getting is 2 hours. So you'll be getting 120 minutes to complete the exam. And then in order to pass the exam uh you'll have to get 700 that means 70% of passing mark

[47:51] out of 100 you'll have to have you'll have to get 700 and uh have to get 700 and uh there and once you click on submit there only you'll come to know the result you don't have to wait for the result okay

[48:05] everything is proctored everything is computer basis so once you submit uh it will calculate the software will calculate your percentage and you'll

[48:17] have your result there. So in order to pass you need to have 700 you need to get 700 clear. The exam is available in different different languages English, Japanese, Chinese. So whichever language you

[48:29] Chinese. So whichever language you prefer you can uh book exam in that language. Now where to book the exam from? So if you go to the 305 page from there itself you have the option to book the

[48:43] itself you have the option to book the exam. Okay. So if you are in India you select your region wherever you are. Then click on uh then click on schedule exam and from there it will take you to the Pearson VOE page and from there you

[49:00] can schedule you can select the date when you want to sit for the exam. All those stuff you can do in a Pearson VE site. All right. From Microsoft page itself, you can book

[49:14] the exam. So that's all about the introduction about cloud computing, about simply learn and about easy 305. Any questions on the basics yet?

[49:30] platform as a service, and software as a service? Now this is uh important to understand. Uh it's a it's a basic cloud computing service model. Okay. Um

[49:45] when you are dealing with different compute services you'll have to understand the different between is PA and SAS. All right. So what is before going on break let me answer this quickly uh

[50:02] and then uh if I'm not able to complete this in in in the next 7 minutes we'll continue this since this is important to understand is pass and SAS now how do I understand is pass and SAS now how do I see this is pass and SAS from for me

[50:19] see this is pass and SAS from for me or for you to understand is p and s from or for you to understand is p and s from a305 point of view okay I'm not going at the a900 level since this is something which we cover in a 900 uh and a 104 as

[50:35] well. I'm not going into that level. So I'm I'm explaining it to you from a 305 point of view. Okay. The full form is quite simple. Infrastructure as a service, platform as a service and software as a service. All right. Now

[50:51] what is infrastructure as a service? So in infrastructure as a service your responsibility is more your as in you are the customer of Azure or any cloud provider. So your responsibility here is more

[51:05] in paz your responsibility is less as compared to infrastructure as a service. uh we are not saying that there's no responsibility there is responsibility responsibility there is responsibility okay so how does this is pas and as are

[51:19] are defined is defined in a shared responsibility model people people think that since we are using cloud everything is cloud provider's responsibility that's not correct

[51:33] we are sharing responsibility with the cloud provider okay so what is our responsibility what is cloud provider's responsibility that will be defined depending on the model depending on the service model you are selecting

[51:48] infrastructure service p platform as service software as service now just to explain this in a simple term I just gave you an example of of suiki let's say you have an you have a similar idea and you want to use uh internet for

[52:03] need to come up with an application first what is an application in simple term application is nothing collection of files where your developer or if you are a developer you will be developing the application. So how do

[52:18] you write how do you code an app code an application? You simply open a file if whatever you are using. You simply start writing your code and that code is written in a in a file. So you'll be having multiple files or you single file

[52:33] depending on how big your application is. Now in order to store this or save these files I need a server. Okay. So when I'm when I'm selecting cloud within the cloud I have two

[52:47] options to select from infrastructure as a service or platform as a service. In infrastructure as a service the hardware server server is cloud provider's responsibility.

[53:01] Okay. Uh if you remember the data center model where you have to spend $1,000 or whatever the server cost is, you have to spend that up front. We are not using on-prem model right. So we are not going to spend this upfront. So what we are

[53:16] doing we are using cloud. See even in cloud there is a hardware server. Someone has bought the hardware server. Who has bought? In our case it will be So if I'm using infrastructure as service this hardware server is cloud

[53:31] provider's responsibility. Now within that Now within that hardware server the cloud provider will be deploying their own operating system. So in case

[53:45] of Microsoft Azure they they are deploying HyperV. HyperV is nothing but an operating system. It's a hypervisor which allows them to create multiple uh machines on or multiple virtual machines on top of this hardware server. Okay. So

[54:00] this hyperV is also their responsibility. >> All right. Now on top of this HyperV, I will be creating my virtual server. This is a physical server which is cloud provider's responsibility. The operating

[54:15] system which is again cloud provider's responsibility. On top of this HyperV, I will be creating my server, my virtual server, let's call it virtual machine server, let's call it virtual machine 01.

[54:29] responsibility. Now within this virtual machine 01 I will be deciding whether to go for Windows operating system or Linux operating system that's I'll have to decide as as a customer I have to decide this okay so here what uh what Microsoft

[54:47] what we will do we will select let's say we select Windows operating system and on top of that Windows operating system you have to use the runtime or

[54:59] the framework work. So when you are writing an application your developer will write that application ill in certain code in some code right he might be using Java he might be using python might be using net whatever he's using

[55:15] you're a developer you should know that that there is framework I need to I need to use that language so in order to host the application I need to have this runtime installed on the server where I want to host my application where I want

[55:30] to add my files. So on top of Windows operating system, you will be deploying the .NET framework. Okay. And on top of that net framework, you will then host your application. That

[55:45] means you will add your files. So what is my responsibility as a user here? My responsibility is the operating system that I'm choosing, Windows operating system. My responsibility is the framework that I'm choosing.NET my

[55:59] responsibility is to take care of my application. That means I have to either hire a developer or if I'm a developer I'll have to develop the code. I'll have to develop the code. Now tell me every month Microsoft

[56:13] launches the update right? you know the update update patching that you have installed right every month or every week whatever

[56:30] so since this is hosted on cloud the Windows operating system on my virtual machine who will be responsible to patch that

[56:46] So if you're using virtual machine, it's your responsibility. You as a user, Azure will not patch it for you. Okay? Yes, there are way to ask Azure to patch. Uh but Azure by default will not patch you to patch your

[57:00] it. Then if there is a new version available for net, who will be available for net, who will be installing that new version? Again you. So whatever above HyperV is our responsibility.

[57:14] So infrastructure as a service model requires more responsibility uh from from the user. Whereas Paz model is same there will be physical hardware server on top of it there will be any

[57:30] hypervisor like HyperV or ESXi whatever cloud providers is using there will be cloud providers is using there will be virtual machine there will be a framework like net java whatever when I'm using p

[57:44] all this stuff becomes the cloud provider's responsibility what is my provider's responsibility what is my responsibility when when I'm using p the The application code is my responsibility. So if I'm a developer,

[57:57] paz is something that I'll be choosing. Why? Because I'll get more time to focus on the development the virtual machine whether it's Linux or operate or Windows. It's Microsoft responsibility to patch.

[58:11] So your responsibility uh reduces when you use the paz model, the pass service model. Clear

[58:27] entire software is given to you as a service like M365 Microsoft 365 you're using Google Drive so Google Drive is a software as a storage service given to you what are your responsibility when you are using Google Drive

[58:42] what is your responsibility when you're using Google Drive just adding data and sharing that data with whoever you want that's all that's your responsibility. So you're using that software entirely. Do you know where Google is hosting,

[58:56] where Google is saving, whether it's saving in India, Australia, US, wherever? How Google is storing that? Is is that something we need to bother is that something we need to bother about as a user? Obviously not.

[59:08] So software as a service, what is your responsibility? Reduced entirely zero. Yeah, you have limitation like if you're using free version, you can store up to subscribe for a plan. That's all. Software as a service. Netflix software

[59:23] as a service. Are we paying for each movie separately? No. We are buying a plan. Do we need to keep a CD of all the movies? No. We just subscribe to a plan. We watch our our content, right? Software as a

[59:40] service. What is the infrastructure as a and a platform part of Netflix? Do you know CDVD? for CD DVD what what what what was required we need the CD player or the DVD player right so we need to buy it so

[59:56] I am responsible for the hardware I am responsible for bringing the CD or DVD I'm responsible for placing that CD DVD within the DVD driver uh DVD reader and then I can enjoy my movie if I don't have a CD of one particular movie I

[1:00:11] won't be able to enjoy that because I don't have the CD infrastructure as a service part in case of movies and all. What could be the platform as a service part? Uh I cannot think of any here. Okay.

[1:00:26] you go for infrastructure and service model. Who will do the service of CDVD? Obviously I have to do as a as a as as a owner of that. Right. In Netflix, however they are hosting it, I don't care. I just pay them. I enjoy their

[1:00:42] service. That's all. Clear? Any questions on this? We will revisit this when we are on the compute section. Okay. So let's move on to our first topic which is

[1:00:57] uh authentication and authorization. So from the study guide we will we are from the study guide we will we are covering uh this topic this module design identity and governance and monitoring solutions and

[1:01:10] there we are covering authentication and authorization. This is the uh these are the topics that we are going to cover. Okay. Okay. And from the learn path

[1:01:29] covering this one design identity governance and monitor solution. So governance. Monitoring we'll cover once we have done uh covering all the we have done uh covering all the services. So at the end of the uh I mean

[1:01:44] monitor solutions. Right now we are starting with identity and governance. Okay. [snorts] Now before I start I need an answer from you. How many of you have worked with uh adds active directory domain services

[1:01:59] or if you're from the Linux bike background uh how many of you know what LDAP server is? What are these two services? And those who uh who are freshers please uh wait I'll explain what I'm uh what

[1:02:17] this topic is about. Okay. Okay. So what is adds those who have worked with is adds those who have worked with active directory what is this?

[1:02:32] So what are these services? Adds an LDAP. Okay, never mind. Those who don't know, please pay attention. Okay,

[1:02:46] those who haven't worked with any of these services, you might have uh these services, you might have uh account right in OTD platforms like Netflix or Amazon Prime. Do you hold the account?

[1:03:04] Amazon Prime. Do you hold the account? How many of you have account in Netflix?

[1:03:16] order to access or watch any any web series or a movie, what do you do? First you go to dubdubdubnet.com, right? If you're using uh laptop, you go to this website. What happens first thing? What it ask? Does it allow

[1:03:32] directly to watch the movie or there is something to watch the movie or there is something which we need to do? Login, right? So we need to provide our credentials. login we need to provide our username

[1:03:44] and password. So what happens when we provide username So what happens when we provide username and password? Netflix service checks whether you are providing correct

[1:03:56] username and password. If you're providing correct username and password, you are allowed. If you provide wrong username and password, it may deny deny you the entry and you won't be able to access those

[1:04:09] and you won't be able to access those services. Right? So this process of providing username and password and identifying that username and password is known as authentication. That means

[1:04:24] That means I am not I am Netflix is authenticating me checking me whether the credential that checking me whether the credential that I have provided is correct or not.

[1:04:37] Okay. So what is authentication? Authentication is a way to to check someone with a certain credential. Apart from credential, how you can check someone? You can check them with with their card,

[1:04:51] smart card. If let's say you work, you go to your office. When you go to your office, there is a door. In that door, you have to there's a reader where you have to place your your smart card. Those who are working might know

[1:05:08] card. Without smart card, there's no entry. You cannot go in. Right? Unless your company has no security. Most of the company do have security and

[1:05:20] they do provide the smart card to their uh employees. And in order to enter the building, you need to place that smart card. So when you place that smart card, the identity service that is deployed within that building checks whether your

[1:05:34] smart card is valid or not. If it's valid, you can go in. If it's not valid, you cannot go in. Okay. So, what runs behind uh behind that authentication is

[1:05:47] behind uh behind that authentication is this kind of services adds or LDAP. They runs behind the services and they checks whether your username or password is correct or not. You use your laptop, [snorts] you use your company laptop or

[1:06:01] your personal laptop, you need to provide your username and password correct or not. we need to provide. Nowadays Microsoft has made this made it compulsory to enter your Hotmail account right your email address.

[1:06:16] and password then only you can enter your laptop and do whatever changes you want. So this part of verifying the user the application or whatever you have whoever needs access

[1:06:34] is known as authentication. Authentication is a is a is a process of verifying a person person is nothing but a user or application to see whether the

[1:06:47] credentials provided are correct or not. Okay. So that authentication is done by the services. Then once you're in once you're inside the building

[1:07:02] which flow you can access which flow you cannot access that path that part is cannot access that path that part is known as authorization.

[1:07:16] when you log into Netflix you have different plans right? you subscribe for different different plans. We have mobile plans, we have standard plan and then we have HD plan right I don't know the current plans but this was the plans

[1:07:30] the current plans but this was the plans we we had right so you have [snorts] uh mobile plan where when you log into Netflix you can only watch Netflix within I mean within your mobile app

[1:07:42] then you have standard plan where you can uh watch in two different screens uh at at the same time and then you have some plan where you can watch in four different screen. So once you log in once Netflix authenticates you once

[1:07:59] you're inside the application that means you have got the access now it totally depends on the plan that you have subscribed to depends on that you're authorized to watch either on mobile or on two screens at a time or on four

[1:08:13] on two screens at a time or on four screens at a time. So that part of entering into something, entering into application [snorts] and then checking application [snorts] and then checking what you are authorized to do,

[1:08:27] right? So like in cloud world, cloud world you are logging into Azure portal. So that login thing is nothing but authentication and then once you are logged into that application, what you can do? Can you create another user? Are

[1:08:41] [snorts] Can you delete the existing users? Are you authorized to do that? So to check what you can do, what can what you cannot do is known as the process of checking what you can do, what you

[1:08:54] cannot do is authorization. Okay. What is authentication? What is authorization? Is that clear? authorization? Is that clear? Now this is basic of any identity

[1:09:08] uh any identity and access management system. All right. [snorts] So, authentication and authorization. If you want to implement in your organization, you need some kind of

[1:09:23] organization, you need some kind of identity and access management system. If I want to implement authentication and authorization in my organization, I and authorization in my organization, I need some kind of AM service. IM stands

[1:09:36] for identity and access management. Okay. So if I want to uh implement that let's say I I'm not using cloud I'm using on-prem network. So in my on-prem

[1:09:49] data center I can either use active directory domain services or if I'm good with Linux I'll be using LDAP services. How do you use these services? You need to have a server first

[1:10:05] hardware server or or a virtual server whatever if you're using on-prem server on top of that hardware server depends on whether you are using virtualization or directly physical server you'll have

[1:10:19] to have Windows OS if you want to use adds or Linux OS if you if you want to use LDAP okay on top of that on top of Windows operating system you'll be deploying the active directory domain services role and there on top of it

[1:10:35] services role and there on top of it you will be promoting this server to domain controller where you'll be creating your domain and once it's promoted and your domain is ready then you can go ahead and create your users

[1:10:48] users groups whatever you want you can add computers and all. All right. So this is al all all all the stuff you need to do when you're doing onrem that need to do when you're doing onrem that means your own data center

[1:11:01] everything you need to do you need to bring a server you need to install the or uh install the operating system then you need to install the adds role on top need to promote it to domain controller once everything is done then only you'll

[1:11:16] once everything is done then only you'll be able to create users and uh groups and uh add computers. Okay. [snorts] Now, if you want to use Azure for IM,

[1:11:33] Azure for IM, Azure has Microsoft Entra ID, which is Azure has Microsoft Entra ID, which is nothing but a cloud-based AM service. nothing but a cloud-based AM service. When we say cloud-based uh AM service,

[1:11:45] we don't need to bother about all this stuff. We don't need our own server. We system. We don't need to install ADDS on top of it and then promote it to domain. top of it and then promote it to domain. Everything will be handled by Microsoft.

[1:11:59] What we can do if you're using Microsoft Enra ID as I mentioned Microsoft Enra ID is a cloudbased AFM tool. You sign up and start using it. You just sign up for Azure service for Azure portal and start creating your users. [snorts] Don't need

[1:12:15] to bother about all this stuff. only if you want to do on-prem from scratch then you you are responsible for everything from scratch if you want to go for cloud we have we can sign up and we have access to

[1:12:29] Microsoft enter ID we can start creating users uh directly okay okay is I am clear

[1:12:41] it was just basic just giving you an overview of IM so what is ZTM ZTM stands for zero trust model. Yeah. Now, zero trust model is not a service. It's not a trust model is not a service. It's not a policy. It's just a framework

[1:12:56] uh based on the principle of never trust always verified. [snorts] Now, if you go back few years like before cloud, if you go back 10 years,

[1:13:08] how do we used to consider the security? If you go back 10 years, if you go 10 years back, uh at that point in time, we had the parimeter network where you used had the parimeter network where you used to keep the firewall, uh IDS, IPS, all

[1:13:23] these devices we used to keep in our parimeter network. Before anyone can get into our network, uh the traffic was verified by these devices. And once the traffic considered as safe, then it can go inside our network. then it can

[1:13:38] access our servers whatever servers we had right so this is how we used to keep our network I'm not saying that we are not using firewall now we still using firewall but back in the days the security related decisions were were

[1:13:53] were kept in the demilitarized zone in the parimeter zone here but now we need to protect our identities Since if everything is

[1:14:09] cloud now uh 90% of the workload is in cloud only the banking the airport the airline those mostly are still using on-prem but 85 to 90% traffic is already

[1:14:23] uh in the cloud. Now if someone logs in and if he is authorized to do something and if let's say the login credentials are compromised then we are gone right.

[1:14:36] So with the changing pattern a new model came in which is known as zero trust model. So what zero trust model does it's just a framework which based on this principle never trust always

[1:14:51] verify. You have to always verify whatever request is coming in. Okay. So what are the key principles we need to implement this zero trust model. And in order to implement this zerorust model, you need to have certain IM

[1:15:06] model, you need to have certain IM service in place in your organization. So zero trust model based on this principles like verify the request principles like verify the request first. So every access request whatever

[1:15:19] request is coming in. So if someone is entering your building, you need to verify that you need to verify uh him or her. How do we verify? We use smart her. How do we verify? We use smart card, we use biometrics, whatever.

[1:15:32] Right? We need to verify that. Then second principle we have is least privilege. What what is least privilege? Now in in an organization or in an office building, we have different different

[1:15:46] areas like we have common areas like cafeterias, like gaming zone, right? And then we have some sensitive areas. So in IT we have data center, right? >> In airport, if you go to airport, we have immigration.

[1:16:03] Then before immigration, we have the check-in area. So check-in area is not sensitive area. Anyone can go there and and and do the check-in. So it's like a and and do the check-in. So it's like a common area. So we need to provide the

[1:16:15] least privilege to the users like common areas everyone can go but sensitive areas everyone can go but sensitive areas only authorized person should go. So when we are using smart card based authentication we will divide the smart

[1:16:29] card into different types like everyone will have in uh whoever has the smart card they will have access to the common areas whereas only authorized people will have access to the sensitive areas like data center building itself

[1:16:44] right [snorts] like knock room what is knock room is network operation center where from where you can monitor your your client's network, your own network.

[1:16:57] So those areas are sensitive. Why? Why? Because knock rooms have access to the servers, remote access to the servers. So I cannot allow everyone to go to the knock room. So we need to uh give the lease

[1:17:11] privilege. That means only people belonging to the knock team, they can enter the knock rooms. Lease privilege, right? Micro segmentation. Micro right? Micro segmentation. Micro segmentation is like dividing the

[1:17:26] uh area or the network into smaller smaller uh VLANs or smaller smaller segments so that we can keep our monitoring uh continuous.

[1:17:41] We need to divide our area into smaller segment. Like here we [snorts] can have certain CCTVs. Here we can have certain CCTVs. Here we can have certain CCTV. So this is my one area. This is another area. This is another area sensitive

[1:17:55] area where I can have multiple CCTVs. Uh this is knock room. So within that room we can have uh three or four different uh CCTVs from different different uh CCTVs from different different angles. Right? So I need to divide my

[1:18:09] angles. Right? So I need to divide my uh let's say network or areas into micro segments. All right. So that I can have a continuous monitoring. So these are few principles that we have

[1:18:24] uh in zero trust model. Now again I'm saying zero trust model is not a saying zero trust model is not a security uh policy or is not a a tool it's just a framework which defines some principles and you need to make sure

[1:18:39] when you're implementing IM or you're designing IM you need to keep these things in mind. All right. Verific verify. Make sure you're providing lease privilege. Uh divide your areas into

[1:18:53] different segments. Have a team who can continuously monitor and always assume breach. What do you mean by assume breach? mean by assume breach? We have to do continuous monitoring

[1:19:07] and we have to assume assume breach and continuous monitoring works hand in hand. Assume breach as in let's say we have applied all the zero trust models. That doesn't means you are secure. Why it doesn't means we are secure? It's

[1:19:19] possible that someone who has the access has lost the credential has uh the credentials he was he or she was having uh was compromised and some

[1:19:32] person who should not be having his or her credential has got the credential and now roaming freely everywhere. Right? So every time we need to assume breach. Now how do we assume breach? What what is the meaning of this assume

[1:19:45] What what is the meaning of this assume assume breach? How many of you uses uh assume breach? How many of you uses uh Gmail? you uses? I'm sure 90% of people are using Gmail, right? So, have you ever

[1:20:00] tried logging into Gmail from a different device, from a from a totally new device? Back in the days, we used to have cyber cafe, but I don't know if we we still have the cyber cafes. But let's say you change your mobile and you log

[1:20:14] in from from from a new mobile. So what happens when you log into your Gmail account from a new mobile, you get a message, right? You tried uh from a different mobile, please uh please uh approve your notification in

[1:20:30] already existing mobile or your YouTube application or or wherever. Right? So we get that kind of message. So what is that? Gmail is assuming that

[1:20:42] it's not you who's trying to login. So that's why Gmail is uh sending you that popup please notify uh please uh approve please approve. So that's that is the please approve. So that's that is the meaning of assume breach. Okay.

[1:20:57] So even though you have applied all the principles of zero trust model, you need to make sure or you need to assume breach so that

[1:21:11] breach so that wrong person or a hacker cannot get into your account. It's possible that my username is compromised since Gmail we have used or we have given our email ID to lot of people. So email ID is already

[1:21:25] compromised. Now what hackers can do they can launch different kind of different kind of attack against the username since username is already uh public right everyone knows my email id obviously not everyone knows but who I

[1:21:39] have shared my email id with banks with e-commerce applications with Netflix with with different different service providers who knows who's selling my data right so if someone is has sold my data my uh uh email id is already in

[1:21:55] click. So hackers can get that get my email id and try to launch different different kind of attack. So that's why we have to assume reach. If you log into your Gmail from a new location from a new device, you would see that popup.

[1:22:09] new device, you would see that popup. All right. So in order to make sure that [snorts] your data is secured, your access is secured, you need to your access is secured, you need to follow the zero trust model framework.

[1:22:22] So what does zero trust model says in short? Never trust always verify right even though when you're logging into logging in from new mobile you're providing correct username you're providing correct password still

[1:22:37] providing correct password still Gmail is popping uh popping up to you to Gmail is popping uh popping up to you to approve that that login right even though you have provided correct username password Gmail is thinking that

[1:22:50] it's might be a breach clear so That's what zero trust model is. Now how to implement zero trust model? You need to have some kind of IM model? You need to have some kind of IM service. So in Azure we have Microsoft

[1:23:03] So what is identity and access management? Identity and access management is just a service which helps you to implement authentication and authorization. It al it also gives you a way to manage accounts.

[1:23:19] Uh some IM also gives you the way to do the reporting. Right? Right? I want to fetch a report of my users who log in when from where. So all those stuff identity and access management gives you. In simple what is identity and

[1:23:33] you. In simple what is identity and access management? You have an identity that identity is is some object which requires the access to your resources. [snorts] Okay. Again simple term identity is a is

[1:23:48] Okay. Again simple term identity is a is an object which requires access to the resources. In basics of cloud computing we understand we understood what cloud computing is. What is cloud computing?

[1:24:00] computing is. What is cloud computing? I'm again going back to the basics. I'm again going back to the basics. Cloud computing is a way to deliver cloud uh to deliver the compute services over internet. Why you will be using

[1:24:14] over internet. Why you will be using cloud? To deploy the resources. What those resources are? You need to deploy server. You need to deploy database. You need to deploy storage. So these are your resources.

[1:24:27] Now how are you going to deploy these resources? You are deploying these deploying these resources. So you are the identity. whether or whether you can

[1:24:39] deploy or cannot deploy we need to first identify this guy who wants to deploy so Azure.com and our AM service will identify that

[1:24:52] user will identify that identity will identify that object who's trying to coming into our uh system right after

[1:25:04] identifying we will authenticate I mean not we the identity and access management service will authenticate that user whether the username and password provides provided are correct or not okay Then the authorization kicks

[1:25:18] or not okay Then the authorization kicks in once you are inside the cloud. deploy server? Can you deploy database? Can you deploy storage? Can you do that? Authorization

[1:25:33] account management. You want to create few new users. You can do that using any IM service. Whatever services you have developed, access control, what a user can do, cannot do, you can define that using access control. Okay. And [snorts]

[1:25:49] then auditing and reporting any IM service uh most of the IM service gives service uh most of the IM service gives you the auditing and reporting thing. So what is IM? Is that clear? Now in Azure,

[1:26:02] we have Microsoft Enra ID. So, Microsoft Enra ID is the service uh which is a cloud-based identity service. So, [snorts] as I mentioned earlier, you don't need to deploy a server or anything. You just sign up for

[1:26:17] uh Azure and you have your Microsoft Entra ID. We don't need to do anything. We just need to sign up for Azure. That means you need to create your account on account, you already have Microsoft Entra. So it's a cloud sorry it's a

[1:26:33] cloud-based identity and access management solution. All right. So it gives you centralized centralized identity management. If you have a single Microsoft enter tenant you can simply use that tenant and start

[1:26:46] creating your users. Right? If someone is already using active directory domain synchronize their users with Microsoft enter ID. So Microsoft enter ID

[1:26:59] previously known as Azure Active Directory it it was launched in Directory it it was launched in 2013 or 15 I'm not sure on the exact year but during that time it was launched before that Microsoft had this

[1:27:14] service active directory domain services which uh the short form for that is adds which uh the short form for that is adds which people were using on prem cloud started gaining pro uh popularity after 2010 or 2011.

[1:27:30] 2010 or 2011. I think 2006 or 7 AWS got launched and I think 2006 or 7 AWS got launched and 101 Microsoft came in and by 15 it was 101 Microsoft came in and by 15 it was all popular 1516. Okay. So before that

[1:27:42] when cloud was not there people were already using ADDS for their on-prem identity and access management services. [snorts] So those those organization who are already having ADDS and they want to use Microsoft Enra ID

[1:27:57] then which identity and access management service will do the management service will do the authentication will do the authorization will do the verification. So you have adds you have Microsoft

[1:28:10] enter ID both are IM service which will do the authentication which will uh if you are resetting password which will be considered as as the uh having the

[1:28:23] highest control. So all those question were arises arised if you use two different identity and access management services. So what Microsoft did Microsoft created Microsoft Entra connect. So it's a tool which you can

[1:28:37] connect. So it's a tool which you can install on your on-prem server and using that you can synchronize your on-prem users to Microsoft Entra ID. Okay. So if I have hundreds of users on

[1:28:52] prem and if I use Microsoft Entra connect all hundreds of user will be connect all hundreds of user will be synchronized to Microsoft Entra ID. Okay. So whatever user you have over here, all users will be synchronized.

[1:29:06] Instead of recreating user in Microsoft Endra ID, you use this tool and Endra ID, you use this tool and synchronize your users. That's all. All synchronize your users. That's all. All right. So that option Microsoft uh gave

[1:29:20] to the people who are already using Microsoft uh active directory domain Microsoft uh active directory domain services. Microsoft created a tool. You deploy that tool on a server and you start synchronizing your user. If you

[1:29:32] create a new user, that new user will also get synchronized. All right. So, Microsoft Enra ID in short is a cloud-based identity and access management solution that you can use

[1:29:45] once you sign up to the Azure. It's free of cost. Obviously, there are different plans and pricing, but uh when you start, it's free of cost. Okay. So how to see Microsoft enter ID in action. [snorts]

[1:30:00] [snorts] If I go to uh Azure portal. All right. Now in Azure portal before I show you the Microsoft Entra ID let me just explain or give you the tour of Azure portal.

[1:30:16] portal. Okay. So I'll do it from scratch. Let me Okay. So I'll do it from scratch. Let me sign out.

[1:30:32] thing that you need to do whenever you want to interact with Azure platform, want to interact with Azure platform, you need to go to portal.azure.com. So this is the uh link where you should be going when you want to log into Azure

[1:30:47] or when you want to interact with Azure portal. when I click on uh when I press portal. when I click on uh when I press enter first thing that Microsoft Azure enter first thing that Microsoft Azure portal or Microsoft is doing is what

[1:31:00] it's asking what is this process I went to portal.azzio.com azio.com and it directed me to this what it is doing right now authentication. doing right now authentication. Okay, it is asking me to prove my

[1:31:16] Okay, it is asking me to prove my identity. So this step that we are going that we are doing right now is authentication. All right. So authentication is the process of

[1:31:29] verifying and identifying the identities. This is my username. How do we usually authenticate? We ask for the username. So my username is already selected here. Already mentioned here. If it's not

[1:31:42] mentioned, I can simply provide my email id. Whatever my email id is, right? This [snorts] is my email ID for example. I'm providing that. I click on next. It will ask me for the password. I provide the password. I click on sign in. Okay. Once

[1:31:56] username and password are correct, I'll be inside. So I'll I'm in my application. application. All right. Now this is Azure portal. Now

[1:32:09] those who do not have access to Azure portal, what you can do is either if you want to use your own account uh unrestricted account, you can sign up uh unrestricted account, you can sign up for free tier.

[1:32:27] You search for Azure feed free tier and you will see uh the Microsoft Azure page in Google or Bing. You just search for Azure free tier.

[1:32:41] [snorts] Go to the first link that Microsoft is providing and there you'll be having a button which says get started with Azure. Click on it. Once you go, once you click on it, you

[1:32:54] Once you go, once you click on it, you can click on try Azure for free. Once you click on try Azure for free, it will ask your email ID and your password. Right? So, you need to provide your uh Microsoft email id. If you do not have

[1:33:07] one, you can create one from here. So, whatever email ID you have, you provide that. Now, in my case, I have already utilized. So, if I enter my email address, [snorts] uh it will trigger it will say

[1:33:19] that I'm not eligible. Why? because I've already used it. Okay. it will say I'm not eligible. So, uh in order to utilize Microsoft Enra ID,

[1:33:38] sorry, in order to use Azure free tier, you need to have a unique email address that you have not used before, [snorts] you have not used before, [snorts] right?

[1:34:05] email address that you have not used before. Right. So here it says I'm not eligible. Why? Because I've already utilized it. So I can sign up

[1:34:17] for a pay as you go go pricing. I cannot sign up for a free tier. What I'll do, I'll see if I have any other email address. But I'm not signing up since apart from email address, you also need a unique credit card, right? So I don't

[1:34:33] have a credit card. I've already utilized all my credit card. So if I have any other email address, I can use that. So let me see.

[1:35:51] able to demonstrate how you can come up with the but it it's very basic you just provide your email address once you provide the email address you can then uh provide your details like your mobile number that should also be unique. Your

[1:36:03] email address that should also be the one that you have never used before and the credit card which you have never used before. So Microsoft Azure has this restriction where you [snorts] cannot use the same email twice to avail the

[1:36:17] free services. So you need to use new email every time but with new email you need to have a new credit card as well as you need to have a u a different before. All right AWS I think doesn't have that

[1:36:34] issue with AWS. You just need a new email address. You can use the same credit card again. [snorts] Okay. So that's how you can sign up for a free tier from here. Once you have the free tier um

[1:36:49] you can then sign in to portal.asio.com. So once you get your free tier you can So once you get your free tier you can then sign in by going to portal.azio.com use to sign up and your password. That's all. All right. Now let me introduce you

[1:37:04] or give you a tour to Azure portal. So the first thing that you see on left hand side here uh where where you see nine dots. So this nine dots is a cloud menu. Okay. What what what do what what what is the

[1:37:17] cloud menu? This is a newly uh uh new feature or or a new option that Microsoft has added where you can launch different Microsoft portal directly from here. So let's say I want to work with GitHub. So I click on GitHub, it will

[1:37:32] take me to the GitHub. I want to work with Intune. I click on Intune, it will take me to the Intune. Right? So different different portals. shortcut to that portal Microsoft has just added here doesn't u it is helpful when you

[1:37:47] here doesn't u it is helpful when you want to switch between different u different portals if you want to uh go to GitHub from here or in tune from here you can simply click on this shortcut and go to that

[1:38:01] right after the cloud menu the second thing that you that you see with the thing that you that you see with the three lines uh is known as [snorts] uh portal menu. So if I click on it, you'll see the menu over here from where you

[1:38:15] can go to you create any resource. Uh some shortcuts are given, right? Go to homepage, go to dashboard page, uh go to Microsoft Enra ID, go to monitor services, right? So shortcuts are given. So you can launch whichever service you

[1:38:30] want. I want to work with virtual machine. I click on this portal menu. I launch the virtual machine and I go to the virtual machine page. Right? Similarly, any service that that we want to use, we we go there and we can use

[1:38:42] it. Okay. [snorts] Next, after that, you have this Microsoft Azure mentioned there. It's it's the brand name. So, if you click on Whatever page you have selected, you'll be landed to there. All right. It's just

[1:38:56] uh a shortcut to go to the to the homepage or to the dashboard whichever you have selected. Then, if you go right hand side, you have the search bar. So if I want to we will be using this search bar every time we want to work

[1:39:11] with any service. So this search bar will help me to search for different resources. Like if I just type virtual, it will list out all the services which has uh virtual in it. Like I want to work with virtual machine. I search for

[1:39:24] virtual. Virtual machine is there. I click on virtual machine. It will be landed to the virtual machine page. From here I can create virtual machine. I can stop existing virtual machine if I want. start, restart, whatever. Right?

[1:39:36] Similarly, if I search for database, so anything related with with this particular keyword will be uh placed over here, right? Database watcher, SAP solution, whatever I search for SQL, all the SQL related services

[1:39:52] will be provided. Right? So, this is just the search bar, a shortcut you can say to search and go to any service that you want. Then if you go on again on right hand side you have copilot. What is copilot guys?

[1:40:08] So copilot is a gen AI tool from Microsoft right. So if I click on co c co c co c co c co-pilot within the browser itself I will get a way to chat with the co-pilot. So if I have any issue like I want uh copilot to answer

[1:40:27] any of this any of the question like I just uh added hi it it gave me the just uh added hi it it gave me the response right I want copilot to create response right I want copilot to create an ARM template for me

[1:40:48] me a give me a response depending on my prompt. So the better the prompt is the better the response will be right. So it is now generating the template. I can use that template then right apart from that it also has few

[1:41:02] bots kind of question already created. So if you click on it that will be the prompt for for your copilot. So copilot option is is given there if you want to utilize it for anything you can

[1:41:16] want to utilize it for anything you can utilize. So uh nowadays Gen AI is quite smart. Okay. So if you see this, it has already created a template for me. I can how to deploy the template, I can again ask the copilot how do I deploy this

[1:41:33] template? It can help me. Right? So, anything I I need

[1:41:45] on your prompt, how good your prompt is, it will give you the answer. Now, obviously, I'm not saying that it's it's perfect. It can make uh mistakes, right? perfect. It can make uh mistakes, right? So whatever you're using uh use it

[1:42:02] So whatever you're using uh use it uh try it and then if it's wrong ask it ask the copilot or the chat GPT again right so you see how how to deploy this it has given you the the the steps right so nowadays it has become very easy to

[1:42:17] do the hands-on by use by using chat GPT or copilot or whichever genai tool you or copilot or whichever genai tool you prefer right so it's just a a simple way instead of launching copilot in a different tab Microsoft has given you

[1:42:32] different tab Microsoft has given you that uh option within the portal itself then after copilot the next option or the next icon that we have is the cloud shell so what is cloud shell so if I click on the cloud shell it will launch

[1:42:48] the command line interface within the portal itself so within the within the portal itself so within the graphical portal azio.com I have the option to launch the cloud shell directly. So what is this cloudshell? It

[1:43:02] will allow me to interact with the Azure platform using the commands. So if I want to interact with Azure virtual machine I need to use certain command. machine I need to use certain command. What that command is uh you need to uh

[1:43:17] rely on Microsoft documentation to get the command or you can take help as the command or you can take help as well. Right? So type help to learn more type to use Azure CLI right a VM stop and then the VM name and all if I give

[1:43:31] it will simply stop that VM. So these are the required field if I want to stop any a VM it's just a way to interact with the Azure portal or Azure platform we can say using command line. So you can use

[1:43:47] say using command line. So you can use either the bash shell the Linux shell or if you are familiar with PowerShell or if you're more comfortable with power p PowerShell you can switch to PowerShell as well. Okay. Okay. So now if you see I

[1:43:59] have clicked on switch to powershell. This button right now it's showing as switch to bash but when you are in bash it will show switch to powershell. So I clicked on that and now I am in powershell. So I can run the powershell

[1:44:12] commands now to interact with us your portal. All right. Now if you want to restart the terminal I mean the cloud terminal you can click on restart and it will give you a new uh terminal. Right. as as

[1:44:26] soon as I clicked on restart, it is now requesting a new cloud shell. All right. Then the next option that you have is manage files. So you can upload

[1:44:38] or download files uh to cloud shell. So if I want to work with file, I can simply click on manage file upload. And if I want to upload any local file, I can upload it. Like for example, template.json. I want to upload

[1:44:54] it. It's uploaded right where it is uploaded to this path. So if I do ls now uploaded to this path. So if I do ls now here which is list you see template.gs

[1:45:09] to upload or download. Now new session will simply give you a new powershell a new portal and then within that portal you'll get new cloud shell session. you'll get new cloud shell session. Okay. So that's the option as well. Now

[1:45:22] after that we have a very basic visual studio editor. So if I click on editor a visual studio will open. It's a very basic visual studio editor. Okay. It's a file editor. So if I want to edit my files from here I can do that. I don't

[1:45:37] files from here I can do that. I don't need to switch between the desktop and the and the portal. I can simply if I if I have obviously it's not featurerich. It's a very basic cloud shell that uh sorry file editor that you

[1:45:52] have. If you want to make any changes you can do from here right. So if you want to close you go over here and you can close it. You have the web preview as well. So for web preview uh if you let's say have

[1:46:06] web preview uh if you let's say have deployed any basic application here and you want to see how it will look like when someone launch it from from from browser how it will look like. You can simply use the web preview from here.

[1:46:21] Okay. Then the settings like you just want to change text size, font or uh theme. You you want dark theme, light theme. So all those things you can change from setting. Then there's help like I want to see all the PowerShell

[1:46:37] command, all the all the CLI commands. So I click on that. It will take me to the Microsoft documentation and here I see all the CLI related command. Okay, I want to work with uh virtual machine. So I search for VM and it

[1:46:52] should give me the the VM related command. So this is these are the VM related command. So if you scroll down you'll see all the command that that are you'll see all the command that that are that you can use for for VM.

[1:47:07] that you can use for for VM. Okay. cloud shell, we have a very simple notification uh tab. So what this notification tab does uh let's say I'm I'm working with or I'm deploying

[1:47:22] I'm working with or I'm deploying anything. So I'm deploying uh I'm I'm creating a resource group. Don't ask me what resource group is. I'll I'll cover that in detail when we are on that topic. But I'm just explaining the

[1:47:34] notification tab right now. Okay. So if I search for resource group [snorts] and I create a new resource group or I delete an existing one. So a notification will trigger like for example RG02

[1:47:49] central India click on review create and click on create. So once the creation is completed you see resource group create a notification will be triggered. So if I delete the same resource group another notification should trigger

[1:48:03] another notification should trigger which says resource group deleted.

[1:48:23] resource group. Once the deletion is completed it will trigger delete. So whatever you are doing uh and if you want to monitor that you can come over here and you can see that all the events that whatever you have in you have the

[1:48:38] everything will be cleared there will be no notification you cannot see the history there's no way to see the history okay then you have uh settings uh for the portal itself if you want to

[1:48:54] if you if you are part of multiple Microsoft Endra ID You will see all the Microsoft enter ID over here. If you want to switch between switch from here. Right now, I'm only part of one. If you're part of multiple,

[1:49:07] I have seen people who are part of multiple directories. I can show you that in my another account. So, if I go to another account and click on settings, you see I'm part of two different uh tenants, two different

[1:49:21] Microsoft enter IDs. So, if I want to switch between any of the Microsoft Enter ID, I can do that. How I can do that? I click on settings. Settings will land me to this page and I can click on switch. It will be switched

[1:49:34] can click on switch. It will be switched to a new um the other directory. Right? So that you can do from settings. Apart from that you can you can uh change the appearance like I want a dark theme. So a dark theme will be applied over here.

[1:49:49] I want a light theme. Light theme will be applied. So it's just a normal language and region like you want English or any other language. Uh your information like your email id and all if you want to uh get a notification

[1:50:03] right uh sign out and notification uh if you're not doing anything and if it's idle do you want to sign out when when inactive after 15 minutes if you're not doing anything for 15 minutes it will automatically sign out. All right. So

[1:50:16] all those stuff you can do from the settings tab from the settings option. Then you have support and troubleshooting. So if you have any issue with Microsoft Azure portal you can search for it. If they have the

[1:50:31] documentation you will see the documentation over here or from here also you can raise the ticket as well. So let's say my subscription is not allowing me to deploy any resource. I can raise a ticket and I can ask

[1:50:44] Microsoft as your team why it's not allowing me to deploy the resource. So they will come up with an answer like maybe your subscription is not eligible or you don't have the kota kota whatever right. So you just uh can raise a ticket

[1:50:59] from here. Now remember this thing where to raise a ticket from you can either raise from support and troubleshooting option or you can raise it from uh your subscription itself. All right. Now why I'm asking you to

[1:51:13] remember this because in interview if you are fresher uh the interviewer might ask how to raise a support ticket to Microsoft Azure team. Okay [snorts] then if you want to provide any feedback to Azure team you can provide like I'm

[1:51:28] you're liking you're not liking it what you're not liking. So this feedback will you're not liking. So this feedback will will go to Microsoft team. Okay. Then the last option that you have within the portal itself is your username. So this

[1:51:43] is your username. Uh you can switch directory or switch Microsoft enter ID from here as well. Can view your Microsoft account from here as well. All right. So just to summarize, you have the shortcut to go to uh uh uh go to any

[1:51:59] other portal outside Azure. You have the option within Azure if you want to launch any service there's a shortcut if you want to go to homepage from any other uh page like for example I'm here in the network page I want to go back to

[1:52:13] my homepage so I click on Microsoft Azure here it will take me to the homepage then you have the search bar shortcut to reach any service for example I want to go to health page I want to see the health if I have access

[1:52:25] I will be able to see it right so whatever shortcut uh to the services you service. Then you have copilot. You have cloud shell which is like a like a uh an

[1:52:37] option to interact with azure platform using command line. You have notifications. You have settings your appearance your language and all you can select in the settings or you can change

[1:52:50] select in the settings or you can change in the setting. You have uh support and troubleshooting from where you can raise tickets related to Azure portal itself. Then you have feedback and then you have your user detail right the user that you

[1:53:02] have logged in from right it's just a short tour to Azure portal how which short tour to Azure portal how which will help you to navigate from u uh will help you to navigate from u uh within the Azure portal itself right

[1:53:17] all right so now where do I see the Microsoft entra ID question for you guys I want to go to Microsoft entra ID page how to how to >> [snorts]

[1:53:33] Right, we have the search option. We can search for Microsoft Enter ID from here and go to Microsoft Enra ID or you have the portal menu here. From here you can simply uh click on Microsoft Enra ID and you can go

[1:53:49] once you sign up for Azure you have to do nothing. You'll get Microsoft Entra ID for free. You don't have to pay anything. Okay. [snorts]

[1:54:04] identity and access management system which is free of cost. If you see here license, I have got the free license. So you have I have got the free license. So you have the Microsoft Entra ID free of cost.

[1:54:20] uh obviously with free of cost you'll have less features. There are different licenses available for Microsoft enter ID. If you're going for free there is certain limitation like I think you can create uh half a million records only

[1:54:34] that that means half a million objects only. If you want more if you want to go above that you need to go for Microsoft Entra ID premium. Entra ID premium. So if I search for Microsoft Entra ID

[1:54:58] this is the page where Microsoft has mentioned uh different features available in different plans. So there are like three or four plans. So if you see we have premium P1, we have P2 and then Microsoft Entra Suite. So these are

[1:55:12] it's free. You don't have to pay anything. But if you want to use certain premium plans then you need to go for P1 or P2 or suite depending on what features you want. Now if I scroll down here you see if you want Microsoft Enra

[1:55:30] here you see if you want Microsoft Enra ID protection it's available here in P2 or Microsoft Enra ID suite. It's not available in free tier. All right. So whatever is checked over here is available on the on on that particular

[1:55:45] available on the on on that particular plan. not on free. Okay. So here are the plan. not on free. Okay. So here are the limitation that you see with free tier.

[1:55:58] it supports multiffactor authentication. It supports the single sign on. It supports the basic reporting. You can manage users and groups. Uh it also reset. It can also allow you to sync your

[1:56:14] on-prem directory users with Microsoft enter ID. So this can be done. But if I enter ID. So this can be done. But if I want let's say verified ID, it's not mentioned here. I won't be able to use that. If I want to use identity

[1:56:28] protection, it's not mentioned there. I cannot use it with the free TM. Okay. So all these are premium uh plans. All these are premium features. So if you want to use those features, you need to sign up for a

[1:56:43] features, you need to sign up for a premium claim. All right. [snorts] So in order to interact with Microsoft Enra ID, I can search for Microsoft Enra ID and it'll be landed to that page here. What what license I have whether

[1:56:56] here. What what license I have whether it's a it's a free license or a uh premium license will be mentioned under under your overview page uh within the license section. Okay. So that's what Microsoft Entra ID

[1:57:10] Okay. So that's what Microsoft Entra ID is. Now Microsoft Endra ID comes with is. Now Microsoft Endra ID comes with two different flavors B2B and B2C. Now since it's 10:40 already I have only 20 minutes. So I'll cover B2B. I'll explain

[1:57:25] B2B and then we will stop for the question and answers. question and answers. Okay. So what is Microsoft Entra ID B2B? [snorts] B2B stands for business to business.

[1:57:42] what does it mean business to business? Uh you have your Microsoft Entra ID. So once you sign up for Azure, you'll get Microsoft Enra ID and you have a partner Microsoft Enra ID and you have a partner company who will be developing certain

[1:57:56] company who will be developing certain products or certain softwares for you. is your entra ID. >> [snorts] >> and you have your partner company who will be developing certain products for

[1:58:09] you. Now when you're developing certain when they are developing certain products you want them to host those products. websites. So when they're developing that website for you you want to host

[1:58:25] you want them to host that website on your resources. So they will have their their developer here. here. Now tell me this developer

[1:58:39] who belongs to the partner company the user account for their developer the user account for their developer will reside where in our enter ID or their enter ID. When you join a company let's say you

[1:58:52] join XYZ company. So that XYZ company has its own IM service and there's another company ABC company they have their own IM service. So when you are joining XYZ company your account will be created in XYZ or ABC

[1:59:13] so my account should be created in XYZ when I'm signing up for Netflix my account will be created in Netflix it it's not going to be created in prime it's not going to be created in prime video right so similarly these three

[1:59:25] video right so similarly these three developers who are uh employees of partner company their account their user account will be created account will be created in the partner company's

[1:59:38] entra and this is my entra our entra ID now if and this is my entra our entra ID now if these guys wants access to my resources I have a virtual machine here I have storage here I have a database here they

[1:59:54] want to develop an application for me a product for me a website for me and they product for me a website for me and they need access to my resources. So with zero trust model, how are you going to provide the access?

[2:00:10] How can you access or let's say you want to log into your enter ID and you want the first thing that is going to trigger? First thing if I want to provide them the access what I need let me explain it

[2:00:25] from the portal. Okay. So if I go to the portal, this is my entra ID with the name as your training. So this is my entra ID. Okay. If I go to the manage section here, in the manage section you see users. So if I click on users here,

[2:00:41] I'll see all the users which are part of my tenant which are part of my entra ID. These are all the users who are part of my entra ID. Okay. So this is Azure

[2:00:54] training which is my entra id and these are the users who are part of it. I have another entra ID of my friend let's say my partner and

[2:01:06] they're good in development. So I want them to develop a re develop a software for me but I want them to host that software in my resources in my virtual machines the virtual machine that we have now in order to provide them the

[2:01:21] have now in order to provide them the access they have their account in partner entra ID they don't have account here so what I need to do first what I need to ask what I can do one way is to create their

[2:01:38] is user one, this is user two, this is user three. So I'll come over here. You see new user. I click on new user. I create account. User 01, user 02, user 03. So I can create an account for them. That's the one way. But now think from

[2:01:54] user point of view. Think from the user point of view. If I create additional account for them, what is going to happen? what is going to happen? The user needs to remember two different

[2:02:09] set of credentials. They need to remember these credentials which they they are going to use to access my resources plus the they need to uh remember the credentials for their own

[2:02:25] enter ID as well. Now tell me as a security team member or Now tell me as a security team member or as an IM solution or IM team member is it good to ask your employees or your users to remember

[2:02:42] more than one set of credential? Is it a good idea? forget password. They can forget password. they can

[2:02:55] forget user ID since I might be using a different kind of user ID like if you see here I have different kind of user ID some company uses first name last name at the rate their company domain some uses first name and then surname

[2:03:10] and then at the rate their company name so different different companies have different different ways of coming up with the user ID right so I don't want them to to remember two set of credentials what I can do I can use B2B

[2:03:23] this is my business. This is their business. So I'll use B2B here. What is B2B? Business to business. Microsoft Entra IT business to business. I can invite their user to join my tenant.

[2:03:40] I can invite their user. If you click on new user here, we have two options. Create new user and invite external user. So this invitation or inviting an

[2:03:54] external user will create an account here in my tenant. They don't need to remember two set of credentials. They can use the same email ID that they are using same user ID that they are using in their own tenant. They can use that

[2:04:10] and once they use that they can log my tenant. out I well when when I'm I'm I tenant. out I well when when I'm I'm I was giving you the the tour I demonstrated this

[2:04:24] directories directories are nothing but the entra ID you have your one directory here apart from that you can have another directory as well so once I invite them they will have the option to switch between the directories

[2:04:43] okay so what is B2B B2B is a way or sorry external identities external object external users to your own tenant

[2:05:00] to your own directory. Okay. So why we have B2B here to make things easier for the external employees. I don't want them to remember different set of password. They can use the same

[2:05:15] password and they can log in uh to multiple tenants. Now it's possible that the partner company is developing software for different different clients software for different different clients like TCS. TCS develop what is TCS? TCS

[2:05:29] is a consultancy consultancy firm, right? So they develop software for right? So they develop software for multiple partners. Now imagine you are asking your developer to remember password for all the tenants

[2:05:42] he's going to first of all forget all forget most of the passwords right so to make it easier Microsoft came up with this B2B business to business now what is business to business how does it

[2:05:57] work we don't have to bother about it why because we are using this as a service not what Microsoft is doing behind the scenes is not something we need to bother. Okay. But yeah, if you want to come up with your own B2B, you

[2:06:12] don't want to use Microsoft Enterra ID, you you're using onprem services, you have active directory domain services, you need to create something known as federation server. So it works in the same way but uh lot of work is involved.

[2:06:30] Microsoft has made it quite simple. Uh when it come to Microsoft Entra ID B2B, we just need to click on new user, invite external user, uh provide proper

[2:06:43] email address, whatever the email address is and once the user accepts, he or she will become part of my 10. All right.

[2:06:55] Now there are a lot of topics that we need to cover. Obviously we cannot cover today. So we will cover it tomorrow. Now what these topics are just to give you what these topics are just to give you an overview. Uh apart from B2B, we have

[2:07:09] another type of uh tenant in Microsoft Enra ID which is B2C. I'll explain what B2C is tomorrow. Then we have few premium features like conditional access, identity protection, access reviews. So these are the these are the

[2:07:22] premium features. If I go to the Microsoft Entra plans and and pricing uh if you see conditional access is a premium feature. It's not available with free tier. So in order to use conditional access you need to have

[2:07:36] premium at least premium P1. Okay. Then there is identity protection. So identity protection is also part of uh premium tier. Then access whatever we are discussing tomorrow uh is is falls under the premium

[2:07:52] features. In order to use that you need to have premium in place. Then then we will discuss identities for applications. So manage identities and service principles and then we will discuss as your keyword. So for the

[2:08:06] first half tomorrow we will able to complete our Microsoft uh entra ID and then we will discuss the case study. Okay. So make sure you're case study. Okay. So make sure you're re-watching second half of today uh

[2:08:20] before you're coming for the tomorrow's class so that you know the basics of identity and access management uh what is entra ID what is B2B right all right all right so what we have covered so far uh basics

[2:08:36] of cloud computing we have covered yesterday where we understood what cloud computing is why do we need it in simple cloud computing is just the delivery of comput services. What are those compute services? Those compute services are

[2:08:49] servers like you can get CPU, RAM, storage, all those stuff. Apart from that, you can get network, you can get databases, you can get uh different managed services. So all of the services you get as a service from cloud from

[2:09:04] cloud provider. So we see we saw that in the first half. In second half we jumped the first half. In second half we jumped to Microsoft Enra ID where we understood to Microsoft Enra ID where we understood what AM is. Why do we need AM? IM stands

[2:09:16] what AM is. Why do we need AM? IM stands for identity and access management where if you want to manage your objects, your your ids, your identities, identities are nothing but the users or the groups who requires access to your resources.

[2:09:31] If you want to manage them, you have AM which stands for identity and access management. Before seeing identity and access management, we covered the uh uh module the framework which defines how your identity and access management

[2:09:45] should be. ZTM stands for zero trust model. So it's just a framework which defines how you can secure your AM solutions. Then we saw if we want to do

[2:09:57] uh if we want to implement identity and access management on cloud on Azure specifically what service we have? We have Microsoft Entra ID. So what is cloud-based identity and access management service. You can call it as

[2:10:11] identity as a service. You don't need to deploy your server. You don't need to deploy your server. You don't need to deploy the uh adds on top of your server. You don't need to deploy promote it to the domain controller. Everything

[2:10:23] is done for you. Everything is managed for you. Okay? So everything is managed and you're getting that as a service. Then Microsoft Enra ID comes with two different uh flavors B2B and B2C. We have covered what B2B is. B2B stands for

[2:10:37] businessto business. So if if I have a company, this is my Microsoft Endra ID company, this is my Microsoft Endra ID tenant and I want to invite or or provide access to a partner company or let's say I have company A, B, C and

[2:10:51] XYZ. So these are the two companies I have. XYZ is my company. Whereas I uh have. XYZ is my company. Whereas I uh bought or uh I I bought ABC's business. So ABC is also my company. Now I want to provide all the users access to my

[2:11:08] tenant. So I can use B2B here as well. This is another scenario where I can use B2B. All right. The next thing that we are going to discuss today is B2C. So let's go to the next topic which is Azure ADB B2C. B2C

[2:11:23] stands for business to consumer. All right. Before doing B2C, let's just uh right. Before doing B2C, let's just uh see the invitation one that we covered yesterday. Like if I want to invite any uh user who's not from my tenant and I

[2:11:37] want to invite a user who belongs to another company. Doesn't matter if that another company. Doesn't matter if that company is using uh Microsoft Enra ID or any other identity platform. The required thing is they should have their

[2:11:49] users should have a valid email address. That's all. If they have the valid email address, we can invite them. All right. So how to invite? If I go to Microsoft Endra ID from the start menu from the

[2:12:03] portal menu, if I click on Microsoft Endra ID, I'll be landed to this page. This is the homepage of Microsoft Enra ID. From here under manage section, I can see users group. So if I want to manage users, create users, delete

[2:12:16] users, modify users, I have to go under the manage section. So within that manage manage section, we have users and groups. All right. So if I click on users here, I'll see I'll I'll get a list of all the users that are already

[2:12:30] part of my tenant. Okay. Now this is the user Okay. Now this is the user who is an external user. This one if you see this user root cloud easy, this is an external user. Now you consider the

[2:12:45] same scenario which I dis which we discussed yesterday that we can invite any user who belongs to any company doesn't matter whether they are using entra ID or they are using Google workspace or they are using AWS

[2:13:01] Google workspace or they are using AWS uh AM services we can invite anyone as long as they have a valid email. Okay. So to see that in action, what I'll do, So to see that in action, what I'll do, I'll simply delete this user.

[2:13:16] whenever you delete a user from Microsoft Enra ID, the user is there for Microsoft Enra ID, the user is there for for 30 days. It's not getting deleted uh permanently. So you have to delete that permanently if uh if you know that you

[2:13:30] don't need that user account. Okay. In our case right now, this is just uh a a tenant, a test tenant. It's not a production tenant. So, I deleted that user. Right? Now, I go back to all users and in order to invite any user, I click

[2:13:45] on new user. Here under the users section, we have all users. There we have new user. So, I click on new user. I click on create new user. If I want to create a user uh within my tenant within my Microsoft Endra ID,

[2:14:01] if I want to any external user from any other organization, I select this option. All right. So I click on invite external users. I just provide the email external users. I just provide the email address.

[2:14:19] providing that email address. Doesn't matter whether it's your company uh whether they are using Microsoft Enter ID, Google Workspace or it's a normal ID, Google Workspace or it's a normal email id. We can invite them. All right.

[2:14:31] create. That's all your user will be invited. So you see here notification user invitation in progress. So a mail will be sent to user from your Microsoft Enterra ID. Now if you see here uh in

[2:14:46] some time if you refresh you should see that user here now how to verify whether this user is part of your tenant or uh external

[2:15:04] tenant how to verify that so if you see this user type here you have different types of users this is important to understand member Member user that means your own your tenants user. This fabric admin is a member

[2:15:18] user. This is my tenants user. You see this one this is a guest user that means this one this is a guest user that means uh this is an outside user whom you have invited to your tenant. All right. Similarly root cloud easy. This is a

[2:15:33] guest user outside user who you have invited to your tenant. All right. So remember there are three types of users. These questions often lands in the uh

[2:15:45] These questions often lands in the uh exam. You have member user, you have exam. You have member user, you have guest user and you have uh ad sync user. of users you can see when you are dealing with Microsoft enter ID. Member

[2:16:01] user, your own user, your company's user, your tenants user, guest user, user, your tenants user, guest user, outside user, uh ads sync user, if you have an active directory domain services and you are synchronizing that with

[2:16:13] Microsoft tendra ID, the users who have been synchronized will be the type of been synchronized will be the type of that user will be ad user. All right, clear then uh inviting a user is one

[2:16:29] step. The user who have you have whom you have invited should accept the invitation. If he or she is not accepting the invitation, he or she won't be able to use the tenant. Right? So what I do

[2:16:41] right now, I go to Gmail, I log into my account.

[2:16:55] Microsoft invitation. So similarly that user will also receive the invitation and he or she needs to accept that. So if I click on it I need to accept it. So in order to accept what I'll do I'll go to the in private window. I'll copy the

[2:17:10] to the in private window. I'll copy the uh link Now why I'm doing this in in private so that uh in in the in this session I've

[2:17:22] already logged in with the simply learn user. Okay. So I don't want to use the same session. So that's why I have triggered or open the in private window. All right. So it it's saying it will send me a a code to my email in order to

[2:17:38] confirm that this is my email ID. So I can click on send code and I'll receive can click on send code and I'll receive the code in my Gmail account.

[2:17:50] multiffactor authentication. It's like a confirmation that the person who's trying to log in is the same person. So 583 439. So I just go there and enter 583 439. So I just go there and enter it. 583

[2:18:13] Okay, that's all. Now I will be logged in to uh

[2:18:34] from here and just to confirm I have logged into the same tenant uh from from where I was invited to confirm that how how you can confirm you can go to Microsoft Enra ID.

[2:18:47] whenever um a new user account that's been created or new user who has been invited to your tenant has to complete the multiffactor authentication. So before I I give some information let's understand

[2:19:04] what multiffactor authentication is. How many of you already know what many of you already know what multiffactor authentication is?

[2:19:17] Multiffactor authentication is like an additional form of authentication. Okay, I hope you know u what authentication is, right? You know what authentication is? Authentication is a process of verifying the identities, right? So, how

[2:19:33] do you uh verify the identities? You provide them username and password. So, that's what we provided here. Username and password already provided. But it's possible that username and password are compromised. So in order to avoid

[2:19:46] uh allowing access to an unauthorized user what do we do? We add an additional authentication or multiffactor authentication

[2:19:58] one extra form of authentication. username and password you have to provide. Apart from that, prove your identity by entering the OTP or approving the authentication in the authenticator app

[2:20:15] authentication in the authenticator app or if you have a gate or something where ask them to provide the biometric authentication as well. All right. So multiffactor authentication MFA stands for

[2:20:29] multiffactor authentication. From October 2024, Microsoft has made this nothing. I mean you don't have to enable multiffactor authentication. It's by default enabled for all the users within your tenant.

[2:20:43] Before October 2024, we had to enable multiffactor authentication for each and for each and every user. after October 2024, it has been made mandatory for all the users. Okay. So, whenever user logs in, Microsoft's

[2:21:00] collects some extra information from that user. Most probably it would be uh adding an account in Microsoft authenticator or any other authenticator app that you that you want to use. All right. So, whenever I create a new user,

[2:21:13] I need to do this setup every time whenever I'm uh logging in from a new user. So I click on next.

[2:21:25] Oh, let me log in again.

[2:21:46] information that I need to install Microsoft authenticator. It's not mandatory that you need to use Microsoft authenticator. You can use another authenticator app as well. There are lot of authenticator apps available in the

[2:21:59] of authenticator apps available in the market like Google authenticator um octa last pass. There are lot of lot of there but this is the simplest one since we are using Microsoft product. Let's go with Microsoft authenticator. Then I

[2:22:12] click on next here. After clicking on next, I need to go on my phone. Now I am not I cannot share the phone screen here. But within in my phone, I should have the authenticator app and I should be adding the work or

[2:22:27] school account as mentioned there. If you read it's quite simple. It's saying if prompted allow notification then add an account work or school and then scan the QR. When I click on next it should give me a QR. So I'm scanning that QR in

[2:22:41] my authenticator app and once that is done I can click on next. It should send me a approval notification or a number that I have to enter within my phone. I don't know if you can see. Okay. So I need to enter that name here. Uh sorry

[2:22:55] need to enter that name here. Uh sorry number here.

[2:23:12] entered, it should uh refresh and it should allow me to login. Okay. Now, I'm inside portal. So, this MFA setup is something that uh every new

[2:23:27] user needs to do once when when they are logging in. All right. Now, if you see I'm logged into Azure portal. If I go to Microsoft Endra ID as root cloud

[2:23:39] to just confirm that this is the same tenant where uh now obviously I don't have access because I I am authenticated but I don't have the access to do anything with Microsoft enter ID as a root cloud a user. If you remember we

[2:23:54] only just we only invited this user. We did not provide any permissions to this user. All right. So now this user can login but in order to confirm obviously we cannot confirm over here. It doesn't uh give any detail which tenant this

[2:24:08] user belongs to. Okay. But if I go back to the browser where I've logged in with a user who has the access like simply learn user who has the access and if I learn user who has the access and if I see rootcloud easy from here he uh is

[2:24:21] part of this email id is part of my tenant. All right. What is the type of user? It's a guest user. Clear? So that's MFA and that's how you you work with the external users who are not part of your tenant. Okay,

[2:24:38] not part of your tenant. Okay, clear guys B2B mentioned yesterday do not do the de uh the lend hands-on uh alongside me. Okay,

[2:24:51] the lend hands-on uh alongside me. Okay, you you you can do it in your free time. All right, so B2B clear or no? Uh quick answers guys we have to cover a lot of answers guys we have to cover a lot of topics.

[2:25:09] Har is asking in organization I assume you use org MF software it's not org software what is IM whatever IM service you are using that IM service now MFA is very basic topic which is included in all IM services. So if if you're using

[2:25:24] any other IM service, you're using active directory domain services or you're using AWS IM service, they already have MFA. Okay, that totally depends on you which uh AM service you're using, your organization is

[2:25:37] using. All right, next topic that we have is All right, next topic that we have is B2C, business to consumer. Active directory Azure Active Directory or Microsoft Enra ID business to consumer.

[2:25:50] Now B2B works when you want to invite users to tenants and you want to invite your invite external users to your tenant.

[2:26:02] B2C works in a totally different uh manner. Okay. Uh what is that totally different manner? B2C is also an active directory tenant also a Microsoft enter directory tenant also a Microsoft enter ID tenant where you have an application

[2:26:20] you have that application and you want users to log that application so when you are authenticating a user within that application you need to have an

[2:26:32] identity module you need to create or you need to develop it yourself you need to ask your developer to come up with an identity module and before providing an login they need to prove their authentication they need to prove their

[2:26:44] identity so in that case what you can do let me just give you the real world example here if I go to lmsimplearn.com

[2:27:01] authenticate here I need to provide my email address and password right I have to enter my email address and password then only I can login now this simply learn this is an application lms.simplearn.com simply.com this is an

[2:27:15] application where we are asking the end users to login now tell me that end user users to login now tell me that end user are I mean the end users are they our employee the end users like you guys who are

[2:27:31] accessing our LMS learning platform you are not not simply learns employee right so does it make sense for the non employees to create an account within in our tenant. Does it make sense? Let's say we

[2:27:46] have like in one batch we have uh hundreds of uh students, hundreds of candidate. It doesn't make sense for me or my my AM administrator to go here and create users for each and every uh account. Uh we cannot do that, right? I

[2:28:03] mean we can do that but it it doesn't make sense to do that since in one batch we have hundreds of user. Imagine we deliver like parallelly we deliver like deliver like parallelly we deliver like 10 batch a weekend. So 100 into 10 is

[2:28:15] thousand users. I cannot create thousand users every month. Right? So it doesn't make sense. So we should not be creating their user should not be creating their user account our end users user account

[2:28:28] within our B2B tenant within our Microsoft enter ID tenant or what what's Microsoft is doing? Microsoft is providing another set of another tenant providing another set of another tenant which is B2C business to consumer. So if

[2:28:40] you have an application and you want to handle identity that means authentication for that application then you can rely on Microsoft Android IDB2C where you can come up with signup flows what information you want to collect

[2:28:53] from users like if you see here we have given the option to sign up right we have the option to sign up so when you click on sign up you need to provide your email what options we are what things we are collecting we are

[2:29:06] collecting first name last name email address so this is known as signup flow. what information you want to collect. This information will be kept in Azure Active Directory B2C tenant. All right.

[2:29:20] So for your end users, for your customers, you can use B2C. For your own employees, you can use B2B. Clear where you'll be doing B2C and where you'll be doing B2B. Now how to create a B2C tenant? I'm not

[2:29:36] going to create B2C tenant. B2C talent are not free. Uh you'll have to pay right. But if you want to create in any point in time, you can click you can see within your Microsoft Enra ID page, you have this manage tenant. So I click on

[2:29:51] manage tenant and I can click on create a new tenant and from here I can select a new tenant and from here I can select Azure AD2C. Okay. So this is something that we can use to create a B2C tenant.

[2:30:06] use to create a B2C tenant. All right. Now you have to remember one thing uh as uh as mentioned here from May 1, 2025. So already one year a uh B2C tenants are no longer available for sales. That

[2:30:21] means if I go ahead and create a new B2C tenant, it won't let me uh create the B2C tenant. Why? Because it's it's not there. Okay. So what is the uh

[2:30:33] what is another method? If I want to use something similar to B2C, you can uh click uh you can rely on this uh app registration thing where it is this one. So this also works in the similar way as B2C.

[2:30:49] Okay. There you have the option to create uh signup flows and all. Okay. Kalashnat is asking who typically uses B2C? I just gave an example. If you have an application, you will be using B2C. Okay. So if I have this application like

[2:31:05] we have this application, we are not using B2C but we can use B2C since we have the application and we want authentication module for that Microsoft didn't disclose their customer who are using B2C.

[2:31:19] uh if you have an application and you want to you don't want to bother about creating another authentication module just for your end user to login. How does it work in real world? You have an application

[2:31:35] Obviously you want your user to authenticate, right? We do not have a a very simple website here. We have the LMS portal where we have our content. This recording goes to the LMS portal. So we don't want to provide access to

[2:31:50] anyone who can login. We want users who have enrolled for our courses. Only they should be able to uh watch the recordings. So what do we want? We want to authenticate them. Now in order to authenticate what I need to do, I can

[2:32:04] ask my developer to create an identity module and then add the username and password of all users in one of the databases. So I can come up with a database. I can uh ask user to sign up from here. Whenever user is signing up,

[2:32:18] all the information is uh collected in a database. Now when user is trying to database. Now when user is trying to login in uh login this application will checks the username and password in the database. If username and passwords are

[2:32:31] correct, we are allowing them to login. If username and password is not correct, we are not allowing them to log. But why should I be using B2C? Let's say database. Managing database, you need database

[2:32:47] administrator, right? You need an extra personnel who knows how to uh create a database with the application. You need a backend uh developer as well. All

[2:32:59] right. If I don't want to manage all this stuff, I can go with simply with B2C. So if you if your organization don't want to manage, you can go for the B2C. Who uses is Netflix can use it. Netflix also has the identity and access

[2:33:12] management. Right? If I try to go to netflix.com, I need to log in first. So Netflix is nothing but an application. So in order to watch any movie or any

[2:33:24] show, you need to sign in. So when I'm clicking on sign is possible, then that clicking on sign is possible, then that place might be using uh B2C. There are a lot of applications who uses IM and if they don't want to manage

[2:33:37] their own database separate database only for identity and access management only for identity and access management they can simply use B2C. Okay. they can simply use B2C. Okay. [snorts]

[2:33:54] Clear. Next topic we have any questions before I move to the next topic.

[2:34:08] need database for maintain paid subs. Obviously, you need database. Okay. Uh you can rely on the authorization modules as well. Different application have different kind of authorization modules. Authoriz authorization is not

[2:34:21] something that you can uh use Microsoft entra ID for for your application. Okay. For Azure portal obviously you can use Microsoft entra ID for authorization use Microsoft enter ID for that you need to come up with your own uh within your

[2:34:38] uh application module you need to come up with the authorization okay all right next thing is conditional access. So [snorts] conditional access is a premium feature you cannot use it with

[2:34:52] the free tier. uh yesterday uh we discussed the different plans and pricing of Microsoft Android ID. So this conditional access is a premium feature. So if I want to use conditional access, I need to have the premium P2 premium P2

[2:35:06] license. If I have premium P2 license, then only I'll be able to use the conditional access? As the name specifies, depends on certain conditions,

[2:35:18] the access will be defined. depends on certain conditions. Uh the policy will define whether to grant the access or to block the access

[2:35:30] or to enable the multiffactor authent or to ask for the multiffactor authentication. All right. So on depends on certain conditions whatever you define in your policy you

[2:35:42] whatever you define in your policy you either grant the access to prove the authentication using multiffactor or you block the access. Now what that condition can be that conditions can be anything like you just

[2:35:55] want to block a a particular user or a part a group of users or you want to uh block users from non-compliant device. Okay. Uh what is non-compliant device?

[2:36:08] Non-compliant device is a device which is let's say not joined to your domain or the device which is which does not belong to your company. then on on on depends on certain locations as well like uh my company let's say is based in

[2:36:24] India and if someone is trying to connect uh my application or Microsoft Azure portal from any other location let's let's say Singapore I don't want them to

[2:36:38] uh log in right so all all these are conditions so depends on you what you requirement You can take certain actions like allow You can take certain actions like allow the access or ask user to prove the

[2:36:53] authentication using multiffactor or simply block the access. All right. Now um if you're a working professional you might have noticed if you're using uh iPhone you might have noticed even in Android uh and if you're use if you have

[2:37:09] downloaded Outlook your your company's Outlook Outlook uh email within your phone uh teams within your phone you are not allowed to access it unless and until you are on

[2:37:22] the secured iOS platform. I think this is the latest one. So you might see that if you have encountered. So how do they come up with this? They use conditional access for that. Okay. So conditional access is a way depending on certain

[2:37:36] conditions you will be defining whether to provide them the access or not. Now you're not going to monitor this uh manually every now and then. What you'll access you'll be coming up with policies.

[2:37:49] You will create conditional access policies and that conditional access policies in that conditional access policies you will define if so and so user so and so group logging in from so and so device uh from certain locations

[2:38:04] allow them or deny them. So that's what you'll be defining. All right. But comes with the premium feature uh is a premium feature and if in order to use that you need to have Microsoft enter ID premium uh license.

[2:38:38] pricing, then if I want to see uh with which tier or which premium license Microsoft conditional access comes with, you can come over here and you can see that conditional access comes with P1. So in

[2:38:55] order to use conditional access, you need to have at least uh Microsoft enter ID P1. If I go back to the portal where I have logged in, what license do I I have a free license so I won't be able to use the conditional access. Now I

[2:39:09] to use the conditional access. Now I have another tenant which is uh P2. So I can go to that tenant and in that tenant

[2:39:36] this tenant where we have the P2 license. So for conditional access I can license. So for conditional access I can make use of this.

[2:40:08] have the P2 license. Now Har is asking why different tenants to be used. You don't have to use different tenant as I mentioned if uh one company should only have one tenant. In any case uh if you

[2:40:20] have multiple tenants then you need to switch between the tenants. Okay. Here you need to switch between the tenants if you are part of multiple tenants. All right. You don't need to have multiple tenant but most of the uh

[2:40:34] companies who did not follow the best practices initially when Azio was new they might be having more than one tenant. All right. But you should not be having more than one tenant unless and until

[2:40:47] you are uh you're taking over another another company. So in that case obviously you'll be having more than one tenant. you'll be having more than one tenant. So I can switch from here.

[2:41:07] So in order to use any premium uh topic I can make use of uh this tenant and premium P2 is not a free license. You have to pay. So that totally depends on your company whether they approve or not. But obviously since this is these

[2:41:21] are the security features uh your company should approve the budget and you should be able to use [snorts] uh the premium uh gear. Okay. All right. So in order to use conditional access I need to go to Microsoft Entra ID and

[2:41:36] there if I go under manage section somewhere I should have the uh security option. Uh within security if I go to protect you should see the conditional access. How does it work? Conditional

[2:41:50] access is just a policy. You need to define your own policy. What are what are the conditions that you want to evaluate and what actions you want to evaluate and what actions you want to take. The conditions are

[2:42:03] users, groups, devices and locations. The actions are allow throw multiffactor authentication challenge or block the access. Okay. If I go back to the

[2:42:15] browser where I have logged in with uh P2 uh tenant you see here conditional P2 uh tenant you see here conditional access. from from last patches. So if you see here I have a policy which

[2:42:30] says block access to Azure portal from Malaysia. In order to create a new policy you can click on new policy here and you can >> [snorts] >> Now I I already have policy. I'm I'm

[2:42:44] going to use this but let me just walk you through the uh creation uh steps. So once I click on new under the conditional access policy I click on new policy. Here are few few things that I need to provide like what is the name of

[2:42:58] allow access whatever the name should be descriptive enough so that uh anyone should be able to understand what this policy is doing. Then users whom which

[2:43:11] user you want to target. Do you want to target a specific user, all users or selected users? All right, you want you you can target all users. But remember if you are targeting your all users, this policy

[2:43:24] will impact you as well. Even if you are the administrator and you are targeting all users, this policy will lock you. If you're locking if you're defining a policy which is locking the access to a

[2:43:36] particular resource or a particular application you are locking yourself out as well if you target all users. All right. So how to avoid that thing? If you click on all all user make sure you excluding one or two users like who who

[2:43:52] are admin. So in case if you want to change the policy at least you can login. Okay. So you can add your username whatever your username is you can provide your username I don't know if I have my same account here right so

[2:44:06] I can select my account I can select so this user won't be impacted with the policy all other users will be impacted all right so I click on include uh and

[2:44:18] I'll just select a particular user I might have user 01 here okay so this user will be impacted whatever I'll be defining next. So what

[2:44:30] we are defining here block access this is the user user 01. So this policy will only impact user 01. Then target resource. Target resource is something which is the application that you want to uh

[2:44:46] select. Okay. So what we are defining this is my policy. There is a user this is the target user. So whenever this user is trying to log in or whenever this user is trying to do anything as of now we have only created policy and we

[2:44:59] have selected that user we have not defined what what condition what this doing that's that's something that we are defining here in target resource. So in target resource you are defining the condition this user is trying to login

[2:45:14] let's say a simple example for this user is trying to log into portal.azio.com azure.com this user is trying to log into portal.asure.com that's my condition so this is portal.zo.com com is my target resource. So that's

[2:45:26] what we are defining over here target resource. Okay. So what we can select in the target resource we can select the specific resources like I want to uh

[2:45:39] select all the admin portals in Microsoft all the Microsoft admin portal. So these are the these are all the Microsoft admin portals. So if you want to evaluate for this portal that means user 01 is trying to loging into

[2:45:51] this portal. So these are the target portals right? [snorts] Uh you just want portals right? [snorts] Uh you just want to target uh Microsoft 365, you want to target Azure Active Directory reporting, you want to target uh Azure perview or

[2:46:07] whatever you want to target. So you can select uh that from here. All right. Now in order to target the Azure portal we have something known as Windows API something [snorts] uh Windows Azure service management. So

[2:46:24] this is the application which is equivalent to portal.azure.com. So if I select that it says this policy impacts Azure portal. So they have changed the name into Windows Azure service management which is nothing but

[2:46:38] portal.azure.com. So what we have defined so far we have defined user 01 target resource is portal.zo.com then you can define network as well if this if this user is coming from so and

[2:46:51] so network so you can define that as well. Okay so how to define the network in order to define the network u you need to select any network or any need to select any network or any location all trusted networks. So if you

[2:47:07] have added certain IP address as trusted IP address that will fall under all trusted network. Okay. You can also select uh networks and locations like I just want to uh block from a certain location only from one country or uh two

[2:47:24] select that as well. But in order to define the networks and all we need to do that beforehand before defining the policy. So where we can do that within

[2:47:37] the conditional access policy you have one uh [snorts] option where you can define the trusted or untrusted location. So if I go over here uh go to the security go to the conditional access and here

[2:47:53] under manage you have named location. So here you can define the named locations like I define country's location depending on on exact country like I don't want to allow people or I want to allow people uh to log in from uh so and

[2:48:08] so location. So I can create country's location over here. I need to switch since I logged into uh different tenant. So I need to switch.

[2:48:34] you see named location. So here you see the option is available in in last tenant uh in my default tenant is not this option was not available because I had the free tier. Right? So here you can define your uh named location. Here

[2:48:48] I can create on the basis of countries or on the basis of IP IP ranges. So if I let's say I have a VPN, I can define click on IP ranges and provide certain IPs. Like if I click on IP ranges, I can provide IP addresses here. Like only uh

[2:49:03] this IP address should be allowed only one IP address should be allowed. So I I can mark that as a trusted location. So if traffic is coming from this and this IP that's what we are defining in the conditional access policy. [snorts]

[2:49:17] Okay I already have the name location over here. So I'm not creating a new but in in case you want to create you can create on the basis of IP ranges or in the basis of countries. Let's say you want to block traffic or allow traffic

[2:49:30] only from Afghanistan uh Alan Island, Albania, Algeria. So you select all of your location which you feel trusted or untrusted. Okay. So I can select uh Barbados, Barus. So I can select all this which I

[2:49:43] Barus. So I can select all this which I want to define as as a white list networks or or a whitelist countries or a blacklist countries from where I want to block the traffic. I can select that. So with this named location you're

[2:49:55] you're only selecting locations that's all. Okay. Once I select I can click on name. So once I provide the name I I'll get that option uh to create that particular location. that location will be created here. Similarly, I created uh

[2:50:11] a new a location in my last patch uh with the name Malaysia. Okay. So, this is named location Malaysia and here I have only selected Malaysia. So, if you see all other countries are not selected only Malaysia is selected,

[2:50:26] right? So, that is selected. So, I can use that. So, if I go back to the to the page where we were defining the policy here I can select Malaysia. Okay. Click on save. So what we have defined we have only defined the conditions as of now.

[2:50:40] We have defined the user who is our target user the resource the target target user the resource the target resource where user is uh user [snorts] will be trying to login. Then we have defined the network. All right. Then you

[2:50:53] can define the conditions. So here I can go to the conditions and here I can go to the conditions and here I can define whether I want to uh allow or or deny or whatever. Right? So I've selected the network here and then if

[2:51:05] you scroll down here you have the access control whether you want to grant the access. So you click on grant. So here you can define block access. That means you can define block access. That means if user one which we selected here is

[2:51:19] trying to log into Azure portal from Malaysia then you defining block access or grant access but ask for the multiffactor authentication right multiffactor authentication right [snorts] or grant access and ask user to

[2:51:34] change the password or grant access and ask the user to or grant access and ask the user to login from from so and so network. You compliant device that means a device which is connected to your or a device

[2:51:49] which is provided which your company has provided to the user. So that device will be marked as a compliant device. Right? So whatever you want to select you can select. So just to keep it simple I'll do a block access. Okay.

[2:52:01] Before applying the policy I want to show you that if we do not apply the policy the user 01 should be able to login. So before doing anything with the policy, let's go back to the users section

[2:52:16] users section and let's confirm that we have user 01. If you see here, we have user 01. Uh hopefully I know the password. So I copy the user 01's credential. I mean I copy the user 01's user ID. I open in private

[2:52:31] the user 01's user ID. I open in private window. Go to portal.zo.com. just want to show you uh what is the location from where this traffic is going. So if I type what is my IP

[2:52:46] address, I should know what is my location, [snorts] right? So if I if I click on what is my IP address? Oh, it's this.

[2:53:07] address, you should see the location from where this traffic is generating. If you see this Kalur, where is Kola Lampur? Colour Kalur is in Malaysia, right? You know, you guys know or know if you [snorts] see this is the

[2:53:20] if you [snorts] see this is the Malaysia. So if I if I just minimize uh or maximize, you see the name Malaysia, right? So when I'm trying to going to portal.io.com, my traffic is going from

[2:53:32] Malaysia. All right. So I copied the username, I pasted it here. Uh I need to provide the password. Hopefully I remember it.

[2:53:47] And okay, this doesn't have the MFA. Seems it has. So I need to provide the code as well.

[2:54:04] policy if you see I am able to login you see I was able to login and this is the same tenant where uh if you see the tenant name is the same tenant Azure tenant name is the same tenant Azure training premium P2 if I switch to the

[2:54:19] training premium P2 if I switch to the uh if I switch you see the same tenant Azure premium P2 so without applying the policy user can login right now let's go back to the page where we are defining the policy so we have defined user 01

[2:54:33] one target resource is Microsoft Azure portal [snorts] network is Malaysia condition is uh same uh same network selected right and the uh grant the access control is block I

[2:54:47] select block and then I enforce the policy and I click on create so new policy is being created and I'm enabling that policy report only will only report when there is such traffic it won't uh directly block of your

[2:55:03] turning of the policy that means policy is not in effect. All right. [snorts] is not in effect. All right. [snorts] There are three uh there are three options when you go to enable policy. Report only will only

[2:55:17] report when such traps such uh requests are coming in. On you are turning on the policy. Off is your policy is completely off. It's not doing anything. All right.

[2:55:29] So if I go here I should see my policy. If you remember we only provided the name as block access. So this is the policy that we just created. All right. That policy is on. The other policy which I created in last batch is is is

[2:55:44] off. All right. [snorts] So this policy is on. Now when that user is trying to log in that user should be blocked because of this policy because of the basis of certain conditions user will be allowed or blocked depending on whatever

[2:55:58] you have selected. Now obviously one thing you need to keep in mind the existing session will not be impacted only the next session when user is trying to log in that will be impacted. All right so in order to see that in

[2:56:11] All right so in order to see that in action I'll sign out after signing out I'll try to sign in again and conditional access should take again and conditional access should take effect and block this traffic.

[2:56:30] MFA. It's saying your sign-in was successful but does not meet the criteria to access this resource. What we applied in our conditional access policy, we applied if user 01 is trying to logging into portal.asure.com

[2:56:45] block the access from Malaysia. If trying to logging in from portal.asure.com from Malaysia block the access that's what is defined in my All right. But if this user tries to loging in from any other location, it

[2:57:00] should be allowed. Now I don't have uh any other location over here. Uh if I have that location, uh it should allow. All right. So now it's blocked. Now where you can implement this in real world. U tell me how many of you uses

[2:57:16] Hot Star and Indian Hot Star. Okay. In India we have Jio Hot Star, right? It was Disney Hot Star but then Jio took over. So now it's Jio host hot star. [snorts] Have you ever traveled and tried to access

[2:57:29] the hot star from outside India? Have you ever tried that? Yeah. I I stay in Malaysia and if you know IPL is going on right and IPL is broadcasted in hot star. I cannot watch it. Why? Because Indian content on Jiohostra can only be

[2:57:45] accessible from within India. So if you are in India then only you can consume the Indian content. If you're outside India, you cannot uh consume that

[2:57:57] content. So this is like a conditional access. Now I'm not saying that hostar is using Microsoft enter conditional access but they might be using similar kind of policies. All right. So that's one. Same goes with any any OTT content.

[2:58:11] Even prime video I cannot watch Indian content from here. Even uh Netflix Obviously Netflix is available here. Hot Star is available here but the only

[2:58:23] thing is I cannot consume the Indian content. All right. Now people are asking work with VPN and all. Obviously it will work with VPN. What VPN does? VPN changes your location. Right. So if I use NodeVPN or ExpressVPN and connect

[2:58:38] to any Indian server [snorts] technically I'm in India right from Malaysia. If I use NodeVPN or ExpressVPN and if I change my location connect to Indian server what will be the traffic

[2:58:51] the source traffic from where it will be generated computer only understand the source IP address destination IP address all those stuff right so if I launch NodeVPN or expressvpn and connect to India and then

[2:59:06] expressvpn and connect to India and then try to access hot star or prime video what willar uh what will the application uh sees the source as the traffic the traffic source obviously the hot star will see my source is India so India if

[2:59:22] your source is India you are allowed to watch right so that should be allowed so VPN is a technology or a network which changes your location which hides your original location so if you're connecting any uh using NVPN to any part

[2:59:38] of the world your source traffic will change to that part so if If I use source will be Australian. So my whatever I'm trying to access the target whatever I'm trying to access the target will will will identify my source as

[2:59:53] Australia, not as Malaysia. Okay. So obviously you can bypass this kind of thing using VPN and all but this is something that you can apply in your corporate corporate network. Now I just gave an example of hotstar but that's

[3:00:07] gave an example of hotstar but that's not uh like a confidential resource and all right but for your corporate network let's say you work for a finance company so for corporate network keeping uh uh keeping in compliance

[3:00:24] keeping uh uh keeping in compliance makes matter it it matters right like [snorts] I don't want my people to access my data from so and so location for this kind of scenario. I can use

[3:00:39] access from Australia. Why? Because my business doesn't I I don't have any business in Australia and I don't want my people to travel to Australia and and my people to travel to Australia and and uh during the work time and access my uh

[3:00:52] my my my resources I don't want them to do. So what I can do I can simply block from Australia. What I can do I can create another policy and only allow Malaysia you are allowed. Outside Malaysia you're not allowed. So those

[3:01:07] kind of thing you can you can uh you can do using uh conditional access. All right. Hopefully conditional access is is is cleared. [snorts] Let's move on to the next topic now. Identity protection. Uh there's no demo

[3:01:21] for identity protection but it's another premium feature that we have with Microsoft. Next topic that we have is identity protection. So what is identity feature. If I go to the plans and pricing, uh identity protection again

[3:01:37] falls under premium feature. Okay. So, if you want to use identity protection, you need premium P2. If you do not have premium P2, you won't be able to use identity protection. So,

[3:01:51] what is identity protection? Let's try to understand. As the name specifies, it has something to do with with your uh identity. It's something to do protecting your your identities. Okay. Identity protection is

[3:02:07] again a cloud-based uh premium service in Microsoft Entra ID uh which helps in Microsoft Entra ID uh which helps your identities to log in uh within your your identities to log in uh within your system uh securely. So what it does it

[3:02:21] system uh securely. So what it does it detects the risk risk detection it detects the risk risk detection it detects whether or it analyzes when when your user is trying to sign in uh uh that sign in is risky or not. All right.

[3:02:36] You can do [snorts] the risk based conditional access. If the user or the sign in is risky, we can apply the conditional access policy over there. Right? You can see the risk reports and insight. You can do

[3:02:50] the automated remediations. You can integrate identity protection with different security solutions. Now what it does in real world, it only analyzes it does in real world, it only analyzes your users for their risk.

[3:03:06] What do I mean by risk? If you have used the banking application, you might know banking application from any other location apart from your usual location, location apart from your usual location, u either they will send or or block your

[3:03:20] uh access, right? Either they will uh allow you the access by only approving or uh approving uh MFA. That means they will send a notification to your mobile app and they'll ask you to approve,

[3:03:33] uh if they detects that your traffic is coming from anonymous IP that means a IP which is already blacklisted and if your

[3:03:45] traffic is coming from that IP uh that is considered as a user at risk or the sign in that user is trying to do is risky. So identity protection is a tool is a security feature in Microsoft Enra ID which detects this uh risky behaviors

[3:04:03] involving with your identity and depending depending upon the risk uh criteria whether that risk is a low, medium or high depending on that whatever you have defined block or a law it will take that action. All right. But

[3:04:20] now unfortunately we do not have any demonstration for this since this this works automatically. Okay. So what you can do you can simply uh set up the identity protection policies like if I go back to security over here you have

[3:04:35] another tab or another blade here which says identity protection right. So when I click on it you'll see you have three different policies. different policies. If I go under protect, you have

[3:04:49] three two different policies. User risk policy, signin risk policy. All right. You have you can integrate identity protection with with conditional access. You can also register MFA from here. Now obviously MFA Microsoft has met made

[3:05:04] mandatory. So this MFA registration policy [snorts] policy [snorts] uh is by default require for every user. Okay. We we don't have to do anything for this. The user risk policy. If your

[3:05:18] user is at risk, let's say the the the password that user is using is compromised. The user become a risky user. If user is trying to logging in from anonymous IP, that means the sign in that user is trying is risky sign in.

[3:05:32] Right? So all those stuff you can define over here. Now you don't have to do here and define what users are the targeted user. If you want to select few apply to all users, you can select all users. And then the risk.

[3:05:49] And then the risk. What risk? High risk, uh medium and above risk or low risk. uh medium and above risk or low risk. Even if there is a low risk like [snorts] uh user logs in the the the regular

[3:06:02] login of user is from 9 to 5. user never logs in after 5:00 p.m. But sometimes logs in after 5:00 p.m. But sometimes let's say um so what this identity protection does it learns the pattern that user whatever the usual pattern of

[3:06:16] that user whatever the usual pattern of user is is recorded by Microsoft enter user is is recorded by Microsoft enter ID so every time user only logs in 9 to5 from this particular browser now let's say user changes the device when user is

[3:06:29] changing the device again logging into the same time 9:00 a.m. But device is see the browser is seeing. So that is detected detected as risky. Okay.

[3:06:42] Why it is risky? Because [snorts] Microsoft enter ID never saw this user coming in from this browser from a new browser. So that can be an unusual browser. So that can be an unusual location that can be an unusual uh login

[3:06:57] location that can be an unusual uh login that can be detected as as a low risk or medium risk or high risk. Sorry. [snorts] Okay. So you just have to come over here and define

[3:07:12] if you want to block or allow access even for low risk. Sorry for high risk or for medium and above risk. That's all you want to define. Okay, [snorts]

[3:07:25] that's all. Now, we cannot see the demo here since this totally works uh alongside with Microsoft threat intelligence. All right. So what they do intelligence. All right. So what they do they regularly see the threat

[3:07:39] they regularly see the threat um coming in from threat detection and whether the sign in is risky or whether the user is at risk and depends on that whatever access you have defined block access allow access. So that that thing

[3:07:53] will be considered and uh if you have blocked the access user will be blocked from logging in. If you have allowed the access, user will be allowed. All right. So that's what identity protection is. Clear. Now

[3:08:09] remember one thing uh as as the information is mentioned over here. Uh in order to work with identity protections from October 1, 2026, you need to align that with conditional access policies. So if I go back to the

[3:08:23] conditional access policy here, [snorts] you have the conditions. within that conditions you have the identity protection as well. User risk, sign in risk, right? So all this stuff are already here.

[3:08:40] All right. Clear.

[3:08:54] Clear guys. [snorts] real world we use identity protection. Every application is using identity protection. I log into Gmail from a new browser. Their identity protection is

[3:09:08] confirm that means they using multiffactor authentication right. So multiffactor authentication right. So when when they are when they are uh when they're doing or they are configuring their identity protection

[3:09:23] they're not completely blocking you. So if I go to the security and identity protection here they're not completely blocking me. So here you have the access or the block the access. But when

[3:09:36] asking user to change the password or you are asking user to uh to rec to to prove their identity using multiffactor authentication. So when we work when we

[3:09:48] log into Gmail from a new location they are doing this thing. when I'm logging from a new location Gmail obviously tracking my login activity if I'm using my regular mobile application they

[3:10:03] I'm sorry they will not trigger for MFA but when I'm using a browser within the same mobile but browser is a new session they will detect that as a unusual login

[3:10:15] unusual IP address or unusual login and then they will trigger they will ask me to confirm my identity using the multiffactor authentication that's what they're using. Okay. All right. Similar your banking applications

[3:10:30] even your u if you're working professional you might know that you need to use the company provided laptop for all of your uh outlook your teams.

[3:10:43] If you're using shareepoint you need to use that right. If you're using your own laptop try try using your own laptop. you'll get an get a call from your cyber right? Cuz they're tracking it.

[3:10:58] everything automated. So you can use user risk policy or sign in risk policy and define here what you require. You want to entirely block access, just access and ask user to provide multiffactor authentication, you use

[3:11:12] that. All right. Now, just for simplicity, I I'll disable it. I don't want any of my user to get impacted with this. So, I'm I'm disabling it, but if you [snorts] enable it, it should uh work behind the scenes. All right.

[3:11:36] All right. Next topic that we have is access review. What is access reviews? So, next topic that we have is managed identities. So, what is managed identities? So far whatever we have discussed what were

[3:11:52] mostly related to the user or group based identities. So you have user and he wants he or she wants access to the resources. So you create their user account and provide them the access. Okay. Now in case an application

[3:12:08] Okay. Now in case an application requires an access tell me how an application is going to access the resources.

[3:12:22] user how how do you authenticate yourself? You provide your username and [snorts] So your identities is created within any IM solution. Your identities get created and that IM solution authenticates you

[3:12:39] on the basis of your username and password or whatever identity uh mechanism you're using MFA and all. But in case any application requires an application is going to be authenticated that means whatever IM service you are

[3:12:52] using that IM service should be authenticating the application and then providing the access we are not going to provide access to our backend services provide access to our backend services like SQL or storage direct access to any

[3:13:05] of the application right we need to authenticate that application so what could be the way SSO is not the way MFA is not the way uh The way is one of the way that we have in Azure is managed identities.

[3:13:21] So what does manage identities do? It creates an object ID for your application and then you can use that object ID to provide access to the backend services like storage or or SQL or what you want. All right. Now if I go

[3:13:37] to the portal whatever user we have created. If I go to Microsoft enter ID created. If I go to Microsoft enter ID and if I go to the users, if you see here, let's say I I I I pick up any random user fabric admin. If you

[3:13:53] see this, this user is having an object ID. What is this object ID? This object ID is the reference or the identification for this particular user identification for this particular user within my tenant within my entra ID.

[3:14:08] Okay. So this object ID is the identification identifier for this particular user. So when this user is trying to logging in as a user what it will be providing this user will be providing the username but

[3:14:23] user will be providing the username but the IM service will identify this user with this object ID. [snorts] Okay. So similarly when an application requires an access we need to register an object ID for that application. So where

[3:14:38] application is hosted? If you remember from yesterday's class, yesterday's discussion, uh application is nothing but some files, right? People will develop the code, will write the code, that code is written in one of the file

[3:14:51] or or uh multiple files and that that files is stored somewhere in one of the server. So this is my server in in on top of this server I am hosting in in on top of this server I am hosting my application. Now this application

[3:15:05] requires access to the backend services like database like storage. But before providing the access I need to authenticate this application. So how to authenticate this application? So if this application is hosted on Azure

[3:15:19] this application is hosted on Azure virtual machine or Azure app service or Azure or any uh service any compute service Azure any compute service of Azure then you can create manage identity for that service and that

[3:15:35] manage identity registers an object ID for your application. That means in simple term a user gets a user ID gets created for your application and when you create the user ID then it

[3:15:51] becomes quite easy to provide access to the resources to the required resources. Okay guys is the screen visible? I see that Babata is saying screen is most visible. What do you mean by most visible

[3:16:07] What do you mean by most visible guys? Am I audible? Uh screen visible. connection. Please rejoin. [snorts]

[3:16:23] It's visible for everyone, not visible to you only. an access for real world scenario, you have this application. This

[3:16:35] lms.simplearn.com simply.com is an application right when I go to continue application right when I go to continue learning

[3:16:48] should see your live classes here but when I go to the past classes so it's when I go to the past classes so it's not this one let me show you with a 104 not this one let me show you with a 104 if I go to a 104 when I go to the live

[3:17:06] You see this recording thing? Now this is my application. ls.simplearn.com is my application. Now tell me [snorts] do we keep the assets like videos and images within

[3:17:21] the same server where our application is hosted. separate our front end with our back end. Front end is something that user

[3:17:34] see you lms.implearn.com you can login and you can see you can interact with our application but if you want to access any backend service like the storage like we have files whenever I upload file that file

[3:17:48] will be visible here right if I click here I should I should be able to see the files that have been uploaded right so this application lms.simplearn.com simply.com is hosted on a compute service like virtual machine. So

[3:18:02] lms.simplearn.com will be hosted here. But the actual video, the recording of the live class is not stored on the same virtual machine. We don't store it here. Imagine we have running 10 classes

[3:18:16] parallelly every weekend. If we keep on saving all the videos in the same virtual machine, imagine how much storage we would require. machine. So what do we do? We separate

[3:18:28] this with our back end. So we might be using storage service, storage account. So here we will have our videos. This recording that you see over here that recording that you see over here that will be stored in the storage service.

[3:18:43] needs to access that video. When someone clicks on this video, obviously the play that video. So when any user is clicking on this

[3:18:55] video the application will play that video but in order to play application itself needs an access to the storage account. Storage is a separate service. The compute is a separate service. So when application is trying to access the

[3:19:09] storage. Now tell me whether storage will do the authentication and authorization or not. Storage is the service in Azure. So Microsoft enter ID will first authenticate this lms. com whether the

[3:19:24] whether the object ID is present or not the username password provided by this application is correct or not so all those thing will be checked and if it's correct then it will see whether this application is

[3:19:38] authorized to see or run or play this video or not. So for user it's quite easy we create the user user gets username and password but what about application? So application you can create credentials

[3:19:53] for your application in Azure by using manage identities. All right. So manage identity is the way to create an identity for your application. Okay. Does I just give you an example of

[3:20:09] uh I I just give you an example of lms.simplearn.com. You can take any example. Every application works in the same way. most popular video streaming service YouTube. So YouTube what you see

[3:20:23] is the front end youtube.com you see all the videos and all everything. When you application is communicating with their backend service wherever they are storing the video and that backend service is responsible

[3:20:37] for storing the video. It could be a storage service any storage service that Google is using, YouTube is using. All right. So in order to provide the identity to your application within Azure you can use manage identities. Now

[3:20:50] identity system assigned and user assigned. In order to understand system assign manage identity and user assign manage identity you need to answer me a question where uh the difference between user and

[3:21:05] group. What is the difference between user and group? user and group? [snorts]

[3:21:17] Debra, I would ask you to check your connection please. You need to uh turn off and and rejoin. You should be able to see the screen. Okay.

[3:21:37] users. So if you have multiple users, you create a group and you put all the users within the group. So system assign and user assign is is the is is based on the similar concept. System assigned is an individual identity for one

[3:21:51] application. So when you use system assign, one object ID will be created and that object ID will be assigned to only one uh application. Whereas when you create user assigned

[3:22:05] manage identity that user assigned manage identity is shared across multiple applications. So if you have let's say 10 applications and all these

[3:22:17] 10 applications require similar kind of access. So instead of creating 10 different system assign identity, you create one user assigned manage identity and then you assign that user assign manage identity to all other VMs or app

[3:22:31] service or whatever. Okay. So it's similar to group and individual user. System assign consider it as an individual user. So you create when you create system assign manage identity a single object ID is created

[3:22:45] and is associated with only one application. Whereas user assigned manage identity is like a shared manage identity which can like a shared manage identity which can be shared with multiple applications. So

[3:22:58] if I have five applications which require similar kind of access, I'll create one user assigned manage identity, I'll associate that one user assigned manage identity with five different applications and then all that

[3:23:10] five different application will have similar access. Okay, that's the difference. Now where this manage identity we can see now we don't have any VMs or all but I have existing VMs. So if I search for the VMs

[3:23:22] it's not only for VMs it's can be for any compute service. So if I have app any compute service. So if I have app service we will have a separate topic uh module on compute service where you'll get an introduction to all compute

[3:23:35] services. So whichever compute service you are using every compute service has a manage identity feature. Okay. So let's say uh this is my uh Linux VM let's say uh this is my uh Linux VM OpenVPN 2 and this Linux VM needs access

[3:23:49] to the backend service. So what I can do I can create a manage identity for this. If I go to the security there I should see identity and within that identity we have system assigned or user assigned. So if I select system assigned then that

[3:24:05] would be an individual identity for this VM only. Okay. So I click on on and then I click on save. So it will create a manage identity for this particular manage identity for this particular virtual machine. That manage identity is

[3:24:19] not shared across multiple virtual machines. Okay. So as soon as I click on on it should once it is done it should create the manage identity. So you see an object ID is created. Right. Now you can use this object ID to assign

[3:24:34] whatever role you want. Like this virtual machine needs an access to storage. So you can use this object ID and assigned access to the storage. Okay, I don't need it. So I click I I turn it

[3:24:47] off. Okay, let's wait.

[3:25:08] identity. Once this is done, I'll go to that tab. it on, it creates an object ID for that particular uh instance for this virtual

[3:25:24] machine. when you turn it off, it dregistered the same object ID from enterra ID. Okay, that's what's happening behind the scenes. Now, if you happening behind the scenes. Now, if you want to use user assign, uh I need to

[3:25:37] want to use user assign, uh I need to wait until uh it won't it won't disable. wait until uh it won't it won't disable. [snorts]

[3:26:06] It's taking a lot of time for re-registering. object ID? Okay, where do you use this object ID? If I go to uh portal.asio.com

[3:26:20] object ID? If I go to uh portal.asio.com azio.com user every group all of them are having the user ID

[3:26:54] we If I go to Microsoft Entra ID, if I if I select any user, we use this object ID? As I mentioned when before starting the manage identity

[3:27:07] that every identity within your Microsoft Entra IM solution has this object ID. When this object ID is used when this user is trying to log into any Microsoft service like portal.asure.com, azure.com

[3:27:21] azure.com the IM service is identifying this user as this object ID we are not directly using this object we as a user we are not directly using this object ID if I ask you to remember this

[3:27:35] object ID will you be able to remember the object ID let's say you are this user fabric admin obviously you won't be able to remember this right for you for us as a human being it's easy to remember the the names fabric admin at

[3:27:49] whatever my domain name is. So I can remember that. So for for me I will be providing fabric admin at whatever my domain name is. I'll be providing that and then I'll be logging in. But for IM service how that IM server service will

[3:28:05] identify this user IM service will see this object ID. So behind the scenes when we are when the data is being sent or or received by the IM service they will be using this object object ids. Okay. So when I registered when I

[3:28:20] created an system assign object system assign manage identity an object ID got created it got registered in the Microsoft entra ID as mentioned here. Okay. So Microsoft entra ID will identify the openVPN2 virtual machine as

[3:28:36] that whatever object ID was created. So when you use system assign manage identity it's an individual identity for that particular virtual machine. When you use user assign you will have uh you can use that user assign manage identity

[3:28:53] to share across multiple resources across multiple uh virtual machines. across multiple uh virtual machines. Okay.

[3:29:05] assigned manage identity. So I need to first create it. So if I search for manage identity on top I should see manage identities and there I can create manage identities and there I can create the user assigned manage identity. Okay.

[3:29:45] Once this identity is created, multiple VMs can share it.

[3:30:05] to the resources. So I go back to the virtual machine. I go back to the identity. Hopefully I can use it since I created it in central India and my VM is in different region.

[3:30:31] Since my VM is in different region, it's somewhere in US, South Central US and identity was created in central India. I am not able to see that identity. Okay. So in order to use the user assigned manage identity, I need to make

[3:30:44] sure that user assigned manage identity is created in the same region. All right. I cannot see it because it's in different region. If I go back to user uh if I go back to manage identities, I see this shared user

[3:30:59] manage identity created in central India. That's why I cannot use it. Okay. If I create it in another manage identity somewhere in

[3:31:25] So both the identities and the resource who wants to use the identity should be who wants to use the identity should be in the same region. [snorts]

[3:31:44] back to identity. Click on user assign. Give it some time. I should be able to see. Just wait for some time. You should be able to see. Okay. If you're not able to see, just give it some time.

[3:32:10] see that we should be able to see it. Okay, it's it's not showing it takes some time. If we did not receive any error while creating the manage identity and and we are not seeing it, just give it some time. [snorts]

[3:32:23] it some time. [snorts] Okay. Or better we go to the uh identity Okay. Or better we go to the uh identity and check the type of identity this is.

[3:32:43] after 10 minutes we'll come back and see. We should be able to see that user assign manage identity and we will be able to assign it to the uh OVM South central US identity is also in South Central US.

[3:33:20] the identities now, right? So I can select this shared user 02 which we created in the same region. I click on add. And once I click on add, this OpenVPN will have that identity with that object ID. Similarly, I can go to

[3:33:34] that object ID. Similarly, I can go to another VM in the same region and I can add that as a user identity for that VM. Okay.

[3:33:56] this, let's me go back to very basic. Tell me what is authentication? Have you understood what authentication is? There are users who wants to login. Why? Why do you want users to log in? I want user to login to make sure that the

[3:34:11] user who he is claiming to be is the same user. So I need to verify. So in order to verify I have an IM solution. I need some kind of IM solution in place. Right? Have you understood that basic?

[3:34:27] So in order to assign access to the users I need IM solution in place. Before assigning access I need to create an user ID for access I need to create an user ID for that user. Is that clear?

[3:34:47] explaining manage identity I went to the lms.simplearn.com. lms.simplearn.com. I showed you the uh where it is. Okay, I showed you this. Okay, so what is lms.simplearn.com?

[3:35:00] Hopefully you you you know this is an application. Okay, it's a web application since you're accessing it via web. It's a web application, not a desktop application, not a mobile application. It's an

[3:35:12] application. Now when it comes to application, you design application in different tiers. You have front end. Front end is something that your user, your end user sees. You have back end. Back end is

[3:35:26] front end because we don't want our users to get the direct access to the back end otherwise you'll be able to download the video and you'll be able to spread the video right imagine Netflix is giving you access to the back end

[3:35:39] what we can do we can download that movie and then we can share it on torrent and all that is known as piracy similarly we want to protect our assets right so what do we do we separate front end everyone every application has this

[3:35:53] concept back end and front front end. So front end is something uh which is accessible to the user and user end user and user sees application in that form. Now when you are separating these layers front end and back end

[3:36:07] can your front end your lms.simplearn.com directly access the back end without authentication or authorization. Is that safe? Obviously not safe. Why it's not safe?

[3:36:19] Front end is also ours. Back end is also ours. So when front end wants to access back end why can't we give the direct access without doing the authentication authorization. Why we are not doing this? Because when

[3:36:33] Why we are not doing this? Because when as a end user you click on this this as a end user you click on this this video link a new uh a new uh browser will be open and your video will be played there. So if someone some hacker

[3:36:46] is listening to your traffic and if you do not have any authentication or or or anything that hacker can uh track or can can hack the hacker can uh track or can can hack the session and can get into our back end

[3:36:59] can download all the videos that we have. So for that reason we want authentication and authorization between front end and back end as well. But this this application? Application is not a user. So when it's not a user, it

[3:37:13] doesn't have the username and password. So how do I authenticate this guy? This application, this application is hosted somewhere, right? Might be hosted on virtual machine, might be hosted on app service or

[3:37:26] container wherever it is hosted somewhere. So if it is hosted somewhere that virtual machine I can provide access uh I can provide identity to that virtual machine. So in Azure we have this managed

[3:37:40] identity concept. You can create a manage identity for your virtual machine where your application is hosted. Once I create the manage identity

[3:37:52] that object ID gets registered to the entra id. Why it's registered to the entra ID? How entra ID is going to identify a particular object? So in Microsoft entra ID we uh they create the they create something known as object ID

[3:38:07] they create something known as object ID like in Windows you have uh SID in Linux you have some different identifier. So in every platform you have an identifier. Object ID is nothing but an identifier. How enter ID is going to

[3:38:20] recognize or verify or identify that particular identity. Identity is nothing but a an object which requires an an access. So in Azure we have something known as managed identity. So when I create the

[3:38:34] manage identity an object gets registered. So as soon as I created the manage identity shared user 02 an object gets registered within my uh entra ID.

[3:38:46] Obviously I won't be able to see it here but when you are trying to assign the access since it's not an since it's not a user I won't be able to see it under users. You won't be able to see it here since

[3:38:58] we are under user section. Okay, there's no separate section for application where you can see the object ID. But object ID is a way how entra ID is recognizing or verifying or identifying that particular ID.

[3:39:14] When you create manage identity, there are two ways. So let's consider this. OpenVP VPN2 is a virtual machine where my lms.implearn.com is hosted.

[3:39:28] my back end because application is hosted on this virtual machine and that application requires access to the back end. So how do I provide the access? So in order to provide the access one way that we have

[3:39:40] within Azure is manage identity. So when I create the manage identity an object ID gets created for that particular man for for that particular virtual machine. when it's created. Let's say now I want to assign an access to the storage. This

[3:39:55] application requires an access to the storage account. So I go here, assignment and I provide whatever role is required like reading. So if if it

[3:40:09] requires a reader role, I select reader role and then I select manage identity. I select that object ID that that got created. So this is the user assigned manage identity that we have. This is the one that we assigned to OpenVPN 2.

[3:40:22] Click on select. Now OpenVPN 22. Once I click on review and assign, OpenVPN 2 will have access to the storage. And when application request the access, this object ID, this manage identity will be used for authentication and

[3:40:36] authorization. Hopefully it's cleared now. Clear for you. You just need to remember if you want the manage if you want the access for if your application wants the access to the back end and if your application

[3:40:51] is hosted on Azure you can use manage identity. Okay, is it clear hurry? Yeah, it's similar to service account but it's not service account. Service account is a windowsbased uh solution. Okay. To the

[3:41:04] similar thing, right? That's a similar similar concept.

[3:41:19] Now, manage identity the limitation is you can only use when it's if if when your application is hosted on Azure. If your application is hosted outside Azure, then you cannot use manage identity. If my application is hosted on

[3:41:34] identity. If my application is hosted on AWS or onprem AWS or onprem or uh GCP not in Azure any anywhere outside Azure then manage identity is not the solution for you. Why? Because

[3:41:46] managed identity as the name specifies it's managed within Azure for you. Okay. In that case if your application is hosted outside Azure you cannot use manage identity. Then what we can use? So we can use something known as service

[3:42:00] principle. Service principle similar concept the only difference is your application is hosted outside Azure. So if your application is hosted outside

[3:42:12] Azure you cannot use manage identity. You need to use service principle. Okay. Concept is similar application requires an access to backend services like

[3:42:24] storage account and SQL. Your back end is still within Azure. You are using Azure storage service. you're using DB SQL DB in Azure but your application itself the front end is hosted somewhere else for any reason. So if that's the

[3:42:39] case then I'll be using service principle. Okay, in this case I'll be using service principle. Service principle will also create an object ID principle will also create an object ID within that entra uh ID and then you can

[3:42:52] use that object ID to assign whatever access is required. The only difference between manage identity and service principle is outside Azure you'll be using service principle. Where do you see service

[3:43:06] principle. Where do you see service principle? Same. If you go to enterra ID there you have app registration. Okay. So you register your application Okay. So you register your application here. Uh this name can be anything.

[3:43:23] random name. All right. And then once I click on register, an object will be created. So you see object ID see an object got created for this as well. Now I can use the same object to assign whatever access I want. Okay. So I can

[3:43:38] go again go back to the storage. I can click on uh access control IM. I can click on add add ro assignment. Now instead of manage identity I'll select here service principle. Okay. You see the first option it says user group or

[3:43:54] service principle. So I I I use the first option and then I search for the name that I use dubdubdub.simplylearn.com. So now this object ID will have access the reader access to whatever service

[3:44:07] the reader access to whatever service I'm providing. Okay. All right. I don't need it. So I'll I'll delete it or maybe later I'll delete it. Let's let's proceed. Okay. All right. The next thing then

[3:44:21] last topic that we have for today not for today I mean this topic is this for today I mean this topic is this module is Azure key wault. So Azure key module is Azure key wault. So Azure key wault is a is a service is a storage

[3:44:33] wault is a is a service is a storage service for storing your secrets keys and certificates. Okay. What are the secrets keys and certificates?

[3:44:45] Secrets are like password. So if you want to store password or config uh want to store password or config uh connection strings or keys uh within as your key uh somewhere then you can make use of Azure key wault. So it helps you

[3:45:00] to store password secretly. It helps you to store keys secretly. It helps you to store certificates secretly. Now [snorts] why do we need to keep secret keys and certificate within Azure keyword? Why why can't we keep it within

[3:45:15] [snorts] the application itself? What could be the reason? Now, in order to could be the reason? Now, in order to explain that, I need to go to my uh explain that, I need to go to my uh GitHub. Okay.

[3:45:37] all, answer me. Do you guys know what GitHub is? Since we have like 40 50% of people who are freshers, do you know what GitHub is? what GitHub is? [snorts]

[3:45:55] GitHub as a central place where your developers will be pushing code. Code is nothing but your application code. Okay, it's a repository or a place where your developers will be pushing the

[3:46:12] code, that code is your application code. All right. So if you see here, this is my uh GitHub and if I go to uh

[3:46:24] the application and if I go to the application app. py and if I go to the application app. py you see here in my code itself I have placed the connection string storage connection string now we are going to

[3:46:37] use this application uh letter when we are on on this particular topic okay but for for simplicity just to help you understand what keywalt is and where you understand what keywalt is and where you use keywalt storage uh uh uh GitHub is a

[3:46:52] so this is one of my application written in Python now this application needs to interact with Azure storage account. How do I uh gain access to the Azure storage account? So, one way is to keep the

[3:47:07] storage connection string here. Connection string is a way uh is an is a is like a password for your application to access whatever you have within the storage. So, if I provide the connection string over here, then my application

[3:47:22] app. py can access storage account directly. You don't need service principle. If you keep connection string directly here,

[3:47:34] you can access directly. Doesn't matter where your application is hosted. So, connection string is like a password for the storage account. Okay. [snorts] Similarly, there are a lot of services like service bus, event

[3:47:46] lot of services like service bus, event hub. Now, tell me is it safe to keep the connection string within the code and push it to the GitHub? Is it is it safe? If I just give you this link, try accessing this link. Can

[3:48:00] this link, try accessing this link. Can you see? Can you uh see the link? Let me just provide you the link. You don't need to login. Nothing. Just just don't need to login. Nothing. Just just launch that link.

[3:48:16] this link, I'm not logging with any any credential or anything. But I can see whatever whatever we have here. So if I put connection string over here and if this link uh since this is public anyone can access like you guys are accessing.

[3:48:31] So if I keep my connection string over here you know my connection string then so if you know my connection string what you can do you can add anything to my storage account remove anything from my storage account

[3:48:45] delete my storage account. So is this safe? Keeping storage connection string safe? Keeping storage connection string here. Is this safe? Are you going to ask your developer to push the secrets directly within the

[3:48:58] push the secrets directly within the GitHub? Obviously, it's not safe, right? So, what we do, we store or save this connection string in Azure keyword this connection string in Azure keyword as a secret. So, Azure key is a way to

[3:49:11] to keep your connection string your password as a secret within Azure key. So now instead of accessing the storage account directly,

[3:49:25] account directly, I have another application over here. Who is the application? Oh, I didn't push the application I think.

[3:49:43] Okay. Uh uh okay, it's here. So I have another application here. Program.json here. If you see this application is not written in Python. It's written in C car C car C car C car C car C sharp. Okay. Now here if you see we are not

[3:49:57] adding the connection string. If you know how uh how C# works or hown net works it's very simple. Okay. What it is doing it is connecting to the key wault. It is connecting to the storage account.

[3:50:11] having some container. So it's connecting to that container and then it connecting to that container and then it is getting the secret from the Azure key vault. Okay, we are not adding the the key directly here

[3:50:27] in the code itself. Do you see connection string here or or uh uh secret here or or or a key here? What we are doing? We are declaring a variable. that variable is reading the

[3:50:41] variable. that variable is reading the secret value from the Azure keyword. Okay. So instead of keeping everything within the uh code itself, we separate it. We secure it by putting all of our keys,

[3:50:57] secrets and certificates within your keyword. keyword. All right. Any questions on keyword?

[3:51:12] not not today uh tomorrow during your free time just go to this uh repository go to day one authentication and authorization

[3:51:25] authorization and within day one I have readme file inside the day one folder I have readme file just follow whatever is mentioned here [snorts] everything is given to you step by step even application is created

[3:51:40] Okay, just follow this step by step and you'll understand where your your key you'll understand where your your key how how key wault works. Okay, so it's very simple demonstration that you can do on your own. You don't need me. Okay,

[3:51:55] but I I have created this uh I have developed this application. It's a very simple application which is demonstrating you how uh you can interact how your application can interact with as your keyword. Okay.

[3:52:11] can interact with as your keyword. Okay. Uh if you see we have the templates here parameter.json template.json. So how to deploy that is mentioned in the readme should know you should already know

[3:52:24] that. If you don't know the command is given over here deploy infrastructure. Okay. Then assign permission. So you you you can assign permission by going to you can assign permission by going to this. All right. And then uh you can

[3:52:37] this. All right. And then uh you can also see the keys by by this command a storage account keys list. Now where to run this command? That's why it was as your portal. You can run all this

[3:52:50] command here. You don't need to install anything on your machine. Okay? You choose bash or powershell whatever you want. Select that bash of PowerShell and run your command. Now this here I don't have the subscript uh here I don't have

[3:53:04] the subscription that why it gave me that error. [snorts] Okay, select run that command. Do not run it on your local machine since it's possible you local machine since it's possible you might not have uh things installed in

[3:53:17] your local machine. So it's better to run directly within the cloud shell. All right. And you might uh get some issues. You might uh get some issues like something is not installed. Right? If you if you go to the readme file, you

[3:53:33] should see none not this one. A lot of tabs are open. Let me close it up. If you go to this readme file, uh

[3:53:46] I have mentioned net run. So net run is application locally. But you don't need to do this since netr run might not run to do this since netr run might not run directly on your cloud shell. So you can

[3:54:00] skip step number six. You can follow step number seven. Okay. This is for local. So if you have net installed locally in your machine then only this this particular command will run. All right. So that's all about

[3:54:13] authentication and authorization. These are changed frequently. That's correct. You have to change keys every now and then. That's why you need to keep that in the keyword. So once the keys are changing, you need to go to the

[3:54:25] key wault and change the key manually. Okay? Or you can use PowerShell or Python scripts to change the key as soon as you are changing it in your storage account or database or wherever. Okay.

[3:54:40] All right. So there are no questions. Let's see the case study.

[3:54:53] authentication and authorization solutions. So just go to this link read solutions. So just go to this link read the case study. Kash is asking how do we manage certificate expiry? What what do you

[3:55:08] mean by manage? If certificate [snorts] is expired you replace the certificate in the key world. That's all. What what what's there to manage? I need to buy the certificate first. Right? If uh if my HTTPS

[3:55:21] SSL certificate is expiring, I need to get a new one from the provider and I need to add it to the keyword. That's all the new one.

[3:55:37] going to do? They're going to buy a new one and then they install on their web server the new one. That's all. Similarly, if you're keeping your certificates in key walt if certificates are expiring, you need to remove the old

[3:55:51] are expiring, you need to remove the old certificate, add new certificates. certificates. Key volt is not giving you some kind of automation where you can

[3:56:06] automatically rotate the keys or automatically change the certificates. your scripts or your PowerShell scripts or Python scripts or whatever scripting language you're using or scripting method you're using.

[3:56:19] It's just a place. It's just a storage service to keep your things secretly. service to keep your things secretly. So instead of keeping everything on on the code itself, you're keeping it in in in keyword. That's all. Okay. All right

[3:56:35] in keyword. That's all. Okay. All right guys. So uh keywalt is just a place to store the data. It does not have any additional

[3:56:48] way to remind you or send you an email about the expiry. No, it won't do that. For that, you still need to rely on monitoring system or your scripts. Okay? So, if you have a PowerShell knowledge, you can create a PowerShell script. will

[3:57:03] which will check the expiry date of all the assets of all the secrets or all all the keys that you have here. You can run that PowerShell script and that PowerShell script will send an email or however you want to notify

[3:57:19] uh will notify the stakeholders that this certificate is going to expire or or or things like that. For that you still need to rely on something. Okay, it's just the storage service that's all.

[3:57:32] all. >> [snorts] >> All right guys, case study. Let's come back to the case study. So I have shared the link of case study. So let's uh get through it. Design authentication and

[3:57:46] authorization solution. So this is the requirement. So we have a fictitious uh requirement. So we have a fictitious uh company Tailwind traders who wants to expand their workforce. They have successfully acquired an online retailer

[3:57:59] in sports apparel space. The company has also located a partner to outsource marketing literature. Tailwind traders is using Enra ID for user and groups accounts. Here are two specific initiatives the IT department would like

[3:58:13] initiatives the IT department would like to would like your help uh with. So you to would like your help uh with. So you they are having new user accounts. The online retailer acquisition will add 75 employees to the Tailwind traders.

[3:58:26] All the new users have on-prem account in the retailer's existing domain. Okay. So, what do you understand by this? What service are you going to use? The online retailer acquisition. That means Tailwind traders

[3:58:40] uh is acquiring online retailer and they already have active directory domain services. The online retailer already have active directory domain services and 75 user accounts there. [snorts] So how are you going to bring that 75

[3:58:55] users to Microsoft entry ID? What service you can use? Entra ID connect. That's correct. So here I'll be using Enra ID connect and I'll be bringing those or synchronizing those 75 users with my Entra ID. All right.

[3:59:11] The new marketing partner. So they're all they're also uh acquiring the marketing partner. So the new marketing partner will initially have 15 employees who will need corporate access. So these employees

[3:59:26] already have Microsoft Entra identities in the partner Microsoft Entra tenant. So what service or feature we can use? So it's like you have two tenants marketing partner and your own tenant

[3:59:41] Tailwind traders. So here we can use B2B since these are our partner and we want to uh collaborate with them right so we just use B2B here

[3:59:53] then the new employees are located at various geographic location and we'll need account privileges for their new job roles some changes to the existing job roles some changes to the existing employees roles are expected geographic

[4:00:05] locations [snorts] what what do you think over [snorts] what what do you think over here what services you can use conditional access and identity protection. Right? These two services we

[4:00:18] can use here to make sure that whatever identities are are logging in [snorts] uh are protected. Right? So conditional geographic locations from where the access is required. Okay.

[4:00:33] The IT department wants to take this opportunity to include new identity security features. So whatever features we have learned conditional access, identity protection, access reviews, you can implement all those stuff. They

[4:00:47] haven't mentioned which one to use or haven't defined which one to use. They have mentioned all the new features. So you can implement all. Okay. Then the next thing is new application access. So application also requires some kind of

[4:01:02] access. So the business development team has an application running on Azure virtual machine and [snorts] data stored in Azure SQL database. They need to in Azure SQL database. They need to securely allow the VM to query the Azure

[4:01:15] SQL database. How how you can achieve that? [snorts] hosted on Azure VM database is stored in Azure SQL database. Now this VM should

[4:01:29] be securely able to query the SQL database. So what we can use we can assign manage identity to this Azure VM and provide access to the Azure SQL database. Then whenever query is running the Azure SQL database will identify the

[4:01:44] you using the manage identity and if access is granted or not. Okay. So here we can use manage identity. They also need an on-prem server to be able to securely access SQL database without storing credentials in the application

[4:02:00] code or configuration file. It's an on-prem server. Here you can use service on-prem server. Here you can use service principle and you can use Azure keyword principle and you can use Azure keyword to store the SQL database uh connection

[4:02:14] string within Azure keyword and then on-prem server can access SQL database by reading the credentials from Azure keyword. So here we need to use service keyword. So here we need to use service principle plus Azure keyword. All right.

[4:02:27] Why service principle? Because the server where application is hosted is on prem. It's not on Azure. If the server would have been on would have been on in it would have been easy just simply use manage identity, right? But it's not on

[4:02:41] Azure. All right. Then these are the tasks. So we have already covered whatever uh we need to discuss. But these are the tasks for you guys. So you need to diagram the process. Okay. Like what you need to

[4:02:54] diagram use the same tool that I'm using draw io. If you just search for draw io, it If you just search for draw io, it should uh take you to the draw io

[4:03:06] website. So this is the tool that I'm using. All right. Now here uh we have using. All right. Now here uh we have the shapes. So if you add more shapes, we have azure here somewhere. We should see azure.

[4:03:22] All right. Now you need to diagram the diagram whatever you want to diagram the process of bringing in the acquired user accounts. So 75 user accounts were acquired. Okay. So what I do here then I go to Azure identity. So this is Azure

[4:03:38] identity. Here you should see active directory. Now uh Microsoft enter ID icon is still not there. So you can use uh active directory. This one this is like a Microsoft enter. The previous name was

[4:03:52] as your active directory, right? We can add a text here. If I want to add a text, I can add text like this is the Tailwind traders

[4:04:07] font and all from here. So just so that uh you can read it

[4:04:19] Telvin traders tenant. They're acquiring 75 uh users. So they are running on ADDS. So you can search for ads here or domain So you can search for ads here or domain services. So it would give you uh

[4:04:35] services. So it would give you uh some server image. the on-prem active directory domain services for the online retailer. Right.

[4:04:48] services for the online retailer. Right. So you can just label it.

[4:05:04] what you what you can do here? You can simply use arrows and all. So I just use uh arrows here. I uh pull the arrow and then I search for entra connect.

[4:05:20] So somewhere you should see the entra id connect. Again within the identity you should see the entra id connect. Okay. So this is entra ID connect. So I keep it over here. And then again I label it 75 users by keeping text a little low.

[4:05:42] are synchronized something like that. Okay. So you need to come up with this this kind of uh uh design since this is what Microsoft expects you guys to to do to design things. Okay. We can't do that uh within class. Okay. Since I need to

[4:05:58] cover the theory and then uh certain demos. So case study is something I leave. We will discuss the case study but this design thing is on you. All right. So you can use this app.dagramgram.net

[4:06:13] add Azure as a shape and you'll get all the Azure shapes. Okay. Then you have marketing retailer. So you can uh retail marketing partner. So they're also using Azure active directory or

[4:06:30] Microsoft enter. So you can copy the same and you can label is at marketing partner and between the partner and Tailwind traders. What you can do is

[4:06:45] Tailwind traders you can create like an arrow and you can use as your active directory B2B. If you search for B2B if we have any B2B uh icon you can directly

[4:06:57] use that but I don't think so we have B2B icon. Okay, B2C is there. B2B is not there. So, you cannot use any uh item. But you can simply add a label there. B2B 15 members. Okay. So, I want something like

[4:07:13] this. Once you are done, you can share it with me over my email. So, I'm sharing my email ID here.

[4:07:25] the reply over the email. [snorts] Clear guys? Is it uh are you clear how to do the case study? We have only covered authentication and authorization. I was planning to complete the

[4:07:39] governance as well but uh doesn't matter since since this is the first weekend. uh we need to buckle up and and speed up the the things here. So this is the link

[4:07:57] the the things here. So this is the link sur.

[4:08:09] >> Yes. Pankage. >> Yeah. Then in related to manage identity >> Yeah. Then in related to manage identity >> and you go to the VM option. Okay. where >> and you go to the VM option. Okay. where you created the object ID first first of

[4:08:22] thing and after that you go to the manage identity where you created the another object ID. >> Okay. >> Yeah. I'm unable to correlate that because in the when you open VM uh open

[4:08:38] VM uh VPN02 you created an object ID and after that you go to the MA identity and also you created the an object ID and go to you

[4:08:51] go to the storage and you manage the uh attach the object ID from the manage I'm understood the concept of manage identity. >> Okay. Can can you answer what manage

[4:09:07] identity is? >> Manage identity is the ID which is generated to authenticate between the two resources to talk and exchange the >> Okay. Right. How many types of manage identity we have?

[4:09:22] System assigned and user assigned. >> Correct. Okay. What is the difference? >> Correct. Okay. What is the difference? System assign is is based on the single

[4:09:34] single type user and user assign is based on the multiple type users. Correct. Suppose that we have some >> Okay. Uh system assign is like for >> Yes. Yes. >> So it's an individual identity. So if I

[4:09:49] create system assign uh this VM will get an object ID and that object ID will belong to this VM only single individual. Okay. When I create user

[4:10:01] aside manage identity I can share that manage identity across multiple VMs. So I have 10 VMs. All those 10 VMs requires the same access. So what I can do instead of creating individual identity I create one user assigned manage

[4:10:17] identity and assign them to all. >> Okay. For individual system assigned manage identity. You can create it from the we uh from the resource itself. That mean I can go to virtual machine. I can

[4:10:30] go to identity and then I can create the system assign manage identity. If I click on on here and save system assign manage identity will be created which is which will be associated with openvpn02 only.

[4:10:46] >> Okay. If I want to create the user assigned manage identity I cannot create it from within the resource itself. >> I cannot create user assigned from here. So what I need to do I need to search for manage identities.

[4:11:02] I need to go there. I need to create a new one. Here I'm creating user assigned manage identity and then I can use that user assigned manage identity to user assigned manage identity to associate to as many VMs as I want.

[4:11:16] >> So when I when I switched when I >> yeah that's the difference. So you in identity you need to create it like this. In order to create system assign manage identity you can create from resource itself.

[4:11:31] >> Okay. All right. >> Yes. Thank you.

[4:11:44] are no uh questions, let's proceed with the next uh topic. We'll just cover the basics since it's already 10:34. All right. Those who are leaving, I see participants only 50. Before leaving, please make sure you're providing the

[4:11:59] feedback. All right. [snorts] Now we are moving on to the second part of uh authentication and authorization. Moving to the second part of AM. All

[4:12:11] right. Identity and access management. So far whatever we have discussed was related to identity. That means we were creating users, we were managing users, we were modifying users, we were creating identity for applications like

[4:12:26] manage identity or service principle. So we were just creating identity. we were not assigning any role or we don't know which role to assign right we don't know how to manage or how to assign access to the users or resources so that's

[4:12:41] something which we will cover in the governance topic what res what role we can assign which role is powerful which role is not powerful what is reader role what is owner role so all those stuff we will be

[4:12:55] covering in this topic okay so far whatever we have discussed is related to relate it with the identities creation or management only. We haven't assigned any access to any user yet. We created one user, right? We

[4:13:11] invited one user in our identity in our Microsoft Enra ID. We ass we we invited this rootcloud a user. Remember at the start of the uh session today, we

[4:13:23] assigned any role to this user. So when I log in with this user, this user cannot do anything. So in order for this user to do something we need to assign a role. So which role we can assign? That's what we

[4:13:37] will be discussing in this topic of governance. Okay. So [snorts] what is governance? Governance is a way to come up with with certain control over

[4:13:51] come up with with certain control over your your system or over over your uh uh uh infra you can say or platform you can say in general term what is governance you we live in India let's say and in India we have certain policies certain

[4:14:05] rules right certain laws that we have to abide so every country uh will have their own governance policies, their own own laws, right? So

[4:14:18] similarly, every companies or organization will have their own governance mechanism or own own policies. So governance is just a way which provides a mechanism and process to maintain the access control over your

[4:14:34] resources, over your applications, over your users in Azure. [snorts] So how to maintain the control that's what this topic is about. Okay.

[4:14:47] All right. So you have a user that user requires an access. So for authentication we are using IM. Now after authentication what this user can do can this user access the virtual machines? Can this user access the SQL

[4:15:03] database? Can this user delete the uh delete the SQL database? So what he or she can do that's what we are defining using governance. All right.

[4:15:15] So what is governance in general? Is that clear?

[4:15:35] that's correct like is manage identity just to secure authentication of resources or to provide connectivity manage identity does not provide the connectivity that is something network used uh network should be doing okay

[4:15:48] manage identity does not provide the connectivity it does not connect your virtual machine to the storage account. The connectivity is a network part. So have fourth chapter where we'll be discussing network. [snorts] Okay. So

[4:16:04] authentication. Whatever we have discussed so far is related to All right. So what is governance? All right. So what is governance? Governance is just uh a mechanism where

[4:16:16] you can define certain policies. is you can define access control which user or which application can access what right now how to achieve that in Azure that's what we are we are going to discuss in this chapter now this thing hierarchy is

[4:16:31] important to understand when it comes to Azure Azure okay so Azure has this hierarchy now what is this hierarchy this hierarchy is nothing but a scope

[4:16:43] where you can define the Access control. All right. Hierarchy is nothing but the scope, the level where you can define the access control or you can define the policy or you can define the uh tagging.

[4:17:01] hierarchy. What is this hierarchy? At the top of the hierarchy you have a management group, tenant root management group. Then within that tenant root management group you have you can keep different

[4:17:15] management group within the tenant root management group. Then management group is like a container logical container where you can keep your subscriptions. Subscription again is a is a billing

[4:17:28] Subscription again is a is a billing boundary. Okay. So using the subscription Azure will will charge you subscription within subscription after the subscription the scope that we have the level that we have is resource

[4:17:41] groups. So resource group is again a logical container where you can keep your actual resources. Okay. So this is the hierarchy. Now I'm not explaining each in detail because if you see we have a separate slide for

[4:17:54] that. All right. For now for this slide you need to remember the hierarchy. What is the hierarchy? At top of the hierarchy, we have the first group which is the default group. So even if you're not creating

[4:18:08] the management group, Azure will create one for you by default and that group is known as tenant root group. Now what is a management group? Management group is a management group? Management group is a way to manage your subscriptions. So

[4:18:21] keep your as many subscriptions as you want. What is a subscription? It's a billing boundary. For now you just remember it's a billing boundary. Then within the subscription you will be creating resource groups. So resource

[4:18:35] creating resource groups. So resource group is a way to keep uh in Azure it's Without creating resource group you cannot keep your resources. So resource group is a way to organize your resources. Now tell me when you buy a

[4:18:49] laptop within the laptop we have certain within the laptop we have certain components right? We have uh LAN card. You know what LAN card is? The network interface card where you connect your

[4:19:01] LAN cable, right? Then we have hard disk. Nowadays we have solid state We have processor, right? So a lot of things you when you

[4:19:13] buy a laptop lot of components you get obviously you you don't see it but uh those components are there within the laptop. [snorts] Similarly when I create a virtual machine so it's not a physical machine, it's a virtual machine. you

[4:19:27] can't touch it. So in Azure when you want to create a server you create a virtual machine with the virtual machine you get the virtual disk a disk get created a virtual nick gets created network

[4:19:41] a virtual nick gets created network interface card the LAN card okay if you have assigned IP address so public IP gets created so all these stuff get created with the virtual machine itself. So where if if you scattered this in

[4:19:54] different different groups it will be very hard for you to come up with an inventory and all those stuff. So what do we do whenever Azure is creating whenever we are creating virtual machine Azure keeps all these resources in one

[4:20:06] resource group so that within that resource group you can see all of your resources. If I show you the resource group in action, if I go to the resource group, any resource group where I have my VM,

[4:20:20] this is one of the resource group that I have. And if you see my Windows 11 VM has the disk, has the public IP, has the virtual link. So whenever I create a VM,

[4:20:32] all this gets created with the VM itself. So if you see the resource type over here on on on second row if you see the resource type it's a virtual machine it's a disk it's a public IP it's a

[4:20:46] network interface. So when we create a virtual machine everything gets created. So you can keep them in same resource group. So we'll keep them in the same resource group. Why do you want to keep them in the same resource group? Because

[4:20:59] these resource are related resources. So what [snorts] I can do I can create multiple resource groups like prod resource group, dev resource group, UAT resource group and keep all the resources belonging to that particular

[4:21:13] resources belonging to that particular environment in each resource group. So it will be easier for me to manage. Okay. So resource group is one of the uh uh level in the hierarchy in Azure. The act the main way is it's it's it's a

[4:21:29] logical container where you contain which contains your resources. That's which contains your resources. That's all. Subscription is a billing boundary. Without subscription, you cannot create or or deploy resources in Azure.

[4:21:43] Okay. And then the root the management group is a way to organize your subscriptions. So it's it's bound to happen that you will be having more than one subscription within your tenant. Why? because every subscription comes up

[4:21:58] with certain limits. So within a subscription there there might be limit that I can deploy only 25,000 VMs. So if I need more than 25,000 VMs. So if I need more than 25,000 VMs, what do I do? So I I buy

[4:22:11] another subscription then. Okay. So what is a subscription? It's a billing boundary in Netflix. When you sign up for Netflix, you need to subscribe to their plan, right? without subscribing to their plan. Will you be able to watch

[4:22:25] any movie or any any web series? No. Right? We need to subscribe. So similarly in Azure we have subscriptions. We need to buy subscription, you cannot deploy the resource.

[4:22:39] Okay. Let me give you the demonstration very quickly here. So if I go here and I have logged in with this user. If you see the uh name simply learn at whatever the domain name is. If I search for virtual machine

[4:22:54] I am landed to this page and I have the option to create and I can click on create virtual machine and I'm landed to the create virtual machine page. Once I provide all these detail virtual machine will be created.

[4:23:07] will be created. Okay. But if I log in with another user I the user that we invited, if I log in with that user,

[4:23:39] I login with this user which we invited at the start of the uh

[4:24:07] Okay. So, I've logged in with root cloud a guest user that we invited.

[4:24:30] in [snorts] if I search for virtual machine

[4:24:47] create a virtual machine? When I when I search virtual machine from another user from this user, I'm landed to this page where I have the option to create. I can

[4:24:59] virtual machine and then I'm I'm I'm going to the create virtual machine page. But when I log in with root cloud a, I don't even have that create option here. Why I don't have because this user root cloud a doesn't have any

[4:25:12] subscription. So in Azure when you want to deploy resources you need subscription. Without subscription you cannot deploy resources. So this user doesn't have any subscription. That's why he cannot

[4:25:26] deploy the resources. The other user has the subscriptions. If I switch back to the browser to a different browser and search for subscription here I have the subscription.

[4:25:42] have the access to the subscription I can deploy resources. If I don't have the subscription I cannot deploy the resources. Okay. So in Azure subscription is a way for Azure to bill you. It's like a billing boundary.

[4:25:57] Clear? Any question guys? your where your workload will be running. Resource group is like a running. Resource group is like a container where your resources will be.

[4:26:12] Subscription is like a billing boundary. So if you do not have subscription, you cannot create or deploy resources in Azure. Management group is a way to manage your subscription. That means you can keep the subscriptions within the

[4:26:24] management group. All right. So let me show you the management group here from another account since that account doesn't have access. So let me switch to doesn't have access. So let me switch to the

[4:26:41] management group, I should be seeing all the management group that I have within the management group that I have within my tenant. management group that I have. So if you see the first management group that we

[4:26:56] see the first management group that we have is tenant root group. This is by default. This is created by Azure. Microsoft Microsoft Azure. As soon as you sign up for Microsoft Azure, you'll

[4:27:08] you sign up for Microsoft Azure, you'll see tenant root group. Okay. You can create as many management group as you want. Like I have created MG01,

[4:27:22] MG0003 and within this management group you can keep your subscription. Right now both of my subscriptions are within tenant root group. If you see the hierarchy, hierarchy is like this. You have top

[4:27:35] management group. Then you can create MG00003, MG00002, MG00001 whatever, right? And between the management group you can uh uh move your subscription.

[4:27:49] Like if I want to move pay as you go to another management group, I can move it. I can select which management group I want to move. MG00001, MG00002, MG00003.

[4:28:02] save. Once I click on save, pay as you go dev test will go to whichever management group I selected. Okay, so if you see now, if you refresh, everything is okay. You don't receive

[4:28:15] any error. You should see your subscription within MG00003. All right. [snorts] So if I expand MG00003 now pay as you go is within MG00003. Okay. So you have tenant root group then

[4:28:32] group as you want and then you'll be having your subscriptions. Okay. A question may arise like I see one question by prain that why do we need so many management group? What is a management group? Management group is as

[4:28:47] the name specified is used to manage something. Right? as when I started the governance topic why do we need governance to put certain policies to governance to put certain policies to put certain control right now in Azure

[4:29:01] we have this hierarchy so in the at the top of the hierarchy you have tenant root group so if I assign any access here to any user let's say this is the here to any user let's say this is the user I assign a full access to this user

[4:29:14] at tenant root group this user will have full access over the entire hierarchy subscription number one, then this user will have full access

[4:29:31] will have full access only at the resources which is within subscription one. He won't be able to access the resources at subscription two. But if I assign full access at the tenant root group, he will have full

[4:29:44] access over whatever subscription you have within the tenant root group. Let me explain it from here from the portal itself. If anyone is having whatever access at tenant root group that access will be

[4:29:59] inherited downwards. So if I have let's say this user Imran [email protected] has complete access over tenant root group then that user will have complete access over azure training subscription complete access over mg003 complete

[4:30:16] access over mg01 but if I change my access from tenant root group to only MG01 so whatever I have inside MG01 I can I

[4:30:29] will only be able to manage those resources which I have within MG01. So in this particular scenario, there's no subscription within MG01. So if to deploy resources. Why? Because I

[4:30:44] don't have access here on on the top hierarchy. I only have access here at So why do we need so many management group is to control the access. You have group is to control the access. You have dev, you have test, you have UAT

[4:30:57] environment, you have QA, you have staging environment. You'll be having multiple environments. So to divide the access, you can create as many management group as you want and you keep your resources there.

[4:31:11] management group, that is also fine. Totally up to you. How do you want to come up with your own hierarchy? It's not mandatory to have multiple not mandatory to have multiple management group. only if you have uh

[4:31:24] number of subscription then management group makes sense. If you have only one subscription then having multiple management group does not make sense. All right. So and if you are working from enterprise a large scale

[4:31:39] organization you are going to have lots of subscription. In my previous company we used to have one subscription per client. So imagine we had thousand clients. So we had thousand subscriptions. So how to divide how to

[4:31:51] manage the access control within the thousand subscriptions? Are you going to provide access to all of your users at each subscription? If I create a new subscription uh and my team is is having access over this

[4:32:06] subscription, I need to go to this subscription, assign the access. Then if assign an access. I create another subscription, I need to assign an access. Imagine how much time you'll be wasting just for assigning the access.

[4:32:20] So what is the better way? Create a management group, put your subscriptions there and assign access at the management group level. So whatever level and if you have thousands of subscriptions within that management

[4:32:33] group level, that access will be inherited. inherited. Okay, clear. Let's proceed with our topic governance. Before that I'll just give do a 5 minutes or 10 minutes of

[4:32:46] quick recap what we have covered so far. Okay. Uh so what we have covered so far we started with basics of cloud computing where we understood what cloud computing is. Why do we need cloud computing in

[4:33:00] today's world and then we moved on to our first topic of 305 which was AM. IM stands for identity and access management where we discussed about if we need a service if we want to implement AM in our organization or our

[4:33:16] projects then if do we have any service in Azure. So we have Microsoft Entra ID as the service in Azure which helps you to manage or implement AM in your own Now Microsoft Enra ID comes with two different flavors B2B

[4:33:33] and B2C. B2B stands for businessto business. So if you have a partner company or any other collaborators who want to collaborate with your company and they want to build something for your company or you have

[4:33:47] hired someone to build but it's it's a it's generally a contractor let's say not a permanent employee of your company and you you don't want to create account for them. So B2B is something that you can make use of as long as the

[4:34:00] collaborator has a valid email address. You can invite them directly to your tenant to your directory to your Microsoft Enterra ID and then you can give them whatever access is required to accomplish their role or their job. Then

[4:34:14] another flavor of Microsoft enter ID is B2C. B2C stands for business to consumer. So when you have an application let's say this is your company's application and this application is open for your let's say

[4:34:28] application is open for your let's say end users or maybe your employees and you want to manage a separate authentication module for this application. So in this scenario you can make use of B2C business to customers

[4:34:42] business to client. Okay. Then we saw a few premium features in Microsoft Entra ID like uh uh conditional access on the basis of certain conditions you'll provide access or you'll throw a multiffactor authentication challenge.

[4:34:56] multiffactor authentication challenge. Uh conditions can be anything like uh uh whether should allow that traffic should deny that traffic you'll define everything in that conditional access policy. If you allow the access will be

[4:35:09] granted if you deny the access will be denied. If you ask for multiffactor authentication, a pop-up will be sent to their authenticator. After conditional access policies, we went to identity protection. So in

[4:35:22] identity protection, you have like three different policies that you can set up. Uh you have user risk policy, you have signin risk policy and you have multiffactor authentication, registration policy.

[4:35:34] User risk policy if user is at risk, signin risk policy. If the if the sign in method that that have been opted is detected as anonymous or risky. So all those things Microsoft threat intelligence works behind the scenes and

[4:35:50] intelligence works behind the scenes and uh learns the pattern of user behavior like when what that what what time user logs in which device user uses. If any of this pattern changes then uh it could be

[4:36:03] uh assumed by my by identity protection that it's a risk and whenever that risk whether you have blocked it whether you have th whether you have asked for user

[4:36:15] have th whether you have asked for user to uh to prove the identity prove the authentication using multiffactor. So that will be triggered. So depend on how you have what you have configured in your policy that action will be taken by

[4:36:29] identity protection. When it comes to identity protection you don't do much as a user as a administrator I don't do much I just define whether I want to allow I want to throw a multiffactor authentication or I want to deny the

[4:36:43] access that's all. So those are the three uh radio buttons that one of the radio buttons I have to select. After IDP we went on to access reviews before IDP we went on to access reviews before starting of this uh demo. U pankage

[4:36:57] asked for that and and I have explained it right. So what is access review? In simple access review is just a way to review as the name specifies to review the accesses that you have given to your your users. Right? So whenever user

[4:37:12] and then that group will be having access to certain resources and then after every 3 months 6 month depending on whatever policy you have with your uh security team you will be running that access reviews and then the manager of

[4:37:27] that group or whoever is the reviewer of that group will decide whether the user will have a continued access or uh the access will be revoked for that user for those particular resources. Then after access review review we moved

[4:37:42] on to two types of identities that is required for that we can use for application like manage identity and service principle when an application requires an access to the backend resources like storage SQL whatever. So

[4:37:58] you create a manage identity for that application. Manage identity is something that you can use and assign it. It creates an object ID. Object ID is nothing but the way how Microsoft Endra ID recognizes or verifies a

[4:38:12] particular object or particular identity. So that object ID is it uh gets assigned to that resource where your application is hosted and then you can use that object ID to assign access to whatever resources you want. But

[4:38:26] manage identity the limitation of manage identity is if your application is hosted on Azure then only you'll be able to use manage identity. If application is hosted outside Azure then obviously manage identity is not the option for

[4:38:39] you. So what you can do then you can make use of service principle concept is principle the application is hosted outside Azure. It might be hosted onrem might be hosted in some other cloud

[4:38:52] provider but they need access to Azure resources. So in that case we can make use of service principle. Then we saw one uh resource in Azure which is Azure

[4:39:06] keyword. So Azure keyword is a storage service uh which we use to store our secrets. Secrets can be passwords or can be connection strings. We can generate or or import the keys the cryptographic keys in Azure keyword and we can also

[4:39:23] make use of certificates. So we can keep key certificates and secret in Azure keyword so that our application can securely access the secrets or the passwords or the connection strings directly from Azure keyword. It's not a

[4:39:36] good idea to store the password secrets uh connection strings or uh access keys directly on the application code. It's not a good idea. That's why you can move

[4:39:48] that to a separate uh vault and from there your application can read it. All right. So that's what we have seen so far. After that we moved on to the next topic which is governance. So what is the governance? Governance is

[4:40:01] nothing but a set of processes, policies, access control that you can apply on within your organization, right? And within that governance topic we saw the hierarchy. So this is important to understand from Azure point

[4:40:16] of view. We have a hierarchy. Azure Microsoft Azure has created this hierarchy. Why this hierarchy is created? So that you can manage access created? So that you can manage access policies, access control policies at any

[4:40:29] of the scope that is visible for your company, for your organization depending on the requirement of your organization. Now what is this hierarchy? In this hierarchy, you have five different scopes, five different levels. Okay? Now

[4:40:43] if you see, I've only mentioned four. 1 2 3 4. But in actual you have five, right? So what is that fifth level? The first uh the first scope in the hierarchy is the tenant root group which is present by default. When you sign up

[4:40:57] for Azure, you should be having tenant root group even when you don't create it. So tenant root group is the top is the stop in the hierarchy. create as many management group as you want.

[4:41:12] management group. Then within that tenant root group, you can create as many management group as you want. So what is this management group? Let's see that. So management group is is is a scope is a level in hierarchy where you

[4:41:27] scope is a level in hierarchy where you can organize your subscriptions. So here bound to happen. You'll be working with multiple subscriptions within your organization. Why? So if you have done easy 104 you might know that every

[4:41:40] subscription has its own limit. I cannot use Azure subscription limitless. That means I cannot go and use one subscription and deploy like the like millions of virtual machines. There will be limit. Okay. So, Azure has limit to

[4:41:56] doesn't matter what subscription you are limit. So, it's bound to happen if subscription So, it's bound to happen if subscription is having limit and if I'm uh if I have

[4:42:08] utilized all of that limit, obviously I need to buy another subscription. So when I'm buying another subscription, the access control and the organization having multiple subscription. Why? Let's

[4:42:22] say I have this subscription where few of my users are having access and they can deploy resources. So this user is having access and this user can deploy resources whatever resources required. Similar to this user, you have thousands

[4:42:34] of group you have thousands of users. They have some kind of access to this. some some of them are having read access, some of them are having write access, some of them are having write access. Right? So all the access control

[4:42:47] have been managed over here. Now let's say once I have utilized my limit, I'm buying another subscription. So what I'll have to do now again I need to see who is having what access here and I need to replicate the same thing

[4:43:01] in another subscription so that I'm not blocking my user from deploying resources. Right? Now after few years let's say I've utilized another limit I'm going for another subscription. So I have to replicate all the access control

[4:43:15] all the policies everything on this subscription as well. So to avoid that situation what Microsoft has done Microsoft has created this management group. So instead of assigning access directly

[4:43:27] do you can organize all of your subscription within the management group and you can control the access at the management group level. So once you control the access at the management group level in future it doesn't matter

[4:43:40] how many subscriptions you add within that management group all the subscription will inherit the same access control that you have um you have provided or you have added or you have assigned to your users at the management

[4:43:56] group level. So those access those policies will be inherit downwards. All right. So management group is the top level obviously tenant tenant root group you have your management group you can create a

[4:44:11] management group like uh here it's it's created as tailwinds that is nothing but the company name and within the tailwind you have like sales corporate IT within dev QA u right so all you can create as per

[4:44:30] your requirement whatever you want to create it it because um Azure doesn't want you to follow this. If you want to follow this, you can. Different company have different use cases. So they follow according to their requirement. Like

[4:44:43] I'll give you a real world example of my own company. So my own company, we have like we create a subscription for our client. So if we have thousands of clients, all thousands of uh client, all thousands of customer will have their

[4:44:58] own subscription. so that it's easier for us for us to invoice them at the end of the billing cycle. So what we have done we have obviously we have this tenant root group so I'll write it as TRG

[4:45:10] then we have uh two management group one for our company okay one for the customers every customer subscription will goes under this customer in our management group we have

[4:45:26] rod we have uh UAT we have uh UAT and then we have U staging Okay, test. So these are I mean non-pro not staging non-pro. So we have this

[4:45:39] not staging non-pro. So we have this very simple and uh effective way so that whenever new customer we want to onboard a new customer we just add our a new customer subscription under this customer management group. So that's

[4:45:52] quite simple management group layers we have created. Okay. So what management group is in order to organize your subscription you can keep your uh subscriptions under this management group you can manage for

[4:46:06] access control as well. So whatever access I'll be applying at this level that access will be inherited. Okay. So doesn't matter how many management group doesn't matter how many management group I have in my hierarchy. Whatever access

[4:46:19] I'm assigning here that will be inherited. You can also enforce policies at different levels of management group. So if I have any policy here at tenant root group that will be inherited. If I have any policy at it since it will be

[4:46:33] having different kind of policy. So if I have any policy assigned at IT that will group and the subscriptions within the IT management group. Okay. Any policy at

[4:46:46] IT will not impact the root group, Telwinds, corporate and sales. Okay. So it comes to deal with multiple subscription. If you have single subscription, you don't need to bother about management groups and all. All

[4:47:01] right? You'll be having one tenant root group. Create one management group with management group, you keep your subscriptions. All right? And obviously if you have management group, it is easier to uh

[4:47:13] attain the compliance compliance requirement for your company since I can assign the all company level policy at tenant root group. which should be uh which should be equivalent for every subscription, every management group,

[4:47:26] subscription, every management group, every resource. All right. So I think I group. But in order to work with manage room, I just need to search for management group. So in in the search bar if I types type management, I should

[4:47:41] get this option management groups. I click on it and I'll I can see how many management group I have. Right? So this is the tenant root group. So within tenant root group you'll be having everything all of your management group

[4:47:53] All of your subscriptions will be within tenant root group right. So whatever I'll be assigning here at tenant root group will be inherited by by by all the management group within that tenant root group. So what do we have? What is our

[4:48:09] hierarchy here? We have Azure training. This is my subscription right? You can see the type here. So this is the management group. The first one, the second one is subscription. Rest two are the management group. So anything

[4:48:21] assigned here, any policy or any arbback role assigned here at tenant root group will be inherited by Azure training subscription will be inherited by MG003 will be inherited by MG001. All right.

[4:48:37] All right. If I expand MG003, now we have tenant root group at top. We have subscription that is within tenant root group. We have MG00003 which is within tenant root group and then we

[4:48:49] have another subscription pay as you go within MG00003. Now if I assign someone any access at MG00003 if I assign someone let's say this is a user user 01 and I assign access to this

[4:49:03] user at MG00003. Whatever the access is let's say read Whatever the access is let's say read access. Now tell me can this user user 001 read anything we have at Azure training? Azure training is nothing but

[4:49:16] the subscription name. So if I assign a user 01 access read access at management user 01 access read access at management group 003 can this user read or or deploy any resource at subscription which is named as Azure training.

[4:49:33] So I'm getting the answer as no that's correct. Why? Because MG00003's is a different scope is at the within the tenant root group and this subscription Azure training is within tenant root group. So anyone in my company wants to

[4:49:48] work with Azure training I need to assign access at the subscription level Azure training level or at the tenant root group level. All right. But let's say another question to you.

[4:50:02] If I move this subscription from tenant root group to MG00003. Now what is going to happen? That user who was having the reader role at MG00003

[4:50:15] should have access the read access to Azure training or no. If I move Azure Azure training or no. If I move Azure training to MG00003 then obviously yes. So whatever access you have at MG00003 will be inherited to

[4:50:29] all the subscriptions that you have within that MG00003. within that MG00003. All right. So this is very easy uh to manage. In order to move, in order to create, you just click on create and

[4:50:41] create another management group. So let's say MC00004 uh management group display name and ID whatever display name you want. Display name is for you. ID is for Azure. So that when you work with management group

[4:50:56] using commands like CLI or PowerShell, you can call this ID. You can keep whatever ID you want. Okay. So I click on submit here. on submit here. It will create another group MG00003.

[4:51:19] you need to keep MG under subscriptions or subscriptions under NG? Okay. So you need to focus on hierarchy here. Hurry. You never put management group under subscription. that is not possible. Okay. Management group is a logical

[4:51:35] Okay. Management group is a logical container which is created to manage your subscriptions. So always subscriptions will go under management subscriptions will go under management group. Not vice versa. I cannot put man

[4:51:48] group. Not vice versa. I cannot put man I I cannot put subscriptions under subscriptions. That's not possible. Okay. So always your subscriptions will go under management groups. So if you see the uh the portal

[4:52:03] here this subscription Azure training MG00003 this subscription Azure training MG00003 MG00004 MG01 are all in the same line are all in the same hierarchy. That means they are within tenant root group.

[4:52:18] means they are within tenant root group. Okay. Now we just created MG00004. Now if I want to move this pay as you go, I can simply click on these three dots move and I can move it under wherever I want. Do I want to move it

[4:52:32] wherever I want. Do I want to move it under MG00004, MG00001, MG0000? Wherever you want to move, you select that management group and move it. That's moved. But whenever you are moving something at this level, you need to

[4:52:46] understand that the permissions, the policies all will be affected. Okay. So, whatever policies and permissions you have under MG00004,

[4:52:58] have under MG00004, those policies will be applied to now uh moved. So before moving this subscription was under MG00003. So whatever role policies were assigned to MG00003

[4:53:12] will be would would have been inherited by pay as you go. But now since we have by pay as you go. But now since we have moved whatever policy and roles access whatever you have at MG00004 will be inherited by pay as you go. All right.

[4:53:27] So that's how you manage these things and that's how you create management group and move subscriptions within the management group. You can also move management group to management group. So as you can see here M01

[4:53:43] as you can see here M01 consists or contains M02 now. All right. So hierarchy within the hierarchy you can put management group within management group. So that is also possible. All right.

[4:53:56] possible. All right. [snorts] subscription. I'll answer punk. Just wait. Okay. So I'll read your question.

[4:54:08] uh answer. So what is a subscription? Subscription gives you access to Azure services. What do I mean by what does that mean? If I want to deploy anything in Azure, I need to have subscription. Without subscription, I cannot deploy

[4:54:24] resources. I want to deploy virtual machine or or uh disk or storage account. Whatever I want to deploy, I need to have access. I need to have subscription in place. without subscription I I cannot deploy

[4:54:38] subscription I I cannot deploy resources. Consider it like something uh Netflix. Okay. So in Netflix I can create the account without providing uh nowadays you need to provide the payment

[4:54:52] details and all but I can keep my account. I can sign up. I can provide credit card. I'll still have my account there. my account will still be there but I won't be able to enjoy the the movies or the web series or or whatever

[4:55:07] Netflix has to provide right so in order to watch movies web series what I need to do I need to subscribe to a certain plan uh in Netflix whatever plan they have to provide I have to subscribe to that plan similarly you can create as

[4:55:20] your account without subscription you can have account without subscription but it does not make sense that means you won't have the option to deploy the services that means deploy the resources I won't be able to deploy the resources

[4:55:35] subscription I won't be able to deploy the resources so what is subscription again subscription is a logical container for management and billing so Azure will charge you by looking at your subscription by looking at your usage so

[4:55:52] if I want to deploy resources I need to have subscription in place I need to buy subscription from somewhere all Right. So subscription is a billing boundary. It's your isolation with other customers. So whatever resources you're

[4:56:05] deploying will be build or charged to your subscription. All right. Again this is this is a level at hierarchy. So you can manage your resources and your access control at this level as well at subscription level as well. So if you if

[4:56:20] we go back to the hierarchy here subscription is at the third level. First you have tenant root group then you will be having or not having having subscription. So most list will be sitting at the third level. So this

[4:56:34] at this level as well you can manage the access control or the policies that you want to implement. In simple subscription is a billing boundary. If I want to deploy resources I need to have subscription in place. If

[4:56:48] there's no subscription I won't be able to deploy resources. All right. So, I think we created one user, right, last time. User 01.

[4:57:01] So, let me just go to the user section. I'll I'm just demonstrating you uh what what I explained just now that subscription is a billing boundary. So, subscription is a billing boundary. So, if you see this user user 02,

[4:57:15] okay, user 02. Let's log in with that user. So I'll just copy the username and hopefully I remember the password. I'll open the in private window. I go to portal.azio.com

[4:57:27] portal.azio.com and login with this user.

[4:57:54] This user doesn't have the MFA. Okay, let me quickly

[4:58:38] 02. What do you see at the at the homepage? So this is the homepage. Can I deploy resource from using user 02? So I'm logged in using the user account user 02. And if I search for virtual machine

[4:58:52] virtual machine. If I click on that virtual machine you see where I'm landed. It's it's complaining that I might not have access or I might not have the subscription. Okay. If you see the first page it says welcome to Azure.

[4:59:09] What is it? What it is complaining? don't have subscription that means this user doesn't have access to any subscription or doesn't have uh any subscription within its with within its account. Okay. So you see none of the

[4:59:23] entries matched that means there's no subscription no access to the subscriptions for user 02. So in order to deploy resource I need to have subscription. Now if I do with another user so if you see this is another user

[4:59:35] simply learn something something right simply learn at the rate domain name. So this user if I search for virtual machine see where I'm landed on which page I'm landed at least I can see the virtual machine here I have the create

[4:59:50] option that means I have some access to the subscription obviously a right access with this user account so that this user simply learn at the rate whatever it is can create the virtual machines apart from virtual machines can

[5:00:03] create other resources as well. So in order to deploy resources you need to have subscription. Azure will bill you according to your usage whatever whatever you have deployed within your subscription. All right. Once again if I

[5:00:17] go to the in private window where I have logged in with user 02 just focus on the screen user 02 and you see when I search for virtual machine I'm landed to this page where I cannot see any virtual machine and I I'm getting this screen

[5:00:32] which says welcome to Azure. Why this screen I'm seeing? Because I don't have access to the subscription. The next topic that we have is policy. Now we have done the hierarchy and uh while explaining the hierarchy sorry.

[5:00:57] explaining the hierarchy u I have been mentioning about policies and arback and all. Now we are coming to that policies and our back. Okay. So what is a policy? and our back. Okay. So what is a policy? Policy in Azure is a way to enforce

[5:01:11] something. Enforce as in to mandate something to do something mandatory. For example um there is a user like for example I'll take you you guys. Okay you are now

[5:01:25] learning a 305 and you might have done a 104 as well. Some of you might have done a 104. Some of you are directly here for easy 305. So doesn't matter which learning Azure. When you're learning Azure, you are

[5:01:40] When you're learning Azure, you are getting uh introduced to lot of services which you can use for your own use, for your own uh own work. Okay, not for company work, let's say for your own work. So you're learning Azure. Now you

[5:01:53] have learned how to deploy virtual machine let's say or how to deploy certain resources. So when you have learned that you have you're working professional let's say

[5:02:05] you're working professional let's say and you have access to your company's and you have access to your company's Azure subscription. access to your company's Azure subscription. So in order to just to

[5:02:19] understand Azure what you will be doing you have the access to your company's Azure subscription you can use it to deploy resources right what you'll be doing let's say just for just for understanding or just

[5:02:32] machine which is having 64 GB of RAM which is having 64 GB of RAM uh eight virtual CPUs and so and so so you deployed this virtual machine now tell me this virtual machine the

[5:02:47] configuration is hefty or not? Is it a minimal configuration or it's a hefty minimal configuration or it's a hefty configuration? 64GB of RAM.

[5:03:02] configuration. So, I'm learning Azure. I have access to my company subscription and I deploy this virtual machine. Who's going to bear the cost? Is it me as a individual user? Is it my company since I'm using

[5:03:15] my company subscription? So obviously the cost will be for my company uh my company will have to bear the cost since I'm using their subscription right. So as a company or as an Azure administrator

[5:03:32] I know while I'm I'm coming up with governance I know that I will never require 64 GB of virtual machine for my projects or for my products. I I never require that since I don't deal in that those kind of project. So I never need

[5:03:46] the hefty machines. So if I simply ask my user, my employees that please do not deploy this kind of heavy virtual machines, I'll have to pay for that. Now tell me just telling them just asking them not to do uh is it 100% sure

[5:04:03] asking them not to do uh is it 100% sure that they are not going to do it? or as a as your architect that please do not deploy hefty virtual machines.

[5:04:16] Are they going to uh I mean are they going to listen and and they I'm I'm I'll I'll be 100% sure that they're not going to do this just asking them obviously some of them will agree some

[5:04:32] of them will not touch some of them just for sake of of deploying and and learning things they'll go ahead and deploy and deploying is not not a problem the problem is they deploy and then let's say they forget to delete

[5:04:46] So they deploy this and they forget to delete it. I'll still have to I I mean as a company I'll have to pay that charge. So how to restrict our employees charge. So how to restrict our employees from doing such things. So what Azure or

[5:05:00] Microsoft uh did they came up with Azure policies. So what Azure policy does they enforces certain things. Okay. What they what you can do with Azure policy. one one example I have given you like this you

[5:05:15] example I have given you like this you can restrict deployment of certain uh sizes of virtual machines like mentioned here so I can limit to certain SKUs I can restrict users from deploying this kind of heavy hefty virtual machines

[5:05:28] heavy virtual machines why because I don't need it if I need it obviously I'll make amendments to the policies but if I don't need it I can limit that kind if I don't need it I can limit that kind of uh things using policies okay now we

[5:05:41] just understood the tag. So we can enforce that as well. By default it's not mandatory to have tag to each on each and every resource. But with policies you can enforce that. You can ask user to uh when they are

[5:05:55] deploying the resources you can ask them using policies to to provide the tag. the resources. You can also restrict deployment in You can also restrict deployment in certain locations like uh Azure has its

[5:06:10] presence all over the world. Okay, we have presence in India, Australia, US, UK. Uh but let's say for my dealing in US. So we can restrict deployment of certain resources in

[5:06:25] certain locations. So that is also possible. Okay. You can enable auditing, possible. Okay. You can enable auditing, you can using policy, you can uh deploy you can using policy, you can uh deploy the the AAS antimalware on on all of

[5:06:38] machines. you can deploy there. There's a lot of thing that you can do with policies. So policy is a way to enforce uh certain standards that you want to achieve. All right. Now where you can apply the policy at any level in the

[5:06:52] hierarchy at any level in the hierarchy you can apply the policies. Now where which policy should be applied? Let's say the 64GB one that I that I told that I that I mentioned is a policy that can go at the root group level tenant root

[5:07:08] be applied for each and every subscription. So I can keep that policy at the tenant root group level. Certain policies like do not deploy in a certain location, I can keep the keep them at the management group level. MG01

[5:07:24] or MG02. Now let's say MG01 deals with every project that we have in India. So I'll keep the location deployment uh I'll keep the location deployment uh policy at MG01 so that it won't impact

[5:07:37] other resource uh other management group right enforce tag again I can keep it at the tenant root group level since I want tags to be enforced at each and every level each and every resource. All right. So policy is is that that a

[5:07:53] policy is something that you can uh use to enforce whatever standards you want to enforce whatever standards you want to want to have. All right. Now when you work with policy I'll show you two demonstration in in

[5:08:08] this hands-on is uh applying tags and and policy. So is uh applying tags and and policy. So what I'll do I'll first go and create a resource group. Okay. So you see in order to create a resource group you

[5:08:23] should you can search for resource group over here and you can see a resource group right. So in order to create a resource group I click on resource groups here and then I click on create. Okay when I click on create I have like

[5:08:36] two things that I need to provide subscriptions doesn't matter whether you're creating a resource group a virtual machine a disk whatever a re subscription should all always be provided. So you have to provide the

[5:08:49] subscription and the resource group name. Okay. So what would be the resource group name for this? So I'll go for a 305 RG02. All right. And then the region. So what is the region? Region is the physical

[5:09:05] location where your resource will be deployed. So if you see the drop-down, Azure has its presence uh in all of these uh uh regions like uh in all of these uh uh regions like South Africa, Australia, India, uh East

[5:09:20] Asia, Indonesia, Japan, East, West, Korea, Malaysia. So we have all these location, all these Azure has its presence in all of these uh regions. The

[5:09:33] center is present in all of these locations. So you can select whatever you want. Okay? Unless you have a policy which is restricting you to deploy resources from so and so location. Now I select central India over here.

[5:09:47] Mostly I'll be using central India to deploy uh resources. Okay. So I select central India over here. Now what we have provided? We have provided subscription. We have provided resource group. We have provided region. Remember

[5:10:01] the region is central India. Okay. Then the next tab that you see is tags. So you can provide the tags. So what is tag? Tag is just an extra metadata.

[5:10:13] Okay. You can provide anything like uh environment Okay. Owner whoever is deploying Iran, right? So you

[5:10:29] can provide whatever you want. It's totally up to you. one resource can have totally up to you. one resource can have like uh 50 tags. So this one resource can have like 50 tags. So you can provide around 50 tags to one resource.

[5:10:41] Okay. But for now let's not provide the tag. So even if I don't provide the tag, I can click on review create and I can click on create. Remember I created click on create. Remember I created resource group with the name A305 RG01.

[5:10:55] So you should see the resource group in some time here. without tag. Remember we created it in central India. All right. Now let's

[5:11:08] create a policy. Let's create a policy. Right now there's no policy. So let's create a policy. This policy will restrict deploying This policy will restrict deploying resource group in central India.

[5:11:21] So if now people try to deploy resource in central India, the policy should in central India, the policy should restrict it. And this policy will uh will be applied at at at subscription level. Okay. So let's see how we can use

[5:11:37] policy. Now I I just demonstrated that I was able to create the resource group and that resource group was created in central India. Okay. Now using policy will restrict that. So let's quickly do that. So in order to work with policy

[5:11:52] I can search for policy and I can go and select policy here. Okay. Now if I have any policy or if I don't have any policy, I can see over here. If you see on left hand side, you have all the required options. All

[5:12:08] right. So you see here under assignments, you can see all the policy which are currently assigned to your uh to at any any at any scope if you have now it's zero that means no policy is

[5:12:22] assigned. Okay. Now in order to assign you can click on assign policy. So if you see here you have two different options assign policy and assign initiative. So what is the difference between policy and initiative? Quite

[5:12:35] important from uh interview point of view. Policy is like a single policy. Okay. If I want to create a group of policy and assign those policy at once

[5:12:47] then I have to click on assign initiative. I can create like multiple policies as a group at once. and uh at one polic as one policy and I can assign that as an initiative. So if I click on assign initiative, you'll see all the

[5:13:03] initiatives. Sorry, if I go back over here and if I go to the definitions uh and if I click on uh if you see here, these are all the policies that we have available as of now. Okay, these are all the inbuilt policy that that Microsoft

[5:13:17] has created and kept that. But if you see here the type the type mentioned here definition type if you see the type which is mentioned here will will will which is mentioned here will will will will uh confirm whether it's a single

[5:13:32] will uh confirm whether it's a single policy or whether it's an initiative. policy. But if you scroll down you see there are uh multiple uh pages that you there are uh multiple uh pages that you can go and if if you go to the last page

[5:13:46] if you go through each page one of one of the types should be initiative. You can see that initiative as well. Okay. There are a lot of lot of pages. These that Microsoft has already created for you. You can come up with your own

[5:14:00] policy as well. Sometimes it happens that even though we have so many policies inbuilt policy that Microsoft has created we do not find a specific policy for our use case. So what you can do you can come up with your own policy

[5:14:15] you can create your own policy. All right. So in order to create your own policy uh somewhere you should have policy definition initiative definition. If you want to create a policy you click on policy definition. If you want to

[5:14:27] initiative definition. initiatives like multiple policies at once. Okay. In order to assign policy, you need to go to assignments. In order to define policy or create policy, you need to go into the definitions.

[5:14:41] All right. Now, in order to create policies, JSON and you need to understand the different uh services that Azure has to provide, Azure provides, right? For example, this is the virtual machine

[5:14:55] related thing. So this policy can audit all the virtual machines which does not have the disaster recovery configured. So you can use that policy and you can see how this policy is defined. So this policy is defined like this as I

[5:15:08] mentioned that in order to work with policy or anything in cloud specifically any cloud you need to be well versed with JSON. Okay. So whatever Azure or mentioning is mentioning is will be mentioned as a JSON format. Okay.

[5:15:27] So what we are going to do let's go back to our topic where we have to deploy a policy which will restrict the deployment is of resource group in deployment is of resource group in central India that means uh nobody will

[5:15:41] should be able to deploy a resource or a resource group in central India. Okay. So let's go to the assignment. Let's click on assign policy. And here the

[5:15:53] first thing that you need to define is scope. The scope is the hierarchy that we we discussed. So any scope at any scope you can apply the policy provided you have the access. Okay. So if you see here at the scope on this three dots if

[5:16:08] I click on this three dots I can select the subscription. I can select the resource group. Now you might ask the question why I can't see the management group here. So remember I have logged in as simply learn user. It's possible that

[5:16:23] access to the management group. So I don't see the management group here. You can assign policy at the management group. If you have access to the management group, okay. So if I switch the browser and go to the user which has

[5:16:38] access to management group uh like my personal user Imran Ketani. So if I search for policies here, if I click on assign assignments and if

[5:16:51] I click on assign policy just to see the scope, if I click on scope here, you see I can see the management group. So if you have access, you'll be seeing the scope as management group. If you do not have access, you

[5:17:05] won't be seeing it. All right. Now how to assign the access and how to see this is something we will discuss in in the next topic which is arbback. So right now we are on on policy. So let's complete the policy first. Now I'm

[5:17:19] switching back to the browser where I've logged in with simply learn user who does not have access to uh management group. Okay. So here we'll keep the scope as subscription and I'm not

[5:17:33] selecting any resource group. I'm just selecting subscription that's all. All right. And I click on select. So whatever now we are going to define whatever now we are going to define within this policy will be uh will be

[5:17:48] impacting this subscription only and within this subscription whatever resource group you'll be creating whatever resources you'll be deploying only those uh resource or resource group will be impacted.

[5:18:02] So let me just explain this again. So if you see this hierarchy this is let's consider this is the subscription Azure training and we are subscription Azure training and we are applying policy at this level now okay

[5:18:16] so if you go ahead and create a resource group within this policy then only the policy that within this subscription then only that policy which you are applying will be evaluated. If you're creating resource group within

[5:18:30] another subscription then that policy will have no impact. Okay, that's why Azure. Okay, let's go back to the browser. Uh within this subscription, if you want to

[5:18:45] exclude anything, you can exclude that. But let's say I just want to exclude two or more resource group which is for R&D purposes. So if I want to exclude, I can exclude. Okay, that option is given. Then here you can select the policy

[5:18:59] definition. So I click on this three dots and there are a lot of policies. So if you see there are like thousands of policies that Microsoft has already created. You need to select your own your policies

[5:19:15] according to your categories like I only want to work with virtual machine. So I select let's say compute. So I select compute and all the compute related policies will be filtered out. So I'll see only the compute related

[5:19:29] policies. Okay. You see the VM VMs all the VM related You see the VM VMs all the VM related policies will be will be uh shown. Okay. Now what we are interested is restriction of location. So I search I I

[5:19:45] randomly search for location or maybe allowed location. Okay.

[5:19:58] this term allowed location. So you see there are three policies with that name. The first policy is specific to Cosmos DB. So Cosmos DB is a resource in Azure or database in in in Azure. So if you want to impact or or restrict deployment

[5:20:15] of Cosmos DB from certain location, you can select that. Okay. What we are interested here is in resource group. So before deploying the policy I deployed a resource group right in central India and that was allowed but right now let's

[5:20:29] restrict that using uh using this policy. Okay allowed location or resource group. So I select that policy and after selecting that policy we need to go to the next uh tab which is parameter. So in parameters you have to

[5:20:45] define which location you want to allow. Okay. So there are all the locations that is mentioned. What I don't want to allow is deployment in central India uh west India and south India. So I untick south India, west India and

[5:21:01] central India from here. Apart from that every other location is allowed. So let's say that's my scenario that's my that's my uh requirement. So only central India, West India and South India is unticked. Apart from that all

[5:21:17] other locations are allowed. Now next remediation is something which doesn't require we don't require for this policy but let let me explain what the remediation is. What is a remediation? Remediation is a way to uh

[5:21:33] to make sure or to make that that resource compliant. Okay. For example, resource compliant. Okay. For example, your policy is evaluating u and evaluating whether the anti-malware

[5:21:48] and evaluating whether the anti-malware is installed or not in Windows virtual machine. So you have let's say thousands of virtual machine and your VAPD team vulnerability assessment team wants to make sure that antimalware is installed

[5:22:03] on all of the Windows virtual machine. So what we can do we can use a policy. So that policy will evaluate whether the antimalware is present or not. If antimmalware is not present, install it, download it and install it. So that

[5:22:19] download and install it is nothing but remediation. Something is not present, you're asking policy to deploy it. So when your policy is deploying it, that process of deploying things is known as

[5:22:32] remediation. we are remediating which is which is not present there. All right. So obviously this policy doesn't require remediation but there are some policies which might which might have this option of remediation. So you can enable it.

[5:22:45] Okay. Then when you are remediating things you need now I have a question what is the meaning of remediation? The remediation is something which will

[5:23:01] make sure deploy if not exist. You see this word deploy if not exist. So if example antimalware or any other software that you are evaluating if that

[5:23:13] is not deployed deploy it. If it's not exist deploy it now tell me we are asking a policy to deploy things on a virtual machine.

[5:23:25] virtual machine and policy is going to deploy that thing in the virt on the uh I mean within the virtual machine. So what process is required here? Uh is

[5:23:37] the virtual machine automatically will allow the policy to deploy the things? the thing. Policy is a separate application. Virtual machine is a

[5:23:52] separate resource. Both of these are separate resource. Now policy is trying to make some changes within the virtual machine install a software. Tell me is the virtual machine going to

[5:24:05] Tell me is the virtual machine going to allow the policy to install the software or what as a engineer or administrator what we need to do?

[5:24:17] the next step. What is manage identity? Policy is an application which trying to make some changes to the virtual machine. It's an application which is trying to make some changes to the application.

[5:24:30] Think from the security point of view. Is the virtual machine going to allow the application as is without asking anything without doing anything? anything without doing anything? Is it going to allowed or not?

[5:24:47] firewall not on then not deployed the VM. Firewall has has nothing to do with it. Okay. Or the app the request is not coming from outside your network. We are

[5:24:59] within the same tenant. Okay. Policy that we are applying is in the same subscription whereas the virtual machine that will be evaluated will also be in the same subscription. So firewall u doesn't come in this

[5:25:14] picture at least for this example. Okay. So Chetan is saying we need to register the app. Hurry is saying the policy is imposed. Yes. Okay. You you policy is imposed. Yes. Okay. You you you guys are forgetting one simple

[5:25:29] uh mechanism you can say is authentication. I uh is this policy? How the VM is going to authenticate this policy and how the VM is going to authorize that policy?

[5:25:49] identify we have to define the location where to download and install. where to download and install. Uh that's secondary. Yes. Okay guys, go back to IM. Go back to identity and access

[5:26:03] management? It allows you to authenticate your user and authorize your user. It's not only for user, it's also for application. If you remember, we understood two different terms. Manage identity and service principle.

[5:26:17] Manage identity and service principle. Now tell me what is manage identity? Suresh is saying user account should own admin right. Okay. U policy is deploying things on a virtual machine. User account where where is the user coming

[5:26:33] in here? Policy is kind of an application. Virtual machine is kind of a resource. This application needs access to the resource to make some changes. User account is not required here. Consider

[5:26:48] it like this. You have an application which requires access to the database. So here we we we do not include the user account when application is accessing the database. What what is manage identity? Come back.

[5:27:00] What what is manage identity? Come back. I'm I'm giving you the answer as well. statement or words. What is manage identity?

[5:27:29] you to please rewatch the AM section. All right, now let's come back to the policy here. Now just answer yes or no. Is the basic step clear? basic step you're just defining your your scope where you want to apply the policy and

[5:27:43] then you are selecting the policy definition which you want to apply apply in our example we selected allowed location for resource group and then in the parameters section we selected which location to allow which location not to

[5:27:55] allow so we allowed free location we allowed we we unticked few location allowed we we unticked few location where uh which will be denied all right now for our policy we don't require remediation but I explain what

[5:28:08] remediation ation is. Now answer do you understand what remediation is? Okay. So remediation is something where if uh if something is not present it

[5:28:20] will deploy. So in our policy it doesn't make sense to uh to enable remediation. using any policy where remediation is required one policy that I provided is

[5:28:32] uh example I provided is antimmalware which is not installed in a policy will evaluate all the virtual machines. You have thousands of virtual machines. Okay you have thousands of virtual machines.

[5:28:47] Policy will evaluate all the Windows virtual machine and see whether the anti-malware is installed or not. If it is not installed then using the remediation option we will install it. We'll ask policy to install it. We as a

[5:29:00] user are not going to install it. That's why this policy is in place. Policy will automate things for you. Okay. So it will install on your behalf. So you will not ask me for the user account or or anything. So with remediation what I

[5:29:15] can do? I can install this software. Antimalware is what? It's nothing but a software right? So I can install this software. I can ask my policy to install the software if it is not present. All right. Now policy is behaving as as a

[5:29:30] authoritative application which will deploy something which will install a deploy something which will install a software inside a virtual machine. So in order to install that software, virtual machine

[5:29:43] should be authenticating the policy. Right? It's possible that someone outside of my network triggered a script targeting this virtual machine, triggered a script installing a a software. So this virtual

[5:29:59] machine will allow that that person that script to to install the software. Obviously that virtual machine will have to authenticate this traffic where it is to authenticate this traffic where it is coming from. whether this traffic is

[5:30:12] authenticate to install whether this traffic is authorized to install certain software or not. Obviously this virtual machine will authenticate and authorized right. So same goes for policy as well. Although this is coming from the same

[5:30:26] cloud, same account but virtual machine have to authenticate and authorize to check whether this policy is authorized to deploy antimalware or not. Understood or not? So in order to authorize what we are going to do in the

[5:30:40] next step is create a manage identity for the policy. Clear or not? What I explained when we were discussing about manage identity?

[5:30:53] Manage identity is an object ID is an identity for your application. When that create manage identity for that application. And then when that application requires access to the database or the storage, the database or

[5:31:07] storage will authenticate that application using that manage identity. If it's authenticated, yes. If it's authorized, yes, allowed. If it's not authenticated, do not provide the access. Similarly, for this policy, the

[5:31:20] policy that requires the remediation, you needs to create the manage identity as well. For our policy, we don't need it. or a certain policy where you need to remediate certain things in that case you need to create the manage identity

[5:31:34] as well. All right, I hope what I was trying to All right, I hope what I was trying to explain is clear. in basics tab you just selected the policy and the scope. So this is the

[5:31:50] policy and the scope. So this is the scope I selected uh my subscription and then the policy definition that I selected allowed location for resource group that's all in parameters tab we selected what

[5:32:03] location should be allowed which location should not be allowed in remediation for our policy doesn't require but for certain policy if required you can enable this okay when you're working with remediation you can

[5:32:16] create manage identity as well without manage identity ity remediation will not work. Okay, your remediation will fail. So once the manage identity is created, you can also provide the uh def uh sorry permissions to the policy as well. All

[5:32:33] right. And then next non-compliance message. So in our policy uh we need to add a non-compliance message like please deploy in any other region

[5:32:49] apart from India. So what this non-compliance message will do it will help user whenever user is trying to deploy the resource group and if that resource group is failing it will help user to understand why the deployment is

[5:33:03] failing. All right, please deploy in any other region apart from India. And then that's all. Once that is done, you can click on review create and then you can click on create. So now your policy is in place. Now remember before applying

[5:33:17] the policy, I deployed the resource group in India. Remember right now let's try again. Now before trying obviously it's better to sign out and sign in again to take the token or the the new token or the new policy. By default,

[5:33:33] token or the new policy. By default, it's uh it should be uh in in effect as soon as you apply, but sometimes it doesn't work. So, it's better to relog in. Okay. So, I logged out and then log in

[5:33:46] Okay. So, I logged out and then log in again. resource group in central India. So I search for resource group. I click on

[5:34:00] create. I give it a name a 305 RG03 and then central India is by default selected but if you see there is the non-compliance message that you added in the policy is is popped up please deploy

[5:34:16] in any other region apart from India so this is affected by the policy policy will not allow the deployment of this resource group in central India but if you select any other region apart from central India like Canada east or

[5:34:30] something it through all the pop-up is gone. Okay. So now uh it's confirmed that using policy we can enforce certain requirement that that is required uh by our company. So we can implement or enforce those kind of requirement.

[5:34:46] Next topic that we have is arbback. Now this is important topic to understand. Okay. So far we were discussing about the hierarchy and I mentioned that we have different scopes in the hierarchy. uh within that scope you can apply the

[5:35:01] access control or you can apply the policies. Policy we have already seen how to apply and we selected subscription as one of the scope. Similarly, arbback is something which will allow your user to give them

[5:35:15] will allow your user to give them certain rights. Rights like reader right so they can read something uh contributor right so they can contribute something to your subscription or uh owner rights. owner is like a full right

[5:35:30] owner rights. owner is like a full right okay u then you have uh there are different roles available built-in roles available in Azure that you can use to provide certain access in simple terms arbback stands for role based access

[5:35:44] control so as from the ZTM you need to make sure that least privilege access should be should

[5:35:56] be assigned to whoever wants the access. All right. So for that you need to understand arbback. A rbback is role based access control. Okay. I see Ram is asking for break. Break will take in half an hour. Okay. 9 at exactly at 9.

[5:36:11] Okay. We'll [snorts] go for half an hour of We'll [snorts] go for half an hour of break that time. All right. Or you guys tell me do you do you all do you all agree for a break right now or

[5:36:24] agree for a break right now or later? So, arbback arbback stands for role based access control. So far what we

[5:36:38] have what we have seen we have seen the hierarchy here also it's mentioned right you have management group subscription resource group resource. So this is the hierarchy. Now who can do what? You will be having thousands of users. You'll be

[5:36:52] having um uh thousands of applications. what that application could can do. How how as an administrator I assign them the access. So in order to assign them the access, you need to assign them the arbback

[5:37:05] role. Arbback stands for role based access control. So you'll be having depending on what they want to do. Assignments assignments can be at any scope. So you need to assign those roles at any scope whatever scope is preferred

[5:37:19] for you. Okay. You want some some companies like to manage the access companies like to manage at the management group level. If you want low management overhead, you go with management group. If you want more

[5:37:34] management overhead, that means uh every time there's a new subscription, you assign the same role to same set of groups and and and things, then you go groups and and and things, then you go at the subscription level. Okay.

[5:37:46] you'll be assigning different roles and you can come up similar to policies you can come up with different custom roles as well. There are lot of built-in roles by Microsoft Azio they have already

[5:38:00] created lot of built-in roles but at certain point in time you feel that built-in roles are not enough. So you can create your own custom roles as well. In easy 104 we have one practical as well where we where we show how to

[5:38:13] create a custom role. Okay. So what is arbback? Arbback stands for rolebased access control. So in order to see arbback you can go to any scope management group uh subscription

[5:38:27] at the resource group level. So I'm at the resource group level. If you see uh any point in time if you want to see at at which level I am so you can see that at which level I am so you can see that here. Okay. It says resource group.

[5:38:42] here. Okay. It says resource group. If I go to the subscription, subscription, you can see at what level you are. So you are at subscription

[5:38:56] you are. So you are at subscription level. So at any level arbback can be assigned that's why we have the hierarchy. Okay. So in order to see where I can assign the arbback or who is currently having what role you see this

[5:39:09] blade access control I am this blade is present at almost all resources all resource groups all subscriptions all management group. So whichever resource management group you you are at you can

[5:39:25] see this blade access control IM from here you can manage the access control. All right. Now if I go back to any resource group as well, you should see the same access control I am. If you go to management group, you will you will

[5:39:39] to management group, you will you will see the same. So doesn't matter uh from where you want to control. I would prefer for my company, we prefer management group. Why? Because we have lot of subscription. We don't want to

[5:39:52] keep doing the same thing over and over again. Assign once at management group level and you're free. Okay? then doesn't matter how many subscription you add there all subscription will inherit those particular role so best way and

[5:40:05] the best practice that Microsoft also recommends is to manage the access control at the management group level okay that would be easiest but doesn't matter at what level you are you should see this account uh sorry access control

[5:40:20] and there you should see all the access now let's come back to access control IM and here you can see the role assignments so this role assignment tabs provides you the current uh access that users are having.

[5:40:36] All right. All the users who has access to what access what level at this particular uh resource group level. So if you see I'm at role assignment here

[5:40:48] my Hotmail account is having the owner role and if you see the scope here sorry if you see the scope here

[5:41:05] What does it mean? What is the meaning of inherited? What level I am? At what of inherited? What level I am? At what level I am?

[5:41:18] explain the role. Please hold on. I'm what I'm trying to explain. Plus see that. Okay. I'll explain the role as well. Don't worry. Resource group level. What level I am at? I am at resource group level. I am

[5:41:32] access control blade. And here if you see this is one of the user account, Hotmail account. This user account is having this particular role. Owner scope is what? What is the meaning of inherited

[5:41:50] right? This is not directly assigned at the resource group level. It is being inherited from subscription. That means Hotmail account has got this role at the subscription level. That's why it's inherited.

[5:42:04] Hotmail account is having role at this level. gone directly at the resource group level and assigned the role it was inherited from the subscription so

[5:42:16] that's why it's important to define the scope first where you want to control the access you want to control at the resource group level go uh management group level go there and assign role at that particular level okay clear

[5:42:32] uh pankage is asking me to explain all the role obviously it's not possible to what are the important role I'll be explaining that okay now on the right hand side the next tab is the ro roles so here you see all the role now tell me

[5:42:47] is it possible to explain all the roles you see the number of roles you have and you see the number of roles you have and you have like 890 roles total okay so it's not possible for me to explain all the role but I'll be explaining the

[5:43:01] important roles that you now what what what all these roles are if you know We have storage account in Azure. In future topic we will be explaining storage So if you just search for that

[5:43:14] particular uh service like storage. So some roles are storage related roles. Some roles are we have seen key volt right? Some roles are key related roles. So if I just type key and search for it I should see the keyword related roles

[5:43:30] somewhere. So similarly for database you'll be having certain roles. For certain roles. So you'll be having different different roles depending on that particular service. Now which roles are important for you to understand from

[5:43:43] are important for you to understand from the exam point of view and from the the exam point of view and from the interview point of view are these roles. interview point of view are these roles. owner,

[5:43:57] reader, and there's one more role with the name user administrator or user access administrator. Okay, so let me just search for that.

[5:44:19] All right. So let me just explain these roles and then we can go on break. I'll take 5 minutes to explain these roles. Quite simple. Owner as the name specifies you can do whatever you want. So if someone is having owner role that

[5:44:32] means he can do he or she can do whatever uh he or she want to do with particular management group. So understand if I give someone the manage owner role at the management group level he can do whatever he wants at all the

[5:44:49] subscription within that management group. So if you have thousands of management group and you give someone owner role he gets the owner role of on all that thousand subscription at the end on all the resource group at the end

[5:45:03] on all the resources. So owner is like administrator in Windows. So he or she can do whatever they want. Okay. If any point in time particular role is doing, you can read the description here. So what this

[5:45:19] description says grants full access to manage all resources. So he or she can do whatever they want. Right? Next contributor. So what is contributor? It is also similar to owner. If you see grants full access to

[5:45:35] manage all resources but does not allow you to assign roles in Azure Arbback. What does it mean? So let's take an example here. You have user 01. You have example here. You have user 01. You have user 02. User 01 is owner

[5:45:50] user 02. User 01 is owner and user 02 is contributor. Okay. Now there is another user coming in joining in today. Now this user needs an access to virtual machine or resource group whatever. So owner can assign

[5:46:04] group whatever. So owner can assign access to this user 03 to any resources he wants whereas contributor cannot do that. So whereas contributor cannot do that. So that's the only difference. Owner full

[5:46:16] access can can assign or invite any other user as well. Not invite but can assign access to other users as well to any of the resources. can delete resource, can manage resource, can create resource. The only

[5:46:34] u only thing that contributor cannot do is assign access to other resource other is assign access to other resource other users. That's the only difference. All right. Next, reader. Quite simple. As the name

[5:46:47] Next, reader. Quite simple. As the name specifies, if user 03 is a reader, he can read everything but cannot modify, cannot delete, cannot do any anything else. Okay. The last role that I mentioned was user access administrator.

[5:47:10] administrator, he or she can assign access to any other user. So if I am UAA user access administrator, I can assign any role to third user any role whatever role they

[5:47:26] they need. So if tell me now if someone is having contributor and user access administrator both what is going to happen [snorts] he will become owner right he's

[5:47:40] contributor he can do anything whatever he wants to do plus he's getting another role user access administrator that means user access administrator g uh gives the ability to this user to assign any role to any other user

[5:47:55] okay so these are the four roles that you should be aware of and quite important from the exam point of view, from the interview point of view and any conf confusion on this roles. You just [snorts] need to remember four roles as

[5:48:08] [snorts] need to remember four roles as of now. Owner, contributor, of now. Owner, contributor, reader and user access administrator. Owner like administrator can do whatever he wants. Contributor like similar to

[5:48:22] owner but doesn't have the ability to assign access to other users. Reader as the name specifies can read whatever he or she wants to read. User access administrator has the ability to assign access to other users. So if I am user

[5:48:37] access administrator I can assign any role to any other user whatever us or she wants like he wants to manage virtual machine. So I can provide virtual machine administrator role to this user if I am a user access

[5:48:51] administrator. All right. Clear

[5:49:04] user access administrator that's like equivalent to owner. Okay. All right. Now tell me I have a question. I get an owner role. Can I create a new user in in Microsoft vendor ID?

[5:49:20] I I I got an owner role. See if I go back to the role assignments here. My account

[5:49:34] create a user account when I have the Hotmail account? I mean if I have the owner role, can I create the user account? People are saying yes. Okay. Okay. Now here it comes

[5:49:47] uh here you need to understand in Microsoft Azure the there are two types of roles. Okay. Arbback roles. So whatever we have

[5:50:00] Arbback roles. So whatever we have discussed so far owner contributor user access administrator reader these are related to arbback. Okay, arbback is mostly for managing the resources.

[5:50:15] So I can only manage the resource if I have the arbback role. I cannot manage the Microsoft entra ID. Remember these things. Okay. Microsoft enter ID user

[5:50:27] creation user deletion is part of which is is is part of governance or is it is is is part of governance or is it part of uh IM enter ID? It's part of enter ID. Okay. So there are two types of roles in Azure Arbback role and the

[5:50:42] uh Microsoft Entra ID role. So in order to work with Microsoft Entra ID, I need to go to Microsoft Enra ID. And here also if you see there are roles and administrators tab. If I want to work with Microsoft Entra

[5:50:55] If I want to work with Microsoft Entra ID, there are separate roles. If I want to work with resources, there are separate roles. Okay. So which role is to our back role, there are a lot of roles again available here. Okay. Uh

[5:51:11] it's not possible to go through each and every role. But which roles are important for you to understand is global administrator. So global administrator is like full access at your m at your Microsoft

[5:51:26] enter. So if you have global administrator role that means you can do whatever you want to do. Okay. If you have the global reader role, you can read whatever you want, but you cannot modify anything.

[5:51:39] modify anything. So if you get global administrator plus owner, then you have full access at the tenant plus at the governance level. Okay, at the arbback level. So you can manage

[5:51:53] resources, you can do whatever you want. Similarly, if you're global want at the tenant level, at the Microsoft Enra ID level. Okay, apart from that there are few roles that

[5:52:07] you should know is password reset administrator. So if you see somewhere you have password administrator which gives you access to reset password. So if there is a helpex team who just need to reset the password then

[5:52:23] you can provide this role to them help team right. Then there are uh there is user administrator role similar to user access administrator. So if you want

[5:52:36] someone to manage the assignment of uh user roles in Microsoft enter then this role is is something that you can assign. Okay just remember there are two roles in Azure

[5:52:51] Arbback role and Microsoft entra ID roles. Four roles, four important role that you should know from arbback side. Owner, contributor, user access administrator and reader. Main roles in in Microsoft entra ID is global

[5:53:08] administrator. It's like full role, full access at enter ID level, uh global access at enter ID level, uh global reader, full read reading capabilities, user user administrator similar to user access administrator but at the at the

[5:53:25] entraite level at the entra tenant level that means if I have user administrator role I can assign whatever role I want at the tenant level. Okay, I can assign someone password administrator role, someone global administrator, someone

[5:53:38] whatever as per their requirement. Clear? The last topic that we have about governance is landing zones. Now whatever we have discussed so far, management group, subscription, resource group, tagging, policy, arbback. So out

[5:53:53] of this tagging, policy, arbback are the three important uh features that helps you to achieve the governance. The rest is just the hierarchy. Okay. Rest like resource is nothing but the hierarchy. This actually won't help you to uh

[5:54:10] implement the governance. To implement the governance you have tag, policy and arbback, right? So using using policy we can restrict certain things and we can make sure that we are meeting our compliance requirement. Using tag we can

[5:54:23] organize our cost or automation and using arbback we can organize or maintain our access control. So what is this? This last topic, this landing zone is a is a is a concept where you can create

[5:54:39] your Azure platform. You can uh maintain or configure your Azure platform before landing your workload. That's the only meaning of landing zone. Okay? Like for meaning of landing zone. Okay? Like for example, I want to uh land a

[5:54:54] example, I want to uh land a airplane in my city. So I need to build a air airport first. that airport within that airport we have runway. So runway is nothing but the landing zone for that airplane. Right? Similarly, if I want to

[5:55:08] let's say uh have a shop in my mall. So I need to first build entire mall and then within that mall we will have different uh area square of of shops and according to the requirement of the c of the users or of

[5:55:25] requirement of the c of the users or of the uh uh the shop owner they will buy their own shop. So in order to make sure that shop uh is is available we need to first build entire mall first. Similarly uh in the airplane in the airport

[5:55:39] terminology we need to make sure the runway is there so that my plane can land. Similarly in Azure we have landing zone concept where you can define all of

[5:55:51] your policies, define all of your arbback rules, define your ARM template, define everything and then deploy your application, then bring your application. Okay. So landing zone is just a concept in Azure where you can

[5:56:06] prepare Azure platform before landing your workload. So how to prepare? Obviously you need to define the policies that you want to come up with. You need to define who will have what rules. You need to

[5:56:19] define if you want to use tags and all. Right? So in Azure a simple everything is blended into this and you can create your own landing zone. So in Azure we call this as blueprints. So if I go to blueprints and there you can see um uh

[5:56:37] you can create a blueprint and there you can see all the landing zones. Okay. You can start scratch and you can define your own policies or Azure has given you some some uh samples like foundational

[5:56:52] landing zone, migration landing zone. Okay, common policies that it's like a best practice policies that you should be using. If your company wants to be be using. If your company wants to be ISO 2000 27,01 compliance, then you can

[5:57:06] use this landing zone. If your company wants to be have a shared services right if you want to create resource group with certain arbback so you can create this kind of landing zone. So if I select the foundation one I'm just

[5:57:21] showing you uh this is nothing but the best practice landing zone that Azure has created. So you just have to give it a name like for example foundation landing zone. Okay. And then where you want this uh location

[5:57:35] to be. So you can select management group or or subscription. So I'll select subscription here. Okay. I I don't see management group since this user simply user doesn't have access to that. Next in the artifact tab you can define all

[5:57:50] of the policies. So within subscription if you expand you see this policies [snorts] append cost center tag. So tag will be mandatory uh tag will be mandatory for resource group. You will you are enabling monitoring. You will

[5:58:04] define allowed locations for your resources. You'll define allowed are nothing but all the policies. So what landing zone is come up with you want. If you want to add any policy later, you can add that as well. Like

[5:58:19] click on add artifact, select artifact type, policy, then select what policy you want to you want to add whatever you want to do. Okay. So that policy is So what we are doing with lending zone we are making sure that we are compliant

[5:58:36] So whenever people are creating resources they will make sure that tag is assigned since this policy will make it mandatory. Then we are enabling monitoring for all of our resources. We are defining which location to deploy

[5:58:50] the resources in. So these are all the policies. You can add as many policies policies. You can add as many policies as you want. Apart from that you're creating a resource group for shared services. So resource group will be

[5:59:02] created where keywalt will be deployed, log analytics will be deployed, right? where all of your virtual networks will be deployed. Another resource group where you will be having identity service. So if you have uh domain

[5:59:17] controller or any other identity service, you can deploy it there. And then when you when everything is deployed there is an additional resource first application. All right. So landing zone is just a way

[5:59:32] All right. So landing zone is just a way or or or a way where you are you are or or or a way where you are you are um blending or adding all of the stuff that we have learned today like we are creating

[5:59:44] resource groups. We are making making the tag mandatory. we are applying certain policies that require for our uh our compliance then we are providing the arbback rule. So landing zone is just a logical

[6:00:00] you can say a logical way of making sure that your infrastructure is ready your platform is ready before you start adding the application. All right. If I want to provide any arbback role at at any point at let's

[6:00:17] say this resource group. So I can select the artifact type role assignment and I can provide owner role to any uh user or or any group or I can add it later as

[6:00:29] well once the resource group is created. All right. So that's something that you can defide beforehand before bringing your application. Now initially when your application. Now initially when people started using Azure this was this

[6:00:42] concept was not there but uh Microsoft introduced is introduced it very u in in a year or so when Azure Azure was there. So initially people were people

[6:00:54] were not aware of this landing zone thing. So they started deploying resources without considering the compliance and all. So blueprint is a way where you can define your landing zone first and once you have defined

[6:01:07] your landing zone you can bring your application. Remember landing zone is to be done uh before bringing your workload. Once you have deployed your workload

[6:01:22] after that if you are bringing the landing zone you can still bring it but uh that that's not how it should be working. All right landing zone should consider it's like your plane in order

[6:01:34] to land the the airplane you first need to have runway. If you do not have Right? So similarly, landing zone is something that you should be uh creating first or deploying or making sure it's ready first before you bring your

[6:01:49] resources. All right. So that's about a landing zone. Yeah, you can create custom landings on whatever you want to, whatever you want. So, you just need to go to blueprint and

[6:02:02] there you need to click on create. Okay, here you can define whatever you want. I selected the foundation one. It you have the option to start with the blank. the option to start with the blank. Okay, just name it uh provide the uh

[6:02:15] location, the definition location and start adding your artifacts. So, I'll add what I want. I want policy, I want role, I want ARM template or I want resource group whatever I want. So if I want policy, I select policy from here.

[6:02:29] Add then again add artifact policy. Then I add again another policy whatever I I add again another policy whatever I want. Okay. So you can select your own want. Okay. So you can select your own uh blueprint your own uh landing zone as

[6:02:42] uh blueprint your own uh landing zone as well. landing zone in real scenario? Okay. Have you understood what landing zone is? Forget about what is the use as of now.

[6:02:56] Have you have you understood what landing zone is? All right. So what we are doing in landing zone? We are just defining the policies. We are just defining the arvback. Have you understood what is the uh requirement or

[6:03:08] understood what is the uh requirement or use case of policy arbback in in real world to meet compliance you need to meet compliance what landing zone is giving landing zone what we are doing in

[6:03:20] landing zone we are just comprising or blending all this thing in into one thing instead of [snorts] doing this separately every now and then what we are doing we are creating a landing zone and we are adding all this stuff at once

[6:03:33] so if you're adding adding all this stuff at once what when and after adding once you're on when once you're deploying your resources you're deploying VM storage account or whatever now tell me these resources will be

[6:03:48] now tell me these resources will be compliant to your requirement or no this resource will be compliant to your requirement or no [snorts]

[6:04:02] that whatever we are deploying is compliant. So next year when there is compliant. So next year when there is auditing uh audit auditor will will come compliant to whatever certificate we want whatever compliance requirement we

[6:04:16] want to meet. So landing zone is just a logical thing where you are just comprising all of your policies that you want into one landing zone. So at future point in time if you want to see all the policy you can see all at in central

[6:04:28] place what is assigned what is not assigned. assigned. Okay. lending zone is. So when I deploy any resource that resource will be compliant

[6:04:42] to whatever I'm defining over here. Now every company will have their own requirement. Every company will have their own compliance requirement. So depending on your compliance requirement, you'll be adding policies

[6:04:54] over here. Whenever people are deploying resources, that resource should already be compliant. Why it's compliant? Because if that resource is not meeting certain policy, the landing zone will not allow that user to deploy that

[6:05:08] compliance whatever you have defined here. Okay. [snorts]

[6:05:24] just for you to understand what landing zone is. I'm not saying that you need to apply the foundation lending zone at your organization. Okay? You need to understand first what landing zone is. Landing zone is a blueprint of your

[6:05:38] Azure platform of your cloud platform. Within that blueprint, you're defining what I should be deploying, what I should not be deploying. So if I go here, I can define the location. This is my subscription where landing zone is

[6:05:52] being applied. I click on next artifact. And here I'm defining what policies I want to deploy. So I select all the policies. For example, I don't want to deploy high configuration virtual machine. So I restrict that using a

[6:06:08] policy. I want to make sure that tagging is in place. So I select any policy related to tag. I select that and I add tag over there. So what I'm doing here, I'm preparing my platform. This is my Azure platform. I'm adding certain

[6:06:24] restriction. So and so VM is not allowed. So and so location is not allowed. So and so uh skew is not allowed. Making sure monitoring is enabled. Making sure we have shared services. So everything is

[6:06:37] zone is not a physical thing which I can touch and see. Okay. Now once I have defined all this thing then my team whoever is responsible for deploying resources when they start deploying the resources that resource will be

[6:06:53] all these requirement which is defined over here. If it's meeting that policies and that requirement then only the resource deployment will be allowed. If it's not meeting it will throw some error and ask the user to fix and then

[6:07:08] error and ask the user to fix and then user will deploy. Okay. So why why we sure that whatever resources is being deployed is compliant deployed is compliant compliant to the requirement. Okay,

[6:07:22] that's what the the meaning of landing zone. a project. It's just an example how you can use landing zones in real world. All

[6:07:38] can use landing zones in real world. All right. traffic enters. See traffic is is a network part right landing zone is just

[6:07:54] def definition of policies and all where you're defining everything. Now where traffic will enter that will define at your network level. These are not the network related policy. These are the governance related policies.

[6:08:07] Okay. [snorts] Sur is saying okay you means to say if I select 27,0001 the compliance will meet according to 27,01 or else it won't allow us to create as

[6:08:20] we like in 27,0001 what is defined what is required to meet that particular certificate that particular ISO certificate so if I select that there will be certain policy which Microsoft has already defined okay so first I

[6:08:35] subscription and when I go to the artifacts added certain policy which will make sure you're meeting ISO 27,01.

[6:08:51] So whatever is defined in that policy, if you're when when you're deploying your resource, if that meeting that criteria, you're allowed to deploy. If be allowed. So if the resource is not deployed, obviously the auditing is is

[6:09:04] not in the question here. Okay. If resource is deployed and it's not meeting certain criteria then you're not compliant. Your your whatever you're doing is non-compliant and when ISO team comes to audit your organization or your

[6:09:17] platform they'll see that you're not compliant. So if you're using this then it will make sure this landing zone will make sure that whatever resource you are using is compliant to this particular policy whatever is defined in that

[6:09:30] policy. Okay. subscription or the management group level. So it's it's nothing but policies

[6:09:45] arbback and everything. It's not something fancy or something new or are deploying. It's not a physical resource a logical thing. Okay. So if you see the definition location here this is nothing but the scope. You can

[6:09:59] keep it at management group at subscription at resource group. Okay. management group and subscription not at the resource group. Okay.

[6:10:11] With policy what you're doing where you can apply your policy at management group or at subscription. Same thing with the blueprint. Same thing with the landing zone. Okay. [snorts]

[6:10:30] predefined rules or res uh predefined defined over there and when you are deploying your resources those conditions will be evaluated.

[6:10:42] If your resources are meeting those conditions resources will be allowed to deploy. If not uh resources won't be deployed there would be some error like like I'm trying to deploy resource group right now and it's not allowing me.

[6:10:55] Right? Why it's not allowing me? If I click on create resource group and I I allowing me to deploy. Why? What is the reason? Why it's not allowing me? Because what I'm trying to do is non-compliant to my organization.

[6:11:10] deploy something at central India which is non-compliant to my organization. Similarly, landing zone will do the same thing. It's not something new. It's not something different. Okay? It's just that you're blending your policies

[6:11:26] with your arbback and uh with the if you want to deploy anything in in in in uh freehand you can use ARM template and all to deploy blended together and it's called as landing zone that's all

[6:11:43] okay clear location. That's all. And now I'm compliant.

[6:12:19] Okay. So case study is very simple for this. So if you can open this uh and go to governance. So here we have the case study.

[6:12:52] uh I know this case study is asking you to design uh a governance solution for your company. So let's read through it. fictitious fictitious company that we will be using and Microsoft uses this

[6:13:08] name for defining anything right. So Tailwind traders is planning on making governance solution. They have asked for your assistance with recommendations and questions here. are the specific requirement

[6:13:22] cost and accounting. Telvin traders has two main business units that handles apparel and sporting goods. Each of the business unit consists of three departments product development, marketing and sales. Each business unit

[6:13:36] and subunit will be responsible for tracking their Azure spend. At the same time, the enterprise IT team will be responsible for providing companywide Azure cost reporting. Another project, new development

[6:13:50] development project for customer feedback. The CFO wants to ensure all cost associated with the project are captured. For the testing phase, workload should be hosted on lower cost virtual machine. The virtual machine

[6:14:06] should be named to indicate they are part of the project. Any instance of the non-compliance with resource consistency rules should be automatically identified. So these are the task. So for cost and

[6:14:19] accounting what are the different ways Telvin traders could organize their would be the best to meet their requirement design two alternative hierarchy and explain your decision make decision-m process. So what you need to

[6:14:33] do here is you just need to come up with the management group hierarchy for cost and accounting for this Telvin traders. Okay. So what they have mentioned is you

[6:14:45] need to come up with two alternative hierarchy and explain your decision-m process. Then for the new development project what are the different ways Telvin traders could track cost for the new development project. How are you

[6:14:57] ensuring compliance with requirements of virtual machine sizing? Uh propose at least two ways of meeting the requirements. Explain the explain your final decision. So in simple you just need to come up with with a management

[6:15:13] group strategy. Okay. How you'll be defining the management group. So what defining the management group. So what I'll be doing is the main tenant root group. Obviously you'll be having it behind within that tenant root group

[6:15:26] I'll be creating a management group with Telwind traders. Then it's totally up to Telwind traders. Then it's totally up to you. You can divide it as per the the uh unit business unit apparel and sporting goods or you can keep

[6:15:41] everything in same business unit and divide it on on the uh subscription divide it on on the uh subscription level. Okay. So what I'll be doing here apparel this is one management group and then sporting unit this is another

[6:15:55] management group. Then within this business unit you have three department product development, marketing and sales. Each business unit has this uh this department. Okay. So what you can do you can again create three management

[6:16:09] do you can again create three management group if you want having uh product development. Here you'll be having marketing here you you'll be having sales. Sim similar here product development marketing and sales.

[6:16:25] subscription depending on what subscription they need since subscription is not mentioned over here. Okay, since they are saying that each business unit and subunit will be responsible for tracking the Azure

[6:16:37] spend. So it's better to have a separate subscription for each or else you can have a single subscription and uh if you are having single three different management groups over here. So another strategy could be like

[6:16:50] this tenant root group Delvin traders and then two business unit apparel and uh sporting apparel and sporting and then you can have one subscription each okay within each subscription in order to track the cost. You can use tags and

[6:17:07] all okay in order to separate the talk if you're going with single subscription but here they they mention that uh each subunit will be responsible for tracking their Azure spend. So it's better to divide them into three different

[6:17:22] subscription which will be easier for you. Why it will be easier because one subscription will have cost and you can simply put that in their cost center. Right? So I can have three subscription like this is for product development,

[6:17:35] this is for marketing, this is for uh for sales. Similarly in uh sporting unit I'll have three different subscriptions. So either you can divide them in three one each one subscription each or you can simply put subscription within the

[6:17:50] main management group. All right. So these are the two different uh hierarchy you can come up with. That's totally up to you which you want to go. Okay.

[6:18:03] different ways Tailwind traders could track the cost? So again, you can have a track the cost? So again, you can have a new management group here for uh new development project. I I'll mention that as NDP. Okay. How are we going to ensure

[6:18:17] the compliance? Obviously, we need to use policy. So you can just mention here as your policy. Okay. And if you have any other way, you can come up with that way as well. like you can put management group and then subscription or directly

[6:18:31] subscription totally up to you. All right, just go through this uh subscript uh case study and come up with a solution and uh I I did not get any

[6:18:43] solution from you guys for the last case study. So you need to go to draw io and come up with a solution and send me that solution over the email over my personal solution over the email over my personal email. All right.

[6:18:57] Like this. So you did not came up with any solution. management group. Same thing what what what I explained.

[6:19:11] Same thing what what what I explained. Okay.

[6:19:26] Somewhere you should have management group.

[6:19:54] tagging or something. So you can add a text over here. So this is let's say my tenant root group.

[6:20:09] all that I leave to you. Okay. This is my tenant root group. Then I can copy paste to have the same thing here. This is my Telvin traders just renamed. Then I can have additional management group. So

[6:20:22] just similar to what what you're seeing over here what what I what we discussed right now you need to come up with that solution. Okay. Mustak is asking how to get Azure icon. So in order to get Azure icon you first

[6:20:38] go to draw io apps.net and then from there you can simply click on more shapes here and here once you click on more shapes you should get Azure. Just take check this box Azure and click on apply. So you should get the Azure icon.

[6:20:54] Okay. All right. Any questions on case study no questions, we can move on to the next topic. So next topic that we have is design compute service. Okay. So if you go to a 305 study guide or a 305 uh

[6:21:14] learn path, this is this is the topic that we are covering right now. So we have completed this except monitoring. So monitoring we'll be doing later uh once we have covered

[6:21:26] governance, we have covered authentication and authorization. Monitoring is pending which we will cover at the end once we have done with all the solutions. Now we are moving on to the infrastructure solution. Design

[6:21:41] infrastructure solution and within design infrastructure solution we are going with the compute solution. Design and Azure comput solution. This is the this is the chapter topic which uh topic we we are covering right now. Okay.

[6:21:56] All right. So before we start I just need to answer from you what is a compute service? Now we have seen uh in basics of cloud computing that cloud computing is nothing but the delivery of compute services over the internet. So

[6:22:10] what that compute service mean? What is compute service?

[6:22:27] what only VM is compute service? What what is that compute service? [snorts] someone says compute, compute is nothing but the computation

[6:22:41] uh services like like memory which is nothing but RAM. Okay. Uh CPU nothing but RAM. Okay. Uh CPU right and then u storage. So these are the three thing which comprises of compute service. In simple if someone

[6:22:57] asks you what compute service is. So compute is just the home to your application. Okay. Compute service is nothing but home to your application. Compute is actually where application lives. What

[6:23:12] is application? We have discussed is quite simple. Application is nothing but list of files. So when developer codes they codes in a file. So you'll be having file like if developer is writing in Python they'll be having certain py

[6:23:25] if they are writing inn net they'll be having some car related files right. So application and in order to make sure your application run using a runtime you

[6:23:37] need a home for that. So that home is nothing but the compute. Now that can be anything that can be a virtual machine, can be a physical machine, can be app service, can be a container. So there are different different compute services

[6:23:51] available in Azure. That's what we are going to see uh in this topic in this chapter. All right. So in simple compute is home to your application. Now remember one thing whatever we will be learning and for whatever reason the

[6:24:06] information technology is out there for whatever reason the infrastructure background is out there is because of the application if there are no applications in the world if there are no web app there are no desktop app then

[6:24:18] it is not required okay business can can happen physically by by making a physical uh building a physical shop and asking customer to come physically there right if there's no app we are not required cloud is not required onrem

[6:24:34] infra is not required so whatever we are doing is for the app all right so application in order to make sure your application can leave you need to have a compute service in place and in Azure what

[6:24:47] compute services we have that's what this topic is about we have lot of compute services so just to describe or or make you uh services these are all the compute services we have in Azure

[6:25:04] virtual machine app service kubernetes service Azure function Azure batch logic app one is missing which is your container instance right ACI so if you container instance right ACI so if you see every compute has its own dedicated

[6:25:19] section so I'm not explaining each and every service here I'll keep it to it every service here I'll keep it to it own u dedicated slide all right for this slide Is it clear what compute service is for

[6:25:34] me to keep an application? For me to make sure that my application uh can be accessed by the people or my application actually can run I need to have compute service in place. All right. So in that compute service

[6:25:49] which is nothing but home to my application. I'll keep my application and application nothing but files. Is that clear guys? what compute is.

[6:26:03] service. Now out of this out of all this compute service, not all comput service are meant to keep the application. Okay. Uh not all comput service are meant to Uh not all comput service are meant to host the application. Like out of this

[6:26:16] six services, the first three services Azure virtual machine, Azure app service and Kubernetes service are the services where you you'll actually deploy your application. Okay, rest are are different. They're

[6:26:29] not they're not mean to host the application. Okay, so we'll see what is the difference and what what each comput service is used for. So which compute service to choose from? There's a there's a long or or a big uh

[6:26:45] you can see a flowchart that Azure has created. Now which one to choose at at what point in time? uh this flowchart will help you to decide but apart from that if you sit until the end of this obviously today uh I don't think so

[6:27:02] we'll be able to complete or or cover all the services but tomorrow we we will be done with this compute section so tomorrow once once we are done with the compute section you'll be able to identify or define or

[6:27:16] uh take a decision on which compute service to use for your for your work or for your use is all right but let's go through this flowchart and see which compute service to choose at what point in time

[6:27:30] so from here you are starting all right the first question is are you migrating from on-prem or I mean from anywhere not only onrem or you are building new okay so if you are migrating go this way if you're building new go this way

[6:27:45] all right so let's say we are migrating since when I started my Azure career most of the customers were migrating and I helped my second or third company to

[6:27:57] I helped my second or third company to migrate. We had the uh everything in in data center in Australia. So we migrated it to Azure since we were going global. [snorts] So if you're migrating these are your

[6:28:09] options. Okay. So let's come over here and see. Now once you say yes we want to migrate. So th this way you need to go left side and here are you doing a lift and shift or you are doing cloud optics lift and shift is like whatever your

[6:28:24] application's condition today is you're just using asis and you are just shifting it to Azure that's all you're not changing anything okay you're just lifting your application from onrem AWS wherever it is however it is it's

[6:28:38] written in old u old format or old framework you're just using that framework and shifting it to Azure. That's all. Okay. So, if your answer to lift and shift is yes, you'll go this way. If your answer to cloud optimize is

[6:28:55] yes, you'll you'll go this way. Okay. So, let's consider lift and shift. So, I'll I'll go I'll go this way. Now, once you're lifting you're using lift and shift, is your container using uh I mean is your application containerized? That

[6:29:10] means are you using container platform? So if you're using container platform you go this way. If you're not using container platform you go this way. So platform. So if you're not using container platform we have two options

[6:29:23] to choose from Azure app service or Azure virtual machine. Okay. Now when this yes and no is happened is whether your application is is web app or API. So if your application is just a API or web based

[6:29:39] you can go to app service. If it's not, you can go to virtual machine. If your application is containerized, you again have two or three options. You can go have two or three options. You can go for Kubernetes services. You can go for

[6:29:52] Azure app service again with container option or you can go for Azure container instance which is not mentioned here. Okay, it's mentioned here somewhere options you have when your application is containerized.

[6:30:06] Okay, so we have covered this. When you are migrating, you have this these application to Azure, you have these options. You can make use of virtual machine. You can make use of Azure app service. You can make use of Kubernetes

[6:30:20] service or you can make use of Azure app service with container. These two doing containerized application. That means you're using Docker or any other container platform and you have containerized your application and

[6:30:34] you're deploying it as a container. So either you can use EKS as your Kubernetes service or Azure app service. If it's not containerized then you have left with virtual machine or Azure app service. Okay.

[6:30:48] you're building new. So if you're building new obviously you have all the options. Now which option to choose when do you need full control? Do you need a full control on operating system? Do you want to make u uh control

[6:31:04] system? Do you want to make u uh control your operating system like every using Windows operating system you have to patch it. Even Linux you have to patch it. So do you want those kind of full control? If yes virtual machine is

[6:31:19] the option for you. Okay. As I mentioned your application is not hosted on Azure batch service but do you require the HPC workload? HPC stands for high performance compute. So do you need that kind of workload? Uh do you require high

[6:31:33] performance? Mostly you'll be using it for for when you are processing big huge amount of data. So for your big data pipeline and all you'll require HPC. Do you require that kind of workload? Then you go for Azure batch service.

[6:31:48] same are you using containerized application okay micros service architecture if yes you have azure container instance service fabric or container instance service fabric or kubernetes services okay uh if no if if

[6:32:04] you want to go with eventdriven architecture you have Azure functions or logic app okay logicap is not mentioned here but that is also used for for event driven okay and the last one which is azure app service it's like a platform

[6:32:19] azure app service it's like a platform platform as a service uh platform as a service that that that you can use like you don't want to have you operating system that means you you want to uh outsource the patching and all to

[6:32:34] Microsoft. So in this case you can make use of your app service. Now I see it's it's overwhelming. Obviously you can't get entire workflow or entire flowchart in in just 5 minutes but as soon as we go to go through each service uh we'll

[6:32:50] revisit this this flowchart again at the end and at that point in time obviously end and at that point in time obviously it will make sense for you. Okay. So service, any questions on the compute service for now? You just need to

[6:33:03] understand that compute service is the home to your application. That's all. Any questions on this before I move to the first service that we have? [snorts]

[6:33:23] Mustak is asking storage also. What do you mean by storage also? See we are not uh understanding so storage as of now we're means where my application will be running or hosting okay

[6:33:38] related to migrate we we are not migrating storage as of now okay storage we have a dedicated chapter you your questions will be cleared there uh how

[6:33:50] questions will be cleared there uh how storage is handled when it comes to hosting an application ition. Okay. migrating storage as of now. It's just application related things.

[6:34:04] All right. So let's go on to the first topic which is Azure virtual machine. This is the simplest uh you can say simplest compute service available in Azure that you can use to

[6:34:17] host your application. Now I'm I'm damn sure that everyone here might have worked with Azure virtual machine or if not you might have worked with uh EC2 not you might have worked with uh EC2 uh MS Amazon web services EC2 right or

[6:34:32] you might have worked with HyperV virtual machine or VMware virtual machine if you haven't worked with any just consider this virtual machine as just consider this virtual machine as your own laptop but running on Azure

[6:34:45] virtual laptop running somewhere on Azure your data center. Okay. So what is virtual machine? Virtual machine is software computer running on Azure as

[6:34:57] the name specifies virtual. It's not a physical thing. It's a virtual machine. All right. So it's a virtual software virt sorry software computer. So what this virtual machine gives you this virtual machine gives you the storage

[6:35:12] like in our laptop. What do we have? We have hard disk right? So what that hard disk does? It allows us to store something. Similarly, this virtual machine gives me storage where I can keep certain files like operating

[6:35:25] system. Obviously, my operating system will be there. Apart from operating system, I can add additional discs and I can keep my application related file if I want to. That's not mandatory. You can keep your I mean OS will be the uh the

[6:35:41] default disk that you'll be getting. Apart from the default disk, if you want to add additional disk, you can add to keep your application data. Right? So, cloud-based ondemand

[6:35:55] scalable computing instance that uh you can deploy whenever you want. You can decommission or delete it whenever you want. So, it's an ondemand compute. You

[6:36:07] need it, deploy it. You don't need it, just delete it. Okay. So, what are the features? virtualized computing. You don't need to have a physical computer at your home and then create a virtual machine. You

[6:36:20] virtualized. Just deploy it using Azure portal, PowerShell or CLI whichever is whichever you prefer prefer. The usage is to host an application. So you'll be having OS. So it supports Linux as well

[6:36:35] as Windows. Whichever is your preference. you when you're creating or deploying a virtual machine you just mention Azure that I need Windows or I need Linux and once you have Windows or Linux installed on top of it you can

[6:36:48] deploy your applications okay scalability for it's scalable as this is one of the feature or benefit of cloud computing so any point in time if I feel

[6:37:01] that 2 GB RAM is not enough for me I can scale it to 4 GB GB or 8GB whatever according to my requirement. So scalability is the feature that you get scalability is the feature that you get when it comes to compute virtual machine

[6:37:16] networking. I have the option to uh define who can connect, who cannot connect. Okay, who as in which IP can connect, which IP cannot connect. So that's something that we can define. So networking is attached with it.

[6:37:30] management you can manage like login you can take a remote access of this virtual machine and manage it or certain management like changing the size and all you can do it directly from Azure portal or CL PowerShell okay billing is

[6:37:45] a pay as you go so you will be build you will be build hourly so if I keep my virtual machine deployed uh for let's say 24 hours so I'll be

[6:37:59] paying for 24 hours. Okay. Next day I stop my virtual machine. I'm not running it. So I won't pay for the virtual machine for the compute. For storage obviously you'll be paying. Okay. With storage the the disk that that is that

[6:38:12] is deployed. So for disk I'll be paying but if I keep it stop I won't be paying but if I keep it stop I won't be paying for the compute. All right. So it's pay as you go. Apart from pay as you go you can reserve virtual machine for like 3

[6:38:26] years. So there are reserve plans. So if I if I want to reserve, I can reserve the virtual machine. So I can go to reservation and reserve. support it. But if your subscription supports it, you can reserve virtual

[6:38:42] machine for 3 years. Okay. Right now my subscription won't support. So it won't it won't show. But you can reserve it for 3 years. So if you can see this subscription doesn't support it. But if I reserve it, I'll be saying saving

[6:38:56] around 40% of the pay as you go cost. Can see this uh here.

[6:39:18] and if you see here if you see here if you go for reserve plan so everything is mentioned here depending on the size which size you are choosing you go for 1

[6:39:31] GB RAM this is the normal cost this is the saving plan this is again threeear saving plan so if you go with threeear saving plan you'll be having around 54% saving plan you'll be having around 54% of savings okay

[6:39:44] This question from Mustak. When should we reserve and when to pay as you go? we reserve and when to pay as you go? Okay. Do you want to save money to save money? So if you want to save money, go for reserve plan. You'll save

[6:39:59] money, go for reserve plan. You'll save around what 54%. Now when to decide not? You ask your project manager is this project going to be running for at least 3 years? If he says yes then go for

[6:40:13] threeear saving plan. So you'll save you'll save 54%. If they're not certain you'll save 54%. If they're not certain that we might close this project in one one year or so. So don't go for saving plan. Pay as you go. Okay. Totally

[6:40:29] depends on project by project basis. Are you going doing are you deploying a virtual machine for just quick test? If yes, don't go for reservation plan. Go for pay as you go. Since I'm I'm I'm doing it for testing and I'll be de

[6:40:43] decommission decommissioning or deleting it in in after 3 months 4 months whatever right so at that point in time just go for pay as you go okay [snorts]

[6:41:00] why it's reserved if you want if you are sure if you know that it it you you are reservation is not for you okay just go for pay as you go since reservation uh

[6:41:12] you can't cancel it if you can there will be certain cost okay uh so it will charge you more as pay as you go if you cancel it before the contract all right

[6:41:32] I'll take the questions later VM sizes so there are different types or family so there are different types or family of VMs is available in Azure. All right. First one is general purpose. So general purpose is mostly like for not for

[6:41:47] production use. Okay. You can use it but it's not recommended for production use. it's not recommended for production use. It's used for uh dev test uh demonstration like the trainers are are are

[6:42:01] encouraged to use general purpose VMs for demonstration purpose. You will be deploying virtual machines. So you should use general purpose or or your hands on right. So this general purpose are for dev test or demonstration or

[6:42:15] those kind of things. Compute optimize will get a a powerful CPU will get a a powerful CPU uh to memory ratio. Okay. So you'll get more processing power as compared to memory. So you'll be getting a good CPU

[6:42:30] as compared to memory when you go for compute optimize. Okay. In memory optimize you'll be getting powerful memory. So your memory processing would be more as compared to CPU. So where you'll be using memory optimized. So

[6:42:44] memory optimized can be used when you want to host a database. So you need to create a database server. So we know that we need a powerful memory for database. So SQL DB, MySQL, whatever database engine you want to install on a

[6:42:58] VM at that uh for for that scenario. If you're using a virtual machine then you go for memory optimized virtual machines. Compute optimize when you need more processing power like you want to host an application. So we know that uh

[6:43:12] in order to host an application we need more compute we need more CPU. the CPU can process those requests quickly, right? Or else if you're using a virtual machine for a solution where you are encrypting or decryting or you're

[6:43:27] working with SSL quite often, then you go for compute optimiz since encryption removing encryption working with those algorithms requires a more CPU. So we go for CPU for that. CPU compute optimize for that

[6:43:43] storage optimize where your IOPS input output operations per second uh will be optimized. So if you go for storage optimize so where you can use storage optimize for example my company is coming up with something some service

[6:43:57] like Google Drive where I'll be storing people's data. So when I'm storing people's data when they are trying to access I need to make sure that data is readily available. So in that point in time I I would be using storage optimize

[6:44:11] or let's say my company is creating a SAN kind of solution for my internal software or for my internal environment or organization. So sand kind of

[6:44:24] uh solution requires good throughput and So at that point in time you can go for storage optimized. Okay. Then you can go

[6:44:37] for GPU. GPU stands for graphic processing unit. Because when you are when you want to work with graphical images or videos where you want to make

[6:44:49] sure that whenever people are rendering something it should be fast. So at that point in time you can you can go for GPU like for example gaming servers or u nowadays uh uh artificial intelligence right llama or something you want to

[6:45:04] right llama or something you want to host you can go for GPU. Uh then the last one we have is HPC which stands for high performance compute. So if I need high performance compute like I'm coming up with my own

[6:45:17] big data pipeline and I want to use virtual machine for that. So I can go for HPC kind of size of virtual machines. Apart from that there are lot of lot of other sizes available in the in in the Azure portal or in the Azure

[6:45:33] platform. But these are some sizes that you should you should know. Okay. Once again you have general purpose which is for dev test kind of environment not meant for production. Compute optimize where you need high CPU right I need

[6:45:48] more CPU power. For example I'm hosting my application and that application is working with something known as encryption decryption and application want to process that very quickly. So I need high CPU there. Memory optimized

[6:46:02] when you need more memory. Okay, I mean powerful memory, not more memory. Powerful memory. Uh so if you're hosting a database kind of thing um where you require more memory, then you can go for uh memory optimized storage optimized

[6:46:17] where you need good storage like for example you're coming up with sand storage kind of thing or one drive kind of thing or Google drive kind of thing where people are storing and you need a quick read access to that to to to that

[6:46:30] data which is written over there. So you can go for storage optimize GPU graphic processing unit where you need more more graphics like gaming servers, AI rendering, marketing materials, HPC higherformance compute where you want to

[6:46:45] all kind of things and you want compute for that you can go for HPC uh type type of Azure virtual machine. Okay. Then if you want to create clusters of virtual machine then in Azure we have something known as virtual

[6:47:00] machine scale sets. So virtual machine scale sets are like deploying virtual machines as a group of virtual machine like a cluster. So you'll be deploying more than one instance. [snorts] Why we have scale sets over here? If let's say

[6:47:14] I'm hosting my application in one virtual machine and if that application goes down what is going to happen? My application will be impacted right. So if I don't want to do that what I can do I can deploy that virtual machine scale

[6:47:26] set instead of single virtual machine in instead of individual virtual machine I deploy more than one virtual machine as a scale set and in that case Azure will make sure that if one virtual machine goes down another one will be created by

[6:47:39] Azure. So that will give me high availability which means if one of my virtual machine going down it's not impacting my application since my application can still serve the requests coming in from

[6:47:51] user uh using additional instances. All right more on this later we have a dedicated slide for virtual machine scale sets as well when we go to the high availability uh concepts. Okay, but for now virtual machine scales as it's

[6:48:05] like a group of virtual machines that you're deploying together and if one virtual machine goes down, you still have uh other virtual machines which have uh other virtual machines which will serve your requests. Okay.

[6:48:17] Now main thing when to select as your virtual machine quick test you want to do a very quick test of your application whether it will be running or not what issue can what issue you can have right HPC kind of workload. So if you want

[6:48:31] high performance compute then obviously you cannot go for other compute instances. Obviously batch solution supports it. Apart from batch solution other will not be able to support it. So you can go for a virtual machine. Legacy

[6:48:45] app. Legacy app is old applications which are not supported in which are not cloud native or cloud optimized. So you can go for virtual

[6:48:57] machine in that case and you need a full control over operating system. So with can [clears throat] log into the virtual machine and you can install whatever software you want. So you have full control over the operating system. Okay.

[6:49:12] Now this is the excerpt from from that flowchart. So when you will be using virtual machine when you are building a new application or you're migrating uh and using lift and shift. So if you're

[6:49:25] building a new application if you require full control go for virtual When you're migrating and using lift and shift can you containerize it? If no can you use web app or API app? If no then you go for virtual machines. Okay. This

[6:49:41] is the same ex excerpt from this flowchart. flowchart. All right. So before I go to the portal, All right. So before I go to the portal, any questions on this? [snorts]

[6:50:00] for dev and uh dev environment. So dev environment you go for virtual machine will cost you less and make sure you're shutting it down during non-b

[6:50:14] businessiness hours. So which will save money for you. Okay. If you keep virtual machine doesn't matter whether it's general purpose or any other family size uh any other VM family if you keep it running for 24/7 you'll have you'll pay

[6:50:27] extra even when you're not using it. So it's better for dev test environment you use virtual machine and then uh use general purpose virtual machine and then make sure it's shut down when it's not in use.

[6:50:41] Okay, Mustach is saying VPS are cheaper. Okay, which probably

[6:51:04] installed in VM after OS in real that's up to you what applications you wants to install. By default, there won't be any. By default, when you create a VM, when I'm creating a VM, only OS will be installed. That's all. Apart from OS,

[6:51:19] nothing else will be installed. So, what application you need, you can deploy. That is the meaning of full control. Okay? So, when you go for virtual machine, you have full control. You can deploy whatever you want.

[6:51:33] All right? So, by default, there won't be anything. So if I select Windows OS installed. Softwares will not be installed. If I need additional softwares I can install it afterwards once I have access to the V. Okay. Any

[6:51:49] questions before I move on to the portal.

[6:52:02] policy and I remove the policy of that central area. central area. Same thing. Since I want to uh Okay, before I delete, if you see the overview page here, you should this you

[6:52:14] compliance? The meaning of compliance is what our policy is saying. Our policy is saying that you should not have resources in central India, West India and South India. But if you see the

[6:52:26] policy compliance, I have three resources out of which two are compliant, one is non-compliant. That means one is still in central India. So that's the kind of audit or compliance report you get when you use uh policy.

[6:52:41] Now since we only have one policy, I see this kind of compliance. You'll be having multiple policies. So you'll be seeing percentage kind of thing like for example here 14%. All right? So this is where the uh

[6:52:56] policy comes in place to define or to see your compliance level before the audit obviously. So you can make sure that you are uh 100% compliance to whatever requirement your your company or your

[6:53:12] clients are giving to you. All right. So let me remove this policy All right. So let me remove this policy now. I don't need it.

[6:53:27] compliance will go away since you don't have policy. Okay. All right. Now let's see our first demo of compute section. So here what I'll be doing I'll be deploying a virtual machine and within that virtual machine we'll deploy a very

[6:53:42] simple application. It's not an application it's a simple uh static website. So I'll be deploying that. So let's see that and I'll be using using let's see that and I'll be using using same static website to deploy it in all

[6:53:54] compute services whatever we are going to cover whatever demo demo we are going to cover whatever demo demo we are going to see. Okay. So let's see that quickly. So what I'll be doing in order to create a virtual machine you need to

[6:54:07] uh search for virtual machine and then click on virtual machine and then click on create. Okay. So as usual uh with any resource the first two things will be will be common and mandatory. So you need to provide

[6:54:23] subscription and then you need to provide resource groups. Right? So which subscription Azure Azure should charge you and which resource group you want this virtual machine to be part of. Okay. So I'll be selecting Azure

[6:54:37] training subscription and that's the subscription I have access to. and resource group I can create new if I don't have one but if you remember we created a resource group with the name a305 RG02 so I'll be selecting that

[6:54:49] resource group okay you can select whatever resource group you want but remember one thing when you deploy a virtual machine everything will be deployed under this resource group now with laptop when you

[6:55:02] buy a laptop what do you get when I buy a laptop with this laptop within this laptop we have a keyboard here we we have a CP CPU installed on the motherboard, right? We have the storage. So, we have some SSD or HDD and then we

[6:55:17] have virtual uh sorry, physical nick as well, the network card. So, network interface card is also added to to the keyboard. So similar to sim similar to keyboard. So similar to sim similar to laptop here also you will see the disk

[6:55:30] laptop here also you will see the disk is getting uh created with disk you will virtual machine you'll be having virtual network interface card right and then uh CPU will also be allocated the virtual CPU will also be allocated to this

[6:55:46] virtual machine so all those stuff will be in the same resource group then next thing you need to provide is the virtual machine name so So I'll go with a simple name. So let's consider this is my web server. So I'll give it a web server 01.

[6:56:01] world, what name you'll be giving? Totally depends on your naming convention. Whatever what I have seen in the real world is people use

[6:56:14] [snorts] uh the environment prod what this server is. This server is web server. So they use web SRV. And then what is the number of this web server 1 0 some some people add the region as well like for example this is

[6:56:29] deployed in central India so CI gets added and then the number 01 so that's how uh the naming convention would be totally depends on company to company basis so someone can have like this broad server

[6:56:50] some some have this some have just Broad web server totally depends. So we will keep it simple and we'll go with web server 01 or web server. [snorts] All right. Then region. What is a region? Region is a physical location

[6:57:05] where you are deploying the virtual machine. Now you're using Azure portal. So this is the cloud portal which we are using to deploy our virtual machine. But this virtual machine is not sitting in my home. Sitting at my home. What we are

[6:57:21] doing? We're deploying it somewhere on Azure data center. Okay, it's cloud. What is cloud computing? Your data on someone else's data center. Your data on someone else's computer. So, we are deploying this virtual machine in

[6:57:34] Azure's data center. So, Azure has data center all over the all over the world. So, central India is one of the region in Azure. So, that's what we are see we are selecting here. Okay. Then availability option. uh I'm not

[6:57:49] selecting one and not explaining right now since we have the high availability now since we have the high availability uh topic later when we do the network thing. Okay. So we have that topic so we'll cover it there. But uh you can

[6:58:02] understand that availability is like high availability. If I want to deploy more than one virtual machine of the same thing then I can make use of these availability options. All right. Security type. If you want to make uh

[6:58:17] you want to have basic security, you want to have like uh TPM, TPM is used for Bit Locker, you want to have secure boot, right? You want to have more security against uh the type of attack that is being launched against the cloud

[6:58:30] virtual machine. So if you want to have if you want Azure to protect it against those kind of attack, you can go for trusted or you want to have totally confidential uh virtual machine, you can go with with this as well. Okay. Now for

[6:58:44] our use case we can go for trusted launch and in real world as well you can go for trusted launch since that's quite secure and trusted launch gives you the secure and trusted launch gives you the option to encrypt the the discs the

[6:58:57] virtual disk that you're going to get. Okay. Then image. So this image will help you define whether you want the uh Windows operating system virtual machine or Linux operating system. Now there are a lot of images like if you see we have

[6:59:13] Windows server, we have Ubuntu, we have SQL server, we have again 2022 Windows server. Okay. Apart from this you can also click on see all images and you'll see all the images available in the marketplace. You can come up with your

[6:59:28] own image as well. You can create your own image, push it to the gallery and [snorts] Okay. So these are all the images we have. These are all the marketplace images. Some images uh might have extra

[6:59:42] cost. So cost will be mentioned over here. Okay. Like for Red Hat the license is included or not. Once you select it, it will tell you whether the uh cost is included or not. So right now this is not compatible with the security type

[6:59:56] change the security type. Okay. And at the cost page once I go to the review create it will tell me whether uh the cost is separate or uh the license cost is separate or or it will be included in the images itself. Okay. So I'll go for

[7:00:12] Windows Server 2025 data center since we want the Windows machine. So I I'll select the Windows Server 2025 data center which is the latest server operating system from Microsoft. All right. And then you have

[7:00:28] size here. Okay. What is size? Size will decide how many CPUs you are going to get and what amount of RAM you're going to and what amount of RAM you're going to get. 8 GB. Okay. 8 G. And then there's a

[7:00:42] estimated cost. So if you keep your virtual machine running for 24/7, how much you'll be paying? All right. So I'll go for B2MS or or D2 SV3.

[7:00:54] These are the options I have selected. Then once I create the virtual machine, you have your laptop. Uh in order to go into the laptop and do any changes, you need to provide uh u username and password. Right? So that's the same

[7:01:07] username and password you need to keep here. So I'll go for simple Azure user and my default password so I don't forget it. [snorts]

[7:01:21] Okay. And then the network rule. So which port you want to allow or deny. All right. What these ports are? These are the TCP ports. So if you keep 3389

[7:01:36] open, what happened with 3389? Now this is the basic thing. Uh not part of 305 but I'll explain. Okay. Anyone knows what is this 3389 remote desktop, right? So those who are

[7:01:50] experienced in taking remote connections of Windows they would know. So this is of Windows they would know. So this is the port number where we send request to this virtual machine. So I'm sitting here somewhere in in Malaysia. Okay. And

[7:02:03] my virtual machine is sitting somewhere in Azure data center central India. So we are not connected physically. We are not connected directly. So what I'm doing I'm sending connection over internet. I'm sending request over

[7:02:15] internet to this virtual machine that I want to take your control. allowed or not because I'm I'm sending the request on port number 3389.

[7:02:27] So it will check whether the port number is allowed or not. So if you don't allow the port number here, if I just go ahead and untick this, I won't be able to take the control. So I just want to take the control, that's why you need to keep

[7:02:39] 3389 open. Okay. So this will allow your virtual machine to to to accept your request. And then next you have disks. So here you can define the disks. So if

[7:02:51] you're using simply learn subscription, make sure you're changing this disk to uh standard HDD. Okay. So if you're using simply learn subscription, make sure you change it otherwise your VM deployment will fail.

[7:03:05] So if you're not changing this to standard HDD, your deployment will fail because of our policy. the simply learn policy which is in place clear now since I'm not using simply learn policy I'll go with premium SSD it doesn't

[7:03:19] uh it it should not restrict me from deploying next uh quite understandable so if you see the networking topic do you want to have a public IP do you want to create another virtual network do you

[7:03:34] want to have subnet we have a network topic but obviously we're not going to discuss everything in in in deep uh we will be discussing it from easy 305 point of view but what this is doing when you're creating a virtual machine a

[7:03:47] new network is also getting created okay so if you see the new uh word here in the bracket that means a new virtual network will be created within that virtual network a new subnet

[7:04:01] will be created and a new public IP will be created similarly new network security group will be created and ports will be allowed the code that we have defined there 33 389 will be allowed. Okay. So we have a network topic where

[7:04:16] now just know that whenever you are creating a virtual machine a network is also getting created. All right that's all. Once that is done, then you have the management section where you can define uh whether you want to assign

[7:04:32] manage identity to this virtual machine or no, whether you want to login using Microsoft enter ID or no, whether you want to auto shutdown your virtual machine. So if you're using dev for dev and test, if you're using it for dev and

[7:04:45] test, it's better to keep auto shutdown on. So automatically VM will be shut down at so and so point in time whenever you want 700 p.m. UTC or 7 p.m. IST whatever. Okay. Then monitoring. So if you want to

[7:04:59] enable monitoring you can have we have a dedicated chapter for monitoring. So we not doing any changes here. Then in advance if you want to run any script after the VM is getting deployed. So you can give that script here and Azure will

[7:05:12] execute your script once the VM is deployed. Okay. Then [snorts] tags and review create. So if you want to have tags for your virtual machine like uh environment fraud, you can add the tag and then review create. Okay.

[7:05:28] Now Kyash is asking what happens if we select enter ID login. It doesn't join When you create enter ID, you're not creating domain. Okay. So if you select Microsoft enter ID, this will give you

[7:05:41] the option. When you select this, it will allow you to use your enter ID credentials to log to this virtual machine. So this enter ID credentials. machine. So this enter ID credentials. So anyone having the so-called uh role

[7:05:54] like virtual machine administrator login role or virtual machine user login role uh from the arbback to this virtual machine they'll be able to login using their enter ID credentials. It's not joining domain. It's not creating

[7:06:08] joining domain. It's not creating domain. Okay. [snorts] create uh and then create so it will start deploying the virtual machine.

[7:06:23] So just in short what did we do? We provided the subscription resource group the virtual machine name region uh image image will help you decide whether you want to deploy a Windows or a Linux machine. Then you need to provide the

[7:06:35] size of your virtual machine 8 gig or two or 4 G whatever you want and then two or 4 G whatever you want and then username password uh inbound role that's all rest even if you're not making any change and you click on review create it

[7:06:47] change and you click on review create it should it should work okay so rest are just non-mandatory things which Azure is automatically selecting which Azure is automatically selecting for you and then I click on create so it

[7:07:00] now it will take around 2 minutes 6 to 3 minutes for the virtual machine to be deployed. deployed. Okay.

[7:07:46] machine is deployed. Now in order to connect now the the the definition of cloud computing we just definition of cloud computing we just put the definition of cloud computing.

[7:08:01] computing? delivery of compute services over internet. Now my question is where is this virtual machine sitting [snorts]

[7:08:13] you. Where is this virtual machine deployed or sitting central India and where I am? I am in Malaysia or even if I'm in India I'm not sitting or I'm not

[7:08:26] I'm in India I'm not sitting or I'm not inside the Azure data center. Okay. So Central India is not Nagpur Hurry. Central India is uh Pune for Azour. Okay. For us is it's Nagpur but it's it's the data center is actually in

[7:08:40] Pune. Okay. So I'm sitting in Malaysia. Now delivery I want to connect to this web server machine, what I need? I just need an

[7:08:52] address and the credential of this virtual machine. Okay. So let's connect. virtual machine. Okay. So let's connect. In order to take a remote access of this virtual machine, what I'll be doing, I'll be

[7:09:07] right click. I'll do a right click on my start button of my laptop. So if you see, I'll do right click and then I go to run. And after run, I'll do MSTSC.

[7:09:19] [snorts] Okay. What is MSTSC? STDSC is a is a is a shortcut to open the remote desktop connection wizard and here you need to provide the IP address the public IP address which is mentioned here in the

[7:09:34] uh on on the screen. You see the public IP address here. So I just copy this public IP and I paste the public IP here and then I click on connect. So once I click on connect it asks me

[7:09:47] the credentials. So I provide the credentials. the credentials that we provided at the first page when we were creating the virtual machine. Okay. Then click on yes and it will give

[7:10:02] me access. Now I'm inside my virtual machine. So whatever software or install installation I'll be do that will be impacting my virtual machine not my laptop. Okay. I'm connected to the virtual machine. You can see the public

[7:10:17] IP of the virtual machine. similar to what you see here 20.219.24.129. Okay. Okay. You [snorts] can see that here.

[7:10:56] 2025. So let's start with our uh let's continue our compute journey where if you remember uh when we were when we completed the yesterday's session uh we deployed a virtual machine and on that

[7:11:11] virtual machine we hosted one single a very basic website okay so uh since the deployment of website was very quick so what I have done I've already created

[7:11:25] the same virtual machine uh web server server 01 which we had yesterday. So and then I'll be deploying the web server role and after that I'll be server role and after that I'll be hosting the website. Okay. So I'll copy

[7:11:39] the public IP. This is something we covered at the last uh yesterday uh at the last half an hour. So I'll copy the public IP of my virtual machine. This is my virtual machine web server 01. So I'll copy the public IP and I'll connect

[7:11:52] to this virtual machine. Now since this is a Windows virtual machine, what I have to do? I have to connect it using RDP and I need to make sure that port number 3389 is open which we discussed yesterday. All right. So if I scroll

[7:12:05] down here you see port number 3389 is open. So I can copy the public IP and then connect to this virtual machine. So I copy the public IP. I I press Windows I copy the public IP. I I press Windows R on my laptop and I type MSTSC which is

[7:12:20] the shortcut to Microsoft uh sorry to RDP to RDC connection to remote desktop connections. Once I type MSTSC and press enter, it will open this run uh this dialogue box, this wizard where I can paste the public IP of my machine and

[7:12:35] then I can click on connect. So once I click on connect, it asks me for the credential. These are the credential which we provided when we created the virtual machine. All right. So I'll go with the credential that I

[7:12:47] So I'll go with the credential that I used credentials are okay then I can uh click on yes and it should

[7:12:59] uh connect me to the virtual machine that is deployed on uh in central India that is deployed on uh in central India on Azure platform.

[7:13:12] any service? This is nothing but a server right. So we deployed a Windows server operating system. If you see this, if [snorts] you see the operating system here, this is nothing but the Windows Server 2025 data center. So it's

[7:13:24] a server operating system. The operating system that you have in your laptop which is for commercial use is is a client operating system. You might be having Windows 10 or Windows 11. So that is a client operating system. What is

[7:13:36] the difference between server and client? Server provides some kind of service and client accesses those those service. or you want to host your website then you need a server operating system. You

[7:13:49] can't do that with client operating system. All right. So that's why here we have selected Windows Server 2025 which would give us the capability to deploy whatever service we want. As of now we are focusing on deploying a website.

[7:14:03] Okay. So in order to deploy a website I need to deploy web server role. In Microsoft Windows you have web server role known as IIS. If you're working with Linux, Linux has different flavors like you can install enginex. Ninx is

[7:14:19] another web server. So you can use that. So let's say instead of Windows operating system you deploy uh Ubuntu. Ubuntu is a distribution in Linux. So for that I need to deploy NX on top of Linux operating system or you can make

[7:14:34] use of HTTP also known as Apache. We can use Apache as Apache is another web server that you can deploy on top of Linux operating system. But as of now we have deployed Windows server operating system. So we will touch the uh we will

[7:14:49] install the IIS role. All right. Now in order to install the IS ro I have to connect to my virtual machine which I have connected remotely. Right. So once I connect to that virtual machine there in every Windows uh virtual machine in

[7:15:04] every Windows machine not virtual in every Windows machine you have something known as server manager. Now there are different ways to deploy the role or different ways to deploy the role or service on Windows uh machine like you

[7:15:16] have graphical way you have powershell way you have cmd way so there are different different ways available. Now since we have uh 40 50% of freshers here so I'll be sticking to GUI way since that would be easy to understand okay

[7:15:31] instead of doing it via powershell and all all by default in windows machine or windows server operating system you should see this server manager which should open

[7:15:43] automatically even if you don't uh open it it should uh open its wizard let's Say for in your case if server manager is not popping up what you can do you can you can go to the start button in the in virtual machine and

[7:15:58] button in the in virtual machine and here also you can see server manager. So if the server manager windows or or dialog box is not opening you can click here and it should open right. This is the first page that I should see

[7:16:11] whenever I connect to my virtual Windows virtual machine. Now I have to wait. You see this blue line which is uh collecting some inventory. So I need to wait. It won't let me do anything until this is gone. Okay. So what it does,

[7:16:25] it's preparing your server, collecting inventory data like what is the IP all those stuff it's collecting. So this is Windows specific. I need to wait until this is gone. So if I click on add roles and which it won't let me do okay.

[7:16:38] So it's letting me do that means it has already collect collected the data. You see now that blue line which was which was traveling is gone. Okay. It's gone. server. Okay. So what I did on the homepage on

[7:16:53] the dashboard itself I clicked on add rules and features and from here you can select whatever service you you want to provide you want your server to provide provide you want your server to provide like if I click on next next here you

[7:17:06] have the tab known as server role okay what this server role is if you let's say we discuss about active directory domain service right so if you want to uh have this server behaved as an identity server you can install active

[7:17:20] directory domain service. If you want this server to behave as a DNS server, you can install the DNS server. Right? Now, what we are interested here, we are interested in the web server role. So, if you see here W under W, you have web

[7:17:33] server IIS. So, this is the role which you use uh to host the websites or web applications. Okay. So, I selected web server and then I do nothing. I just click next, next, next, install. That's all.

[7:17:49] So now it will start installing the server role for me. All right. Which role we are installing? We are installing web server. Once the role is installed, I'll simply copy paste my application files and this

[7:18:02] uh this machine, this web server or this uh Windows machine should host my website and I should be able to access that website. That's where we stopped yesterday. Okay. So I'm continuing from there since this was very quick

[7:18:16] yesterday. That's why I'm repeating. So I'll have to wait until the installation is done. Okay. I see Ram is asking today's topic. Uh I think I already covered today's topic is is the same. We are continuing our compute

[7:18:31] same. We are continuing our compute journey. So we only saw one compute as of now virtual machine we still have other compute services to to see. Okay. Once that is done we will start with our networking topic. So these are the two

[7:18:46] plan topic in the agenda for today. All right. is done. Once the installation is complete, I just have to copy the files. That's all. Where I'll be copying the file since this is Windows machine. I

[7:19:01] have a file system here. Uh where I can navigate to C uh inet and here you have dubdubdub. So this is the folder where your application lives. All right. So I select dubdubdubdub. These are these are

[7:19:16] the default files. So if I don't change anything, a default website would be anything, a default website would be loaded to wait until the installation is done and then only copy.

[7:19:42] done. The steps are important to understand what we did. We first deploy the uh the virtual machine and while deploying the virtual machine we selected that we want Windows OS. You can select Linux if your pref if your

[7:19:56] preference is Linux. After installing the Windows OS what we did we added the the Windows OS what we did we added the role the web server role known as IIS. And after the IIS is installed we are copying our files. So this is the the

[7:20:11] the steps these are the steps that we are taking. All right. Virtual machine created virtual machine. Uh while creating virtual machine we selected Windows operating system. Windows server operating system. On top of it we

[7:20:24] deployed IIS. On top of it we will be copying our files once the IS copying our files once the IS installation is done.

[7:20:36] already installed. So instead of waiting let's just okay it's done. If you see installation succeeded says it says installation succeeded on web server 01. So once that is done you can close it right without changing anything if I hit

[7:20:49] the IP address the public IP address of the server uh it should load the default website. Okay I just hit the public IP address. This is the default website. So if I navigate or go back to the server, you

[7:21:05] should see this is what is being loaded. So if you open this with paint or [clears throat] if you open this with paint, this is what is being loaded. So if I replace this with my own website, I should be able to uh see my own website.

[7:21:21] Okay. So I made some changes. Click on save and then minimize the virtual machine and refresh the the page. So you see the changes are reflected instantly. Right? So now if I copy my simple uh app. So if I go to downloads and copy

[7:21:45] website. So I copy all this file go to the same location where the default website is located. Remember the location the path is cetpdw. Okay. So I delete this thing the default one and I copy I paste all the files

[7:22:02] that I have for my website. Okay. Now if I minimize the virtual machine and uh refresh the browser now it should load my website. All right. So it's it's it's that

[7:22:14] All right. So it's it's it's that simple. But uh if you want to learn more on how it's it's it's not this much on on web server. There's a lot that you can do with web server. Okay. Now since we just want to understand how compute

[7:22:27] works so we are doing this. All right. Now you can just [snorts] go to the public IP of this machine and you should be able to see the same website. Okay.

[7:22:40] The Baba is asking to repeat uh from which step you want me to repeat what what what we did is we installed or we created a virtual machine. We deployed a virtual machine. [snorts] We selected Windows OS and then we installed IIS.

[7:22:55] This is clear. Okay. So the address where you make changes is within the virtual machine Cetp. This is C drive. C drive in net

[7:23:07] dubdubdub group. So this is the folder where you have your website. Okay.

[7:23:25] we install in this server. Uh [snorts] this is not something at easy 305 level. You can install as many as you want. Uh depends on the configuration that you depends on the configuration that you have selected. Okay. So I have selected

[7:23:38] uh four uh 8 GB virtual 8 GB memory. Okay. So if my web app is is is traffic, light traffic is coming in, I can install as many as my server can

[7:23:51] support. Okay, there's no proper limit. You can install whatever you want. If you want more, you just change the size here and you install hundreds of web here and you install hundreds of web app. It should work. Okay.

[7:24:03] app. It should work. Okay. All right. Okay. So pankage this is not uh something uh we should cover in uh uh something uh we should cover in uh uh a305 okay it's IIS related. So if you

[7:24:18] want to learn more on server thing then I would recommend you to go for a 800 or a 8001 okay so these are the courses where you cover where we cover the uh

[7:24:30] server related thing but if you want to do that that you need to do from the IIS uh management console. So if I search for IIS here

[7:24:43] from here I can manage I can create another website. All right. So here if default website which is running. I can add a additional website but this has nothing to do with a 305. So I'm not covering this here. Can give it a name.

[7:24:56] You can give physical path where your application is wherever you want to store. Mostly you'll be storing it in pub. You add additional site here with pub. You add additional site here with the name whatever name you want to give

[7:25:09] my site or something you select that you add your files there and and it and you should run it. Okay. So this is how you do it but this is has this has nothing to do with a305. If you want to learn more on this uh I would encourage you to

[7:25:24] go for IIS course or server level course. Okay. But course or server level course. Okay. But remember one thing uh on port 80 my default website is running. So I cannot use the same port for second website. So

[7:25:38] that's the catch there. So you need to do some routing here. And instead of uh reaching out to server over port 80, you need to use the naming the host name uh

[7:25:50] these host name routing here instead of port numbers. All right. So here whatever host name I'll be giving that host name this server will be listening host name this server will be listening for port number 80.

[7:26:03] for port number 80. All right. So let's not complicate it. demonstration how you can uh host a web app or a website on on Windows server.

[7:26:18] app or a website on on Windows server. All right. Azure batch solution or Azure batch service. Now Azure batch service is not

[7:26:32] something uh similar to what we just saw. It's not a virtual machine where you can host your application. It's a totally different compute service where you can run large scale batch processing. What is the meaning of batch

[7:26:46] processing? When you want to process multiple files parallelly. Okay, many files parallelly at once. So if you have that kind of requirement then Azure batch uh Azure batch solution is the service for you which you can use to run

[7:27:03] multiple processes or multiple files. You want to process lot of files at once parallelly. So if you want to process that kind of thing, you need large compute, heavy compute. So Azure batch solution is for you. Okay. Now what is

[7:27:17] the uh advantage of using Azure batch service? As I just mentioned batch processing. If you have anything where you require HPC, HPC stands for high performance compute. You want to do distributed computing. Okay. I want to

[7:27:31] uh process certain files for uh in two virtual machines and certain files in three virtual machines. So I can do that kind of uh thing. It also helps you to do the orchestration. uh you can optimize cost by by uh

[7:27:47] combining different sizes of virtual machine in one pool and then obviously you can integrate it with any other Azure service. Now where where in real world it's it it's being used. Okay. So I give a very simple example of uh

[7:28:01] I give a very simple example of uh YouTube. Okay. So what is YouTube?

[7:28:13] please share the today and all past topics. Sorry. Sorry. What you mean m? I don't understand what you're trying to ask. So I'm trying to explain bat solution. So please focus here. All right. So I'm

[7:28:27] batch solution? Batch solution is a service in Azio. It's again a compute service in Azio which helps you to uh do a batch processing. So let's take an example of YouTube. What is a YouTube service guys? YouTube is a service where

[7:28:40] you can stream videos, right? You can stream videos. So what what I can do? I can stream video. It's a video service, a video streaming service. Apart from video streaming service, what you can do

[7:28:52] channel, right? You can create your YouTube channel and you can upload videos. Anyone here who is a YouTuber or I'm I'm I'm damn sure that 50% of people might have tried YouTube and they might have

[7:29:08] their own channel there and they might be uploading videos as well. So anyone what you do you create a channel and then you upload your videos. Now tell me are you the only person in the world who has the channel and who is uploading the

[7:29:23] video at this point in time? What do you think? How many videos are being uploaded on on YouTube at this point in time? 7:26 p.m. today. What do you think? How many videos are

[7:29:39] What do you think? How many videos are being uploaded? Come on, quick. Just take a guess. How many videos in 1 second? How many videos are getting uploaded to YouTube? Million billions of videos, right?

[7:29:52] There's no count. Millions of videos are being uploaded. Now when you upload a video to YouTube, what YouTube does? YouTube processes what YouTube does? YouTube processes your video, right? If I go to YouTube, I

[7:30:06] your video, right? If I go to YouTube, I upload my video. If I have a channel, video, you have different options to play like you you can play that in 1K,

[7:30:19] play like you you can play that in 1K, 2K, 3 uh 4K, right? So 1080 pixels. So there are different different uh once anyone is uploading the video, YouTube it's available in different different resolutions. Right? It's not loading. I

[7:30:35] don't know why but let's come come back to the topic. So when someone is uploading at at any point in time thousands or millions of people are uploading videos. So millions of videos are getting uploaded to YouTube. Now

[7:30:48] tell me when YouTube is processing YouTube has certain kind of application YouTube has certain kind of application which is processing this video.

[7:31:00] being uploaded and YouTube needs some service which can process this millions of videos parallelly at the same time. Now imagine you are uploading the video and your video is in que after the million videos only your video will be

[7:31:15] will be uh processed. So how much time it will take for that video to be available on your channel right? So I need some kind of service as a YouTube I need some kind of service which can process this this millions of

[7:31:27] which can process this this millions of videos parallelly and quickly. So Azure batch solution is the service which can helps you to achieve this kind of thing. So if you have any application where you require batch processing then Azure

[7:31:41] batch solution is the service for you. Another example, you have your marketing Another example, you have your marketing team in in your uh company. What does marketing team do? They come up with videos. Has anyone here work with

[7:31:53] editing or anything? So when you edit a video, what do we do? When we are editing a video, what do we do? We cut our uh I mean we we record a raw footage first. Once you record a raw footage, you then take that footage, put it in

[7:32:08] any of the editing tool and then you cut the unwanted footage. So when you when you cut unwanted footage, that means you are uh you just

[7:32:20] changing the way your video will look like final after the final cut. Right? So when we are finally there I mean we have cut all the unwanted footage and now we have uh added all the all the clips of footage

[7:32:35] that we need. So that means this is my final cut. After the final cut what do we do? We export our video. Export is nothing but this is my final video. Export it in in a full video kind of thing. So when you are exporting your

[7:32:48] tool do? Have you heard the term render? So the what this does editing to tool is doing it's rendering your video that means it's making your full video

[7:33:00] whatever final cut you have come up with it's making that into a single video you have changed ent change changed your entire video and when you click on export it it starts rendering your video that means it's exporting that video to

[7:33:14] a full video like maybe you have used MP4 or whatever format you have used now imagine your company is your company is creating or editing thousands of video

[7:33:29] uh in one day. So at that point in time I'll I I'll require the HPC the high performance compute to render my video since this rendering takes a lot of time. So if that's my requirement I can rely

[7:33:42] So if that's my requirement I can rely on Aziobath solution service. Okay. U so world that I can came up with. All right. I don't have any demonstration for Azure batch solution since I don't have any application which can do this

[7:33:56] kind of stuff. Okay. But Azure batch solution how it works behind the scenes. You create Azure batch pool and whenever there is a there is a task which is coming in the compute will be will be processing that task. That task can be

[7:34:11] stuff where you are processing videos. You're doing this kind of stuff where you are rendering videos or you're working with 3D modeling. So in 3D modeling also we require high performance compute kind of thing.

[7:34:24] performance compute kind of thing. That's why you might see that any editor mostly uh any editor who who is working on editing and all they they use the on editing and all they they use the Apple uh Mac Mac studio or or Mac Pro

[7:34:38] right why because th those PCs those Mac PCs are built for this kind of work. So similarly if I want to process now now Mac is like built for one single kind of

[7:34:50] processing or rendering or creating or developing a video and I want to edit that. So I'm working on one video at a time or mostly two video in in a day. So I'm doing that. So for that kind of work Mac is okay. But if you want to do in

[7:35:04] batches that means multiple or many videos at at at uh in a single day or in a single minute at that point in time you'll require something which can handle the batch processing. So Azure batch solution is that solution is that

[7:35:19] service where you can uh which you can use to do this kind of work. All right, clear. Any questions on batch processing or or sorry Azio batch solution? [snorts]

[7:35:37] uh scientific [snorts] research where you need like like for example weather weather prediction models where you need to work on large amount of data from previous days and then you need to come up with a uh with with a prediction what

[7:35:52] what can be today's weather tomorrow's weather. So that's where Azure batch solution uh perfectly fits. Okay. [snorts] I don't have any demonstration mir okay I'm sorry I don't have any demonstration

[7:36:07] which can do the batch processing and you need to send data in batches so that you can see that in live I don't have that what I can show is just creation of batch solution which will not make any sense okay I don't have any any

[7:36:22] sense okay I don't have any any demonstration for that all right Azure apps service as your app solution. This is another compute service. Okay,

[7:36:37] it's not like ETL run. Okay, batch processing. Yeah, you can use it for ETL as well. So if you're doing any uh extract, transform, load kind of thing, you can use batch solution for that. So it's similar to that. All right. But

[7:36:51] main job of this is is to mostly where I have seen bat solution is implemented is have seen bat solution is implemented is uh in in in in the in in the marketing uh team. So I've seen my friend working in a company

[7:37:07] uh and they have implemented this as your batch solution for their marketing team. Okay. But it's similar to ETL right where you will be taking data that data will be triggered and that data will uh triggered your compute your

[7:37:21] compute will process that data and then that you can integrate it with any other service to load that data somewhere. All right.

[7:37:34] next compute service that we have in Azure is Azure app service. Now, Azure app service is also a service where you can host your application. All right. So, if you want to host your web app, uh you can make use of app

[7:37:49] service. Uh the infrastructure for this is managed totally. So, fully managed infrastructure. Uh you have the option to scale it out or scale it in depending on your requirement. Uh it's highly available. You can integrate it with

[7:38:04] DevOps. uh it gives you the option to make sure that your data is secured and compliance. By default your data will be secured. Okay. Then you can integrate Azure app service with with other Azure services since this is an Azure service.

[7:38:18] integrate it with Azure other Azure services and it has support for containers as well. So main main thing that you need to understand for Azure app services this is mainly used for hosting web apps or website. Okay. Or

[7:38:35] APIs if you're creating if you're working with APIs. So you can host these three things. Now question may arise for freshers that here also I can host web app. In virtual machine also I can host web app. So what is the difference

[7:38:50] between these two? The difference between these two is virtual machine is infrastructure as a service. Okay. Where you have the full control over operating system. So I can as as you saw that I logged into the

[7:39:06] change instead of web server. If I want to make this as a DNS server, I can do that. I have that flexibility or that option or that capability to make this as a DNS server. Okay, I can make it as a DC DHCP server as well. So I have full

[7:39:21] control over operating system. Whatever I want to install, I can do that. So that uh instead of just keeping this as a web server, I can install all these a web server, I can install all these roles as well. So that uh benefit we get

[7:39:34] when we in when we use Azure virtual machine whereas when you're using Azure app service you do not have control over the operating system. If you remember the operating system. If you remember from from the uh basics from the first

[7:39:48] uh session we discussed infrastructure as a service and platform as a service. infrastructure as a service and platform as a service? In infrastructure as a service, you have full control over the operating system. So when I use

[7:40:03] infrastructure as a service model, I am deploying a virtual machine. I'm selecting an operating system and I have full control over that operating system. When I'm selecting platform as a service, I can select which operating

[7:40:16] system I want whether Windows or Linux. But I don't have control over those operating system. That means when I say I don't have control I'm I cannot log to that virtual machine when I'm using platform as a service

[7:40:29] model. So what uh what pass can help you to do is host uh what pass can help you to do is host your web app website or uh web app website or API but you won't be able to log into the v operating system that you

[7:40:45] have selected whether it's a windows or linux. Okay. Now when you don't have control over the operating system, what advantage you have? When I don't have control over operating system, I am not responsible for the

[7:40:57] patching of the Windows OS. So if I'm using infrastructure as a solution and I'm deploying everything in VM, I am responsible for the patching. So if I go to the settings and Windows update, I need to make sure whenever a new update

[7:41:11] is available, I need to make sure that I have installed it. like these two updates are already there in my virtual machine. So I should be the one. It's responsibility since I had deployed the

[7:41:24] virtual machine. So this should be installed by me as a as a user as a consumer. Okay. Whereas in path service and Azure app service, this is not your So underlying virtual machine will be patched by Microsoft. All right. So

[7:41:39] that's the advantage that that you get. Now the question may arise which one to use? If you are a developer the best option for you is app service. If you want more control on the

[7:41:53] infrastructure and you are infrastructure admin and you want more control then infrastructure as a service is the option for you. That's the best uh bet for you. All right. like you just don't want to install web server but

[7:42:06] within the same virtual machine you need to install some other softwares and some other uh uh roles like DNS, DHCP whatever you need for your infrastructure. So you can install that that option you will not

[7:42:19] get in app service. All right. Now whenever you want if let's say uh in interview you get a question explains the difference between p and IS. So you just remember this table. So with IS infrastructure as a

[7:42:36] service you have more responsibility. you as the as the uh consumer you have more responsibility when you're using IAS model

[7:42:48] less responsibility okay so just remember this box what this let's say you want to deploy an application what option you have um

[7:43:03] application what option you have um I'll I'll draw one more box for onrem okay on premises That means your own data center. So what options you have when you want to host an application when there is there was no cloud the

[7:43:16] only option that we had was on-prem right. So what you used to do when when you were when when we were using on-prem you had to have your own server physical server right on top of that server you'll have to deploy the operating

[7:43:30] operating system or Linux operating system whichever. On top of that you need to deploy a runtime. What is a runtime? Runtime is a is a is a framework which is used to uh run your application in simple terms.

[7:43:45] Okay. So your developer might be writing application inn net or java or python whatever or or node. So there are different different runtimes available right. So if my developer is writing uh the application in net I need to have

[7:44:01] net framework installed net runtime installed. Okay, if my developer is writing application in Java, I need to have Java installed. Similarly, Python or Node whatever. So, this also I have to install net if my application is

[7:44:15] written in net. And on top of that, I'll be having actual files of my on-prem you're responsible for everything from bringing physical server

[7:44:27] installing operating system on top of it installing net framework on top of it and then bringing your files that means copying or adding your files responsibility when you go for on-prem now when cloud introduced cloud was

[7:44:41] introduced in different uh models like infrastructure service pass as a service so behind the scenes we still have the physical server and infrastructure service we still have the physical server. What is this physical whose

[7:44:55] responsibility? Uh when you're using cloud physical server is the responsibility of the cloud provider. If you're using cloud the physical server is the responsibility of cloud provider. All right. Now you have the option you

[7:45:09] have the flexibility to choose whether you want to use Windows OS or Linux OS. OS. So if you're using infrastructure as a service, Windows OS is my responsibility. That means the license which which is required for Windows

[7:45:24] operating system is my responsibility. The monthly patching that I'll be doing is my responsibility. The runtime that I'll be installing is my responsibility. Let's say I go for net or java whatever. Okay. So net installation of net is also

[7:45:37] my responsibility. Then again files obviously the application files is my infrastructure as service, out of the four boxes, the three boxes are your responsibility. The operating system, the framework and the files. Okay. Then

[7:45:51] if you move to p platform as a service, the physical server, the the state setup will be same. The physical server is still there. Now it's it depends whether right? And then operating system is still there. You just have to tell the

[7:46:07] provider that I want to use Windows or Linux. the framework is still there. What your responsibility as a when you're using p model is only the files.

[7:46:19] So you just focus on development. That's all. The last box the I mean from the top the first box only the files is your responsibility. Rest three are the responsibilities of the provider. So when you use on-prem

[7:46:35] everything is your responsibility from scratch. When you're using cloud uh or infrastructure as a service, the physical server becomes the provider's The operating system is your responsibility. The framework that you

[7:46:50] The files that you want to install on top of uh uh files are nothing but the want to install or deploy on top of that Windows operating system or Linux operating system is your responsibility. In pass you are only responsible for

[7:47:06] development. The infrastructure the entire infrastructure the platform is the provider's responsibility. Okay. So that's the difference between virtual machine and app service. App service is a path service. So what we

[7:47:20] are responsible for is the the files that we need that we need to uh deploy. That's all. You create a path service. to create an Azure app service and then just push your files into that app service.

[7:47:34] All right. Pankage is saying please explain runtime. Runtime is the framework punkage. Okay. So runtime is the framework as I mentioned here net java python node. So in order to install or

[7:47:48] host any application your developer will be writing an application in certain language right in simple term it's a language which your developer is using uh to to write your application he can be use he might be using python he might

[7:48:02] be using net car might be using java might be using python so in order to host that application I need to have that framework installed that runtime installed on my machine and if I install that runtime runtime is like the run

[7:48:17] time which helps your application to run. All right. [snorts] Okay. So what we did when we installed Okay. So what we did when we installed the virtual machine we provided we we

[7:48:31] informed the server the service provider the cloud that we need Windows operating system and then on top of it whatever we had to do we did like we installed IIS then we copied our files. Right now next month when there's patching I will be

[7:48:45] responsible for the patching. The physical infra is still uh cloud providers responsibilities. So now now let's see uh demon let let me demonstrate how you can use Azure app service to host the same application

[7:48:57] that we are hosting on a machine on on a virtual machine the same application which is hosted here. Now I'll host the same application on an app service. same application on an app service. All right. So in order to create an app

[7:49:11] service in the s search bar. So I'll search for app service here. All right. I click on app service. This is the first one app service. So I'll click on the app service and then I click on create. I click on create web app.

[7:49:27] All right. Now as usual whichever resource you are deploying on Azure cloud you need to provide subscription where Azure will be charging and a resource group where this where the resources for this service will be

[7:49:39] resources for this service will be deployed. So I select AZ305 RG01 where my resources will be deployed. Then the instance name. Instance name is the web app name. Okay. So what web app name you want? Let's go with simply

[7:49:51] learn. This should be globally unique. Okay. So if I go for simply learn, you see uh this name is not available. That means someone has already deployed a web app with this name. All right. So what I do, I just add some random number uh on

[7:50:05] on on front of it. All right. And this is the runtime stack that I was saying whether you want to use net, you want to use java, you want to use python. All right. So these are all the runtime that you need to install when you want to

[7:50:20] host an app. But when you're using a pass service, you just need to tell the provider that I want this runtime python and they will install python. I want this runtime node and they will install node. So they are making sure that

[7:50:35] your platform is ready. You just need to bring your code that's all. So if I select net 10 net 10 will be installed on top of Windows operating system. So what I'm telling the provider is install Windows operating system. On top of that

[7:50:49] install net all right and then the region where your uh where you want to deploy the app service. So I I'll be mostly I'll be using central India for all of my servers. Oh sorry all of my services. So I'm using central India

[7:51:03] services. So I'm using central India here. Okay. And then there is a plan. Plan is the skew on u on the basis of which Azure will decide uh how much to charge. So there are

[7:51:17] different plans available. So there are different different plans available. You can select whatever you want. So if I click on explore pricing plan, these are the different plans available. So it decides how much RAM you'll be getting,

[7:51:30] how much CPUs you'll be getting, right? you can go for premium plan which will you can go for premium plan which will give you one virtual CPU and four uh GB of RAM. So depending on your requirement you can choose whatever you want.

[7:51:43] you can choose whatever you want. All right. Uh for some plans the the prices are also the estimated prices are also mentioned. All right. Now since this is just for demo purpose so I'll go for standard or uh

[7:51:59] basic since that that that will cost me less. So we have standard plan as well. Standard as well. Now consider this plan as just the amount of RAM you'll be getting, amount of uh CPUs you'll be getting. All right? And how much it will

[7:52:15] charge you, how much Azure will charge you for that particular uh RAM. It's not like that. Once you choose and it will it will stay like this. If you in future if you want to change the plan, you can change it. That's that you can do. So in

[7:52:29] future let's say I'm not satisfied with standard the performance of standard S1. So if I want to go for premium I can go okay I can switch any point in time that's the that is the the benefit that you get in cloud. So you see the benefit

[7:52:44] number three the feature number three scalability. So right now when I'm deploying the service I'm selecting a different plan and in future if I need a different plan I can do that. Okay. [snorts]

[7:52:56] All right. So I I'm selecting standard S1 for low cost as of now. All right. And this is the name of plan. So this is the name. You can uh give whatever name you want. So this is the default name or uh a random name that name that Azure is

[7:53:10] name, you can you can give. So this is my simply learn uh app service plan01. So I can give it something like this. Okay. You can give whatever name you want. All right. Now once that is defined that's all. If you don't want to

[7:53:25] defined that's all. If you don't want to touch any other uh uh tab that's fine you just click on review create and your app service will be created. But you can associate or create database here if you want. You can uh ass you can have your

[7:53:41] uh CI/CD pipeline as I mentioned here key features DevOps integration. So if you have a CI/CD pipeline you can integrate uh with C CI/CD pipeline as well. If you want to integrate it with network, you can do that. All right. If

[7:53:57] you want to have uh a different service which will be monitoring uh this web app, you can uh enable that. I'm not enabling it. We have a dedicated chapter that. All right. That's all. You can associate it with database. You can

[7:54:12] associate it with CI/CD pipeline here. Right? If you have a network and you want to integrate your app service with network, you can do that from here. If you want to enable monitoring, you can enable it from here. All right, that's

[7:54:25] all. I'm not doing anything. Just I'm going with the default setting. I just uh in the monitoring section, I just u change the radio button to no. That's all. And then I can click on review create

[7:54:39] and I click on create. All right. So, it will start deploying my app service. [snorts]

[7:54:51] Oh, I paid. Oh, we did change the the plan, right? But they had selected premium P1. I want to select standard

[7:55:04] I want to select standard or maybe basic. standard now. And uh it's it's now going to the deployment page. Within 5 minutes

[7:55:19] your app service will be up and ready. All right. So I can browse my app service from here. As a end user if you want to go to YouTube. How do you go? You type dubdubdub.youtube.com on your browser. Right. So this is where

[7:55:32] this is the address where YouTube lives. Similarly for your app you have an address uh where your application is is this is the address where your application is living. Simply learn

[7:55:46] 5689.azeites.com. azureites.net. So here we have our app running. Okay. And sometime you should see your app. Now what we have done, we have just made sure that platform is ready. We still haven't pushed our code. We have not

[7:56:00] added our code. What did we do when we when we uh worked with virtual machine? We deployed the virtual machine right on top of it. We deployed the in uh IIS

[7:56:12] role and then we copied our file. So so far in app service what we have done we have done this part we still have not copied our files so we need to copy that all right we need to copy that so you see when I browse that that endp

[7:56:30] point that URL it says my web app is running but waiting for the content so I still haven't published my content yet now for web app there are different different ways to publish the content one one way is to use the devop ops way

[7:56:44] of of publishing the content. Another way is to use the CLI to publish the different ways to publish the content. But for our use case uh it's a simple

[7:56:57] website which which we are using. So what we can do we can use the graphical way app service editor. I can open the editor. So it gives me the access uh

[7:57:09] access to the file system where I can simply upload my files. Remember what we did with virtual machine, we deployed the IIS and then we copied our files. So we have to do the same thing with with the app service as well. So I need to

[7:57:22] copy that file. So in order to copy what what Azure has done, Azure has given you the access to the file system. So under the development tools you have app service editor and from here you can open the editor and uh you can copy and

[7:57:38] open the editor and uh you can copy and paste your files here. Okay. So let we have to wait until this is fully loaded it takes cert some time and in any point in time if you want to change the plan the app service plan you

[7:57:52] have the option here under app service plan you have scale up scale out. Okay. So when you want to scale up you can change from basic to share to basic 2 to basic 3 to premium. So if you feel that the traffic which is coming to my

[7:58:06] the traffic which is coming to my application uh is not served properly or served very slow. So that could be because you only have 1.75 GB of RAM. So it might take lot of time for processing a particular request. So

[7:58:21] if you feel that at any point in time you can change your your plan. Now remember if you go for premium plan the cost will increase. Okay, depending on which plan you're choosing and the amount of memory you're getting, your

[7:58:35] amount of memory you're getting, your your cost may increase. All right. So now as you can see it's loaded and this is where where did we copied our file under dubdubdub root right in virtual machine if I go to the virtual

[7:58:48] machine we copied all of our file to dubdubdub root right. Similarly here also you have the dubdubdub root folder from where you can to where you can copy your file. So what I can do I can delete this one the the default one and then I

[7:59:04] can right click and I can upload my simp my simple app files. So if I go to my simple app files. So if I go to download and search for simple app

[7:59:19] it. So this copy will be uploaded the files will be uploaded here right the index.html this is the file which will be loaded. Now if I refresh my my endpoint, I should see the similar uh application here.

[7:59:34] Okay. Same website which is being loaded from virtual machine. Now it's being from virtual machine. Now it's being loaded from the uh app service as well. Clear. You can also try to browse this and you

[7:59:47] should see the same website being loaded. What is the advantage of using getting the SSL certificate free of cost. I mean the cost it's included in the in the app service plan. You see HTTPS

[8:00:01] uh which I need to buy separately if I'm using virtual machine. So I need to buy secured. In order to secure that I need to buy a SSL certificate and obviously I I'm directly hitting that at the IP address. Right? That thing is that is is

[8:00:19] benefit when you're using path service. you already have HTTPS plus you have a hitting the website on on a particular IP address. You're getting a domain name separately free of cost. Okay.

[8:00:35] All right. So for deploying the code it's very simple. You can go and you can place your since my website is quite basic so I can do that from the app service editor. But if you want to deploy an entire code uh in that case

[8:00:48] you can make use of a web app command from from from where you can deploy the code. So a easy web app deploy or easy web app uh deploy is the is the command that you can use. So this is the command that can

[8:01:03] be used in order to deploy entire source code. Okay. So your source code can be code. Okay. So your source code can be in in jar file or in in zip file and you can deploy your source code. The example is also given over here. Right? If you

[8:01:16] want to deploy a war file uh this is the this is the command. If you want to right. So there are different different uh ways to deploy the code. If you want to use uh the command line way then this is

[8:01:31] these are this this is the command that you have. Okay. Apart from command line, you can also deploy using uh something known as Visual Studio Code. So from known as Visual Studio Code. So from here also you can deploy the the the the

[8:01:44] source code. Apart from Visual Studio Code, there is another software from another IDE from Microsoft which is Visual Studio. From there also you can deploy. So there are different different ways to deploy the source code. Since

[8:01:58] our application is quite simple uh it's just a website. So I deployed using the graphical way which will be easier for freshers to understand. All right. Um in future we have advanced topic as well. So once we are done with database

[8:02:14] well. So once we are done with database once we are done with uh the app service architecture in the app service architecture we are going to deploy a a fully looking app uh application. Okay. Uh so that's that's where you will

[8:02:28] understand how to deploy an entire source code or entire application Okay. All right.

[8:02:41] instance. Azure container instance. How many of Azure container instance. How many of you know what docker is?

[8:02:53] Now in order to understand container uh I need to give you some uh some information some basic information but since this is a 305 I'll keep it very minimal okay I'm not going to explain you how you can build a docker

[8:03:09] image how you can run a container that's not the scope of a305 okay same goes for kubernetes as well so next topic we have is azure kubernetes service. We are not

[8:03:21] going to cover Kubernetes in depth since easy 305 is not doesn't cover that scope is not meant for for you guys to to explain Kubernetes. Okay, we have AKS.

[8:03:34] What we will what we will do we'll keep it minimal. I'm not going to dive deep into AKS or Docker. Now, why why I'm not going to dive deep into that. So, there is an there is a reason for it. Okay. So if I go to our website simplylearn.com I

[8:03:50] don't know if we still offer a course in in docker but if you just search for in docker but if you just search for docker in in our website you should see docker certified associate. So there is a dedicated certificate for docker and

[8:04:07] a dedicated certificate for docker and it's not uh the scope for a305 is not to cover entire docker you just need to understand what docker is right so if you see this is the entire course for docker where where it it help you to I

[8:04:22] mean in this course you will get to understand what docker is how to create a docker image how to manage it how to post it to a registry or repository how Docker networking works. So it's it's a very big topic. Same goes for

[8:04:36] Kubernetes. Now we don't offer Kubernetes but if you go to the Kubernetes official documentation you would see that uh this is a course in itself. If I go to the documentation you see the concepts the getting started

[8:04:52] document how to create a cluster and all it's a very big topic. Okay. From easy 305 point of view what you need to understand is let's say someone comes to understand is let's say someone comes to you and ask you that my application is

[8:05:05] written in a containerized form. Do you have any service in Azure which helps you or helps us to to host our containerized application? In that case you will answer that yes we have these services in Azure which helps you to

[8:05:20] host your containerized application. One of them is Azure container instance. Other one is Azure Kubernetes service. So our focus on this services not on the on the technology name as container. Okay. But uh I'll explain you the basics

[8:05:37] Okay. But uh I'll explain you the basics of container. What is container and how it is different from a virtual machine or app service. All right. So what is a container? Container. Now I let's go back to uh I need a whiteboard.

[8:05:53] So let's go back to the virtual machine or bath solution. Okay. So the here I have this page. So I'll use this page. Now what happens initially as as I mentioned uh in the last session in yesterday's session that we are here we

[8:06:06] as an infrastructure administrators are here because of the application. If there's no application we are not required. The infrastructure admins are application developers are also not required. Right? Since businesses are

[8:06:19] required. Right? Since businesses are using it uh to drive their business right to to grow to grow their business that's why they are they are asking the developers to develop application and that's why we are there to host the

[8:06:33] application right that's that's our uh mean like you are a system admin or a deops admin your main work is to make sure that application is up and running right so if you go back 20 years if you go 20

[8:06:48] years ago how we used to host the application. So in order to host the application what we used to do we used to get a server a physical hardware to get a server a physical hardware server IBM or uh Cisco or HP or Dell

[8:07:03] whatever then on top of that server we used to deploy an operating system Windows or Linux operating system and then we used to deploy the framework the library right so we used to deploy net python whatever is required and then we

[8:07:17] python whatever is required and then we had the actual application so in order to host just one application I was I mean we were utilizing the entire server now if server is costing me $1,000 $1,000 is dedicated only for

[8:07:32] one application since if I have deployed Windows operating system and if I'm using net framework I can only host the net related applications if I want to host another application which is written in python I cannot host that on

[8:07:47] written in python I cannot host that on the same uh uh server wheren net is Sometimes it used to work, sometimes it used to uh interfere with with the net library. Since these are two different libraries,

[8:08:01] these are two different frameworks. We were not I mean server was not supporting to host multiple application. So what engineer engineers did they came So what engineer engineers did they came up with the virtualization concept. So

[8:08:13] after the phys after hosting an application in physical server the concept of virtualization kicked in and virtualization is the backbone of cloud computing. Okay. So what virtualization is with virtualization people started

[8:08:27] using hypervisor. Hypervisor is a tool or a software which allows you to create virtual machines. So how the infrastructure change or how the setup changed? You still have a physical server

[8:08:40] on top of it. that you use to install the HyperV or VMware, ESXi or Citrix uh Zen server right so there are different different hypervisors available in the market now depending on which you are using you will be installing that

[8:08:55] particular hypervisor so I'll write it as HyperV now what HyperV or Hypervisor as HyperV now what HyperV or Hypervisor helps me to do is to create extra machines using the same server so what I can do I can create more than one

[8:09:08] can do I can create more than one virtual machines here VM1 1, VM2, VM3. By creating VMs, what advantage we get? I can have one virtual machine running Windows operating system. I can have another virtual machine running Linux

[8:09:21] virtual machine again running Windows operating system. So this virtualization what advantage you got with the virtualization is you can have more than one application like for the first virtual machine I can

[8:09:36] have a net application running for the second virtual machine I can have python running or java running for the third operating system again I can have net or any other node or something that I want to run right so this virtualization

[8:09:48] gives me the advantage of utilizing my server fully here if I buy uh if I'm spending $1,000 that $1,000 was dedicated for one application. Here I'm spending same amount $1,000 but now I can host more than one application right

[8:10:03] so that's that's the advantage on on hyper on on hypervisor on virtualization after virtualization it's it's a good concept people are creating virtual machine hosting our applications and all but the the

[8:10:20] limitation or the drawback not the limitation the drawback is in order to host one application I need to create create the virtual machine from scratch. system from scratch or Linux operating system from scratch and then I need to

[8:10:34] install the framework. Everything I need to install and then only I can host the application. So what engineers did they came up with with one step they went one step ahead and they in introduce the form uh

[8:10:47] introduced the the the technology known as containerization. So with containerization what happens you can create a a very lightweight uh

[8:11:00] system but you can host an application in in a lightweight form. Okay. Now I'll just clear out this screen and I'll just clear out this screen and I'll explain what containerization means.

[8:11:12] Is the physical layer I mean physical infra or the and the virtualization clear? Uh is is the two terms clear physical and and virtualization? understand how the application is hosted. That's all. Initially we were

[8:11:27] hosting like this then we moved on to the virtualization thing. Okay. And then now today we are using the containerization thing. Okay. We are still using the virtualization thing and with plus virtualization thing we are

[8:11:39] using the container. Today's in today's world you will never see uh anyone hosting application like this. It's it's just a waste of resources, waste of money. Okay, you you will still see people are using virtualization or

[8:11:52] you'll still see containerization from 20145 people have moved on to the 20145 people have moved on to the container containerization way. Okay. So now let me understand let me explain what containerization is. So we already

[8:12:04] what what operating system we have installed? We created a virtual machine system. I mean when we created the virtual machine we asked the cloud what operating system is installed in this virtual machine

[8:12:20] this virtual machine if you see it's written it's written there what what is this the operating system name is is written there Windows Server 2022 okay so we installed an operating system

[8:12:34] and then we installed IIS and we are hosting one one simple website if I want installing net or something and then I'll be hosting my uh net application. But if you see this operating system and if I go to the file system, you see

[8:12:49] there are lot of files. If I go to Windows uh C, you see there are a lot of files. If I go to program files, you you should see you have internet explorer, you have some common files where you'll be having some files. Uh you have

[8:13:03] mailing windows mail, you have a photo viewer. Then if I go back to pro to to to windows folder here also if you see you have app readiness azure arc uh boot

[8:13:16] obviously we we need you have system 32 where you should be having non-required files some files which are not required so what I'm trying to explain over here is when you're installing an operating system for a windows operating system

[8:13:30] how much is the recommended storage if you go to if you if you find for windows server 2025 installation guide

[8:13:46] or 4GB something something around that okay system requirements so what is the system requirement if I click on this this not an official page but whatever it is they might have got it from the official page so minimum required RAM is

[8:13:59] 2GB okay that's the minimum requirement it does not mean that your server will it does not mean that your server will behave or or work uh uh uh function quite properly when you install 2GP. So this is the minimum requirement just to

[8:14:13] imagine on top of that operating system we'll be having a runtime and then we will be having an application. So what would be the minimum RAM required for installing Windows Server 2025 I mean for running it properly. Okay. on top of

[8:14:28] it if I see we have lot of unwanted files like we have uh some program files which are not required like like uh SDKs like SQL server these are not required I'm hosting an application I don't need the mail now tell me you're hosting an

[8:14:43] application on a server do you need mail do you need windows mail installed on on on the the server where you want to host an application do you need that [snorts]

[8:14:59] calculator and all clock and all. Do do we need that calculator clock and all these are all the all the things which are for commercial laptops or commercial operating system. These are not these are not the uh services or or or files I

[8:15:12] need in my server. So what what engineers did they came up with this containerization uh uh technology and using containerization what you do you just install

[8:15:26] install the the required files which are enough to run an operating system. All the unwanted files are removed. Only files operating system those files are installed. all the other files are are

[8:15:42] removed with with removing those unwanted files what advantage you'll be getting you'll be saving some storage space right so let's say for Ubuntu server operating system if I require 4 GB of space with removing all the

[8:15:57] unwanted file I might require only 1 GB so I'm I'm saving space over there and by saving space the amount of memory the RAM that is required to run the operating system will also reduce drastically so if The minimum

[8:16:11] requirement is 1 GB of RAM. By removing all the unwanted space and unwanted all the unwanted space and unwanted file, it might go to 512 or maybe 216. Okay, 256. All right. So with this, you'll get speed, you'll get you'll get

[8:16:23] space. And now on top of it, if you install net or net core or python and then you can install your application files. So only the library only the

[8:16:35] Only the required files in operating system will be installed. You convert system will be installed. You convert this entire thing into a image. We we call that as a container image and then you can use this image wherever you have

[8:16:51] the containerization platform. So it's that portable. All right. Now once I create an image a container image I can run the same image on AWS on Azure

[8:17:05] I can run the same image on AWS on Azure on uh Google on digital ocean on Oracle wherever I want to run I can even run it run that in in my Kubernetes platform on run that in in my Kubernetes platform on onrem. Okay so what is an image? Image

[8:17:18] is nothing but the collection of your operating system, your framework, the runtime that you want to use, net, java, python, whatever and your application python, whatever and your application files. So you ship them, you create an

[8:17:30] image and you ship it somewhere. That somewhere is nothing but the registry or somewhere is nothing but the registry or repository mostly a registry. So that registry from there there you can pull your image to any platform which

[8:17:43] your image to any platform which supports the uh containerization. It's the lightweight uh application. You can say lightweight way of running an application. So in Azure if you want to host a container

[8:17:59] then Azure gives you this service Azure container instance which offers you a fast and simple way to run container in Azure. Okay. So what what is what are the key features u of this container instance? You can deploy container.

[8:18:15] your container, where in which registry you have your container, you get a serverless experience. That means I don't need to deploy an entire virtual machine. Now see the cost of virtual machine. Okay. If I go here and

[8:18:29] virtual machine. Okay. If I go here and if I deploy a virtual machine, I click on create virtual machine. And if I scroll down and go to the

[8:18:45] much it is costing me a month. This is the monthly estimated cost. 6,376 Indian rupees. Okay. If I install the cont uh if I install my application

[8:18:57] cont uh if I install my application using a container, create and if I see the size somewhere, if you see the size here, the price is

[8:19:09] not mentioned here. But if you see the pricing, it it's more less, I mean way pricing, it it's more less, I mean way less as compared to the virtual machine. Maybe we need to go to the pricing uh calculator.

[8:19:35] for Linux OS container, this is the price okay per GB. All right, memory per GB if you save uh I mean if you reserve that will also give you 52 or 72 some

[8:19:48] percentage right so this is the cost that you're getting when it comes to different types of containers and when you go for Windows there will be Linux there will be different charges okay but you can refer this pricing

[8:20:01] table or pricing calculator for and there are some examples also given if you're using one virtual CPU and 1 GB of of configuration which runs daily uh for 30 days uh what cost you'll be paying so this is the cost that you'll be paying

[8:20:16] okay for for memory and for virtual CPU so you see for 30 days how much cost they are they are charging the total billing is like only 11 rupees so where where you are paying 6,000 when you're using virtual machine for single

[8:20:29] application you will be paying around estimated cost 11 rupees okay so how many containers you can host in in the same price okay uh same region Central India display monthly pricing. All right. So that's one of the benefit that

[8:20:44] you get when it comes to Azure container instance. All right. So it gives you the serverless experience where you don't need to install the virtual machine. Uh fast startup since it's a lightweight thing. Obviously the startup will be

[8:20:56] fast. You can isolate uh different you can isolate your application. That means one application will have its one uh instance right? One application will will get it own instance. It's a full isolation instance. You can integrate it

[8:21:10] with other Azure services. Uh as I mentioned containers are portable, right? So uh doesn't matter where you are creating your image where you are pushing your image, you can host it at any platform. Tomorrow if you feel Azure

[8:21:24] is not good for you and and you want to go for uh AWS, you can use the same image and pull it to the AWS. That's all. Ephemeral storage that means containers are having like volatile storage. Okay. So it is recommended uh

[8:21:40] that you should not store anything uh within your container that means your application data. You should only have the application files the application all. Apart from that you can keep your data in persistent storage like Azure

[8:21:55] disk or Azure files. You can you can keep your data in the persistent storage. All right. There is a small table which helps you to understand the difference between virtual machine and containers. So containers are like

[8:22:08] lightweight isolation. So it's a very lightweight uh operating system [snorts] you can say with bundled with your application and the source code. Okay.

[8:22:20] Uh it only runs the user mode portion of an unwanted files are not there. Whereas the virtual machine runs the complete operating system. So whatever Windows or Linux are introducing in their operating

[8:22:36] system, those features will be added with every update. Containers are need to have the container engine. Mostly you'll be using Docker engine. So you need to have Docker engine in place in order to deploy the container.

[8:22:50] With Azure container instance, Docker is taken care by Microsoft. All right. Whereas virtual machine can be deployed using cloud. So if you're using Azure, Azure has their own virtual machine. If you're using on-prem, you

[8:23:03] machine. If you're using on-prem, you need to use uh hypervisor like ESXi or HyperV or Citrix gen server. Right? So there are different different options to deploy. Uh in order to get the persistent storage, you can use Azure

[8:23:17] file share or Azure disk when it comes to container. Whereas in virtual machine we already have virtual hard disk attached to it or you can attach a file share as well which we'll see in the storage uh uh thing.

[8:23:30] Now for fault tolerance that's the disadvantage when it comes to Azure fall tolerance. So in order to achieve the fall tolerance that means high availability you need to have more than one container instances running. Right?

[8:23:45] So that's something which is not available here but you can achieve that using some orchestrator which is our next topic Azure Kubernetes services. for VM you might know that we can have a cluster we can create a cluster and that

[8:23:59] cluster we can create a cluster and that cluster u will help you to achieve the high availability. Okay. Now let's quickly see this container need to have a container in place. So I already have a container. Now how to

[8:24:13] create a container? how to create an image all those stuff if you want to learn I would ask you to go for docker certified associate course okay that's not something I'm covering here but I have already created an image and I have

[8:24:27] my image in docker hub so if I if I search for docker hub I should see my image there okay what is docker docker hub is like a github so in github you the developers push or or keep their source code whereas in docker hub people

[8:24:45] keep their container instances, container images. So if I search for my repository Iran kitani, I should see Imran kitani/s simply learn. So this is the container image that I have already created and pushed it to

[8:25:02] uh docker hub and I can pull this anywhere. I can host it on my local anywhere. I can host it on my local machine. I can host it on my on Azure. I can host it uh on on AWS anywhere. Okay. Once once you have the image created,

[8:25:16] you have it somewhere publicly available. You can also use private registries as well. Uh and you can pull it from there. Okay. So I already have What are these tags? These tags are nothing but different versions of my

[8:25:31] application. Now once your developer develops an application, they don't sit. They find bugs and they fix those bugs. Right? So once they fix those bugs, let's say they deploy one application. So that application is

[8:25:46] version one, version one of your application. Then they uh after that application. Then they uh after that that deployment, they still keep on finding bugs, keep on fixing those those bugs. Sometimes they come up with a new

[8:25:59] feature. So once they they fix the bugs, they release a new version of the of of their application version two. Then again after releasing version two, they will still work on fixing the bugs and all. and then they'll come up with

[8:26:12] version three. So similarly that scenario I have I haveve I've done here. application. Version one, version two, version three. All right, it's nothing but the same application but instead of hosting it on a virtual machine, uh we

[8:26:27] will be hosting this on a container instance. Okay, so let's quickly do that. So what I'll be doing, I'll be quickly searching container instance on the search bar and here I'll click on create. Okay, as

[8:26:41] subscription and the resource group. So, I'll keep it in the same resource group. delete everything from this resource group, right? You can give it a name. So, I'll go with simply learn uh 5 6 8 9 whatever

[8:26:56] just to make sure that it's it's it's random name. All right. Region where you want to post. Okay. If you want to high have high availability, you can deploy it in multiple data centers within Azure. You can have different SKs like

[8:27:10] standard or confidential. Right now confidential is not supported. Okay. So image. You just need to provide the image of your container where your image is hosted. So similar to Docker Hub, we have a private

[8:27:27] to Docker Hub, we have a private registry in Azure. Azure known as ACR or Azure container registry. Why do we need a private registry? Now let's say my a private registry? Now let's say my company is is developing a SAS product

[8:27:42] software as a service product and that product is they are using containerized uh form to develop that product. Now does it make sense for them to put their does it make sense for them to put their SAS product in a public registry?

[8:27:57] The difference between public registry and private private registry is that the public uh when you push your container your container image to a public registry anyone can pull that that container.

[8:28:11] container. So my simply learn container can be So my simply learn container can be pulled by anyone anyone can use it. So if my company is developing a propriety product,

[8:28:24] does it make sense for them to keep it in the public registry? Obviously not. Why? Because anyone will be able to pull it and they can uh work on it and bring or or or they can sell it or use it on their own name. So it doesn't make sense

[8:28:39] for my company to put that that that software or that product in a public registry. So what my company will be doing they will be creating a private registry ACR Azure container registry or AWS registry or even in dockerhub you

[8:28:55] registry. So they will create their own private registry and pull all their container images there. So that public public will not not have access to the public will not not have access to the container. Okay. So if you are creating

[8:29:08] company you can create as your container registry and push all of your container images there. But in our case we need to use other registry. So in other registry

[8:29:20] I need to provide the image over here. So what is my image name? If I go to the docker hub and uh if you see here this is your image name. So I can copy this paste it somewhere in the notepad. So you'll able to see what what is the name

[8:29:34] of my image. So if you see here this is the name of my image. So what is this name? This name specifies this is uh Iran ketani which is the registry name repository name. Simply learn is the

[8:29:49] image name and is2 v3 is the version that I want to pull. I have different versions like version one version two version 3. So this is the one which I want to pull. If I want to pull version two I just need to change v3 to v2.

[8:30:04] two I just need to change v3 to v2. Right? So I'll just copy this name. We'll go back to the browser. Paste it here. So it will know that from this registry it has to pull. All right. And the OS type whether it's a Linux or

[8:30:19] Windows uh that's something you should be getting it from the uh registry itself. So the the the OS architecture that's being used while creating this

[8:30:31] image was Linux. So it's mentioned here Linux AMD 64. Okay. So that's what I'm selecting Linux. Then size what you want? You want one virtual CPU 1.5 GB

[8:30:44] memory or if you want more you can change the size. Right. Next in networking if you want to have a lab a DNS name you can add that DNS name but unique otherwise your deployment will fail. All right. Uh which port your your

[8:31:01] that's something you can add over here. My port my application is listening to port number 80. So port 80 I can use here. Right? If you want to have monitoring, you can use it. I don't want monitoring right now. We will understand

[8:31:15] what monitoring is later in the monitoring chapter. On on failure, what do you want to do? Uh I mean do you want to restart the container when when it fails for any reason? So you can select that always it

[8:31:27] should restart only on failure it should restart or it should never restart. you should be you would be restarting it manually. So that's something you can select. All right. And then if you have any environment variable like for

[8:31:40] example your container will be interacting with the database. So that database is added as a connection string. So you can add the connection string over here. If your container is interacting with storage and you have a

[8:31:54] storage key so you can add the storage key over here. So those as an environment variable will be added. uh I don't have any so I'm not adding it and then once everything is provided I can click on review create and then click on

[8:32:07] create so my container will be deployed [snorts] all right so now container will be deployed in 5 minutes and once the public IP for my container and then

[8:32:20] similar to a virtual machine I can access my container directly using I mean I can browse my my website from that container

[8:32:40] what else should be considered when choosing containers over VM. So we have this entire table which I gone through right. The main question that you should ask

[8:32:52] whether I should use container or the virtual machine is you should be reaching out to your developer. It's not it's it's if you're a developer you can decide whether to use container or virtual machine. If you are an

[8:33:04] be deciding where to go whether to go for container or virtual machine. If your developer is writing your code in a containerized form then obviously you have to go for container. You you should not be going for virtual machines.

[8:33:18] advantage? I already shown cost is the is the one advant one advantage that you get. Apart from that it's a managed service. It's a pass service platform as a service. So I don't need to bother about the virtual machine where this is

[8:33:32] hosted. It's Azure's responsibility to make sure that my container is up and running. You get a very fast startup. Even if you're using virtual machine nowadays the boot is quite fast. uh with Windows 8, Windows 8, Windows 10,

[8:33:45] Windows 11, the booting is quite fast. So, Windows Server 2025 is also boots quite fast. But obviously after booting it takes time to bring up all the services and all where where container doesn't have that problem. Your

[8:33:59] application is entirely isolated. You don't have to worry about your net or or any runtime that you are using anyway framework that you're using. The main advantage that you get when you use container is portability. Okay. Once you

[8:34:13] create a virtual machine, you need to rely you need to u uh make sure that properly and all those stuff. With container, the backup is not a problem. Why? Because we are relying on images. So once you have your image pushed

[8:34:28] somewhere, then you can pull it anywhere in any platform which supports container. If I want to let's say I'm using virtual machines and now suddenly I want to change my platform from Azure to AWS.

[8:34:41] that everything is backed up properly. All virtual machines, all applications, whatever I have uh in Azio platform is backed up properly so that I can restore it in AWS. Right? So that's another uh limitation

[8:34:56] you can say. Uh it's not a disadvantage on using virtual machine. A question may arise that if container is so powerful why people are still using virtual machine why don't they go for container see using virtual machine I can host

[8:35:10] multiple containers if I don't want to use Azure container instance I can create my I mean I can deploy my own virtual machine deploy docker on on that virtual machine and run multiple containers there so that's

[8:35:23] one way I can use with virtual machine I can host multiple website if I deploy can host multiple website if I deploy IIS I can host multiple web If I deploy Apache or EngineX, I can host multiple web app. With container, I can host a

[8:35:35] decide. If I if I want to host another web app, I need to create another container. All right. So that totally depends on how your your company is is deploying web apps and all depends on that you can

[8:35:50] decide whether to use virtual machine or whether to use container. my container. Once I go to that public IP, if my image is correct, I should see my application up and running. All right. So, I pasted my IP address uh

[8:36:06] IP address of the container. [snorts] or RW allowed in containers. I can change whatever I want, but that's not

[8:36:22] the mean meaning of of container. I can connect to my container. I can access the the the shell and I can make the changes. So I have the read write credential but that's not the meaning or that's completely beat the beat the

[8:36:36] concept of using container. You have read write access. You can make changes. I can I can delete any file from here. I can uh add extra file here if I want. If can uh add extra file here if I want. If I can connect right. So if you have the

[8:36:50] readr access but that's not the way you use container. When you create an image, that image should be like uh pushed somewhere in some repository or some registry and you would be pulling that image from there.

[8:37:05] Any changes that you would want to make is to that image, not to the running container. All right, you have the readr access. can do whatever I want. I can delete some files if I want. I can restart some

[8:37:21] services if those services are running. Right? So it's it's the bash shell that I have got. Okay. [snorts]

[8:37:38] containers, you're not keeping data in the container. As I mentioned that the the container. As I mentioned that the containers have ephemeral storage. I will not be keeping my data. The container will only be used to running

[8:37:50] the database engine. That's all. The data will not be stored in that data uh in in the container itself. All right? Data won't be stored in the container. Container will only host the database engine.

[8:38:04] database engine. Clear? selection depends on web app. What do you mean by that? I I didn't get your

[8:38:16] you mean by that? I I didn't get your question. which form uh which framework you want to use. Can you tell me can I run the Java application on Windows?

[8:38:36] I mean I want to host a application written on Java written in Java on a written on Java written in Java on a Windows platform. I I I I can't okay I can't run Java application on Windows. Can I use net uh 3 not three two before

[8:38:55] Can I use net uh 3 not three two before three I can't use net ASP.NET on Linux. So after that Microsoft came up with net core which is which is uh platform independent that means I can use net core on Linux or Windows. Okay. So

[8:39:10] operating system is just a platform where you'll be hosting your totally totally depends on your If you're working with Windows and you're comfortable with Windows, you'll

[8:39:22] be selecting Windows. But you'll have to pay the license. Okay? If I want to use Whereas in Linux, I have certain distributions where I don't need to pay anything. Okay? So here you you're saving the cost, license cost. Okay?

[8:39:37] saving the cost, license cost. Okay? [snorts] container, which operating system to select that depends on which operating

[8:39:51] system your developer used to develop or or to come up with the container. So when I created this container image, I used Linux. Similarly, if someone is using Windows, uh you should see Windows here. Okay. So you need to reach out to

[8:40:05] your developer which platform they will they are they they used when they they are they they used when they created the uh the image. Okay. So that's that's something that your developer can answer. You are not

[8:40:18] the one who can decide whether I should simply go with Linux. Uh you cannot decide that. you need to rely or you need to uh lies with your developer and ask them which which language or which not language

[8:40:34] which OS architecture they used. All right. See anything that I'm deploying a me is cost. If I'm deploying container I have to pay something to Azure. It's not free of cost. I'm running the container

[8:40:49] instance on top of Azure. I have to pay. All right. So cost will be there. Obviously whatever service you are deploying you'll have to pay. So Azure will charge me on on my subscription when I'm running this if I keep keep

[8:41:03] this container instance running for 24/7 I'll have to pay certain charge. Okay. What how much I'll be paying you need to go for go to the pricing calculator page and you see how much the estimated billing is. So for this container which

[8:41:19] I selected is having one virtual CPU and 1.5 GB of RAM. So I might be paying around 20 25 rupees if I keep it all running for like 24/7 for 30 days. Okay.

[8:41:31] So if you want to use Azure container instance obviously you'll have to pay charge. I'm storing this image from last four years. I'm not paying anything to to Docker. Okay. So for storing this image is it's free of cost.

[8:41:47] >> All right, the next topic that we have is Kubernetes service. Azure Kubernetes service. Azure has this service Azure Azure container instance. Okay. Uh the second service that we have for containerized application is Azure

[8:42:02] for Azure Kubernetes service when we have Azure container instances. Now if you see in the container instance I don't have a way to scale up. Right now I have given this container

[8:42:16] like 1 GB something and and one virtual CPU something. If I scroll entire all the options if I see all the options over here I don't have a way to scale up or scale out. That means I cannot add additional instances.

[8:42:31] So in any case if this instance goes down for any reason let's say the region where I've deployed it that region has has lost the network connectivity or because of war this region is blown uh is is is not available so my container

[8:42:46] is gone I cannot scale it up I cannot scale it out there's no way okay so that's the limitation of Azure container instance and mostly u for for me I have not seen container instance Azure container instance in in

[8:43:01] production, I'm not seeing it. Why? Because there's no way to scale it out. If some if something happens, it goes down, I need to manually come over here and and start it or restart it. By the time I notice or or I realize that this

[8:43:14] container instance is down, uh it might be a might be like half an hour or 15 minutes or 1 hour. So for that amount of time, my application will be down. So Azure contain instance is not meant for production. You can use it for dev test

[8:43:29] environment. Okay, just to check whether your container is working perfectly fine your container is working perfectly fine or not. So if I want to host a container on Azure, then what is my option? So the second option that you have is

[8:43:41] Kubernetes service. Now what is this Kubernetes service? Azure Kubernetes service. Now Azure Kubernetes service is nothing

[8:43:56] uh it's just a managed Kubernetes cluster. Okay. Now, what is a Kubernetes cluster? So, if I go to the Kubernetes documentation and if you see the Kubernetes cluster somewhere, uh if you see the installation of Kubernetes

[8:44:11] cluster, if I scroll down, there are a lot of uh install if I want to create my own cluster. So that cluster is like you

[8:44:28] have the master node, you have the worker node. Uh if it's if it's worker node. Uh if it's if it's mentioned somewhere

[8:44:43] the cluster architecture. So if I go to the cluster architecture nodes, you might see that here somewhere you have like master node and the worker nodes.

[8:44:55] I don't know if they have moved it somewhere but uh let me just explain it in the documentation because obviously if you want to learn Kubernetes this is the the this is the official documentation that you can learn that

[8:45:08] you can go through. Okay. So yeah here it is. So if you see you have different uh components you can say or u uh the

[8:45:22] objects you can say in in Kubernetes cluster you have control plane and then cluster you have control plane and then you have data plane. Okay. Uh another term for control plane and data plane is uh master node

[8:45:38] and worker nodes. Okay. What is this? What is the difference between master node and worker node? I'm not explaining you a 305. I'm not explaining you Azure Kubernetes service. I'm explaining you basic Kubernetes. Okay. So what is a

[8:45:50] Kubernetes cluster? Kubernetes is a is an orchestration tool. Now I just uh demonstrate you the deployment of uh ACI Azure container instance and and then I

[8:46:02] container instance. What is the limitation? I cannot scale it out. I cannot scale it up. Say if my container instance is down for any reason my instance is down for any reason my application will be impacted right. So

[8:46:15] we need some kind of orchestrator which can make sure that my container never goes down. So that orchestration orchestrator is nothing but Kubernetes. So Kubernetes make sure that your application is up

[8:46:30] and running in any point in time. Okay. That application is deployed uh in Kubernetes. We call that as a pod. So that application is deployed in a pod. Pod you can you can say that pod is nothing but a container. Okay. Just to

[8:46:45] All right. So what is the Kubernetes cluster architecture? Kubernetes cluster architecture is divided into two parts. Master node and worker node. Uh control plane and the data plane. So in control plane you have some components like

[8:47:03] database, HCD, you have API server, cube API, you have scheduleuler, you have uh API, you have scheduleuler, you have uh controller manager, you have uh cloud controller manager. So these are all the components that you have within a within

[8:47:17] a Kubernetes cluster. Now with what each components does is something I'll I'll uh I'll leave for you guys to to figure out if you are interested in learning Kubernetes. I'll leave that for you guys to to go for a Kubernetes course if you

[8:47:33] understand all these concept. But in simple HCD is the database scheduleuler is the is the component which is responsible for your application. Like

[8:47:45] in the worker node you might have one node or two nodes. Nodes are nothing but virtual machines. Okay. So in those virtual machines you'll be having like my application let's say as a two container instance. So if one container

[8:47:59] instance goes instance goes down my application is still up and running. So my actual workload my actual application will be running in the in the worker node. Okay. Now in which worker node my application will be running will be

[8:48:14] decided by the scheduleuler. All right. The API is responsible for communication between the control plane and the data plane and the worker node. All right. Controller [snorts] manager is obviously as the name specifies is is

[8:48:30] is responsible for managing things. The cloud controller manager is responsible if you're using Azure or you're using AWS then this component is useful. So if

[8:48:42] you're coming up with your own Kubernetes services, your own Kubernetes cluster, if you have your own cloud, you can develop this CCM according to your your uh your cloud platform. Okay, that's not something for the normal

[8:48:56] user. It's it's something for the for the cloud provider. All right, so these are all the components you have from AZ305 point of view. If you don't know all these component, that's perfectly fine. Now for a 305 point of view, what

[8:49:11] you need to know is that we have two comp uh two planes in a Kubernetes cluster. Control plane and the data plane. Is that clear? Control plane as the name specifies it's responsible for

[8:49:26] controlling things. Controlling things like where to place the application. Uh how the scheduleuler will define where to place the application. It's possible that this node is full. there's no resources uh left in this node. So

[8:49:40] scheduleuler will place the application in this node. Right? If uh this node is going down, so scheduleuler will transfer all the all the application containers or all the application parts in in the node which is healthy. So

[8:49:53] that's the scheduleuler's work. All right. So what you need to understand is data plane and control plane. Is that clear? If you want to clear your own cluster, own Kubernetes cluster, you need to deploy the control plane as well

[8:50:07] need to deploy the control plane as well as the data plane. This is clear. Is this clear that what is a Kubernetes cluster? Uh it's it's it's of two different planes. Control plane and data plane. Control plane is

[8:50:19] responsible for deploying things whereas data plane is responsible for hosting data plane is responsible for hosting things. Clear or any question? API is, what scheduleuler is, what HCD is, what CCM is. No need to understand

[8:50:33] as of now. Okay. I just gave you the overview. overview. Any question on the Kubernetes cluster? There are two components. There are two planes. Control plane, data plane,

[8:50:46] planes. Control plane, data plane, master node, worker node. Clear guys? Answer. Master node, worker node. Okay. Now what Master node, worker node. Okay. Now what is AKS?

[8:51:01] [snorts] AKS is a managed Kubernetes cluster for you for customers. Managed Kubernetes cluster that means whatever you are seeing over here you can see that it's very complicated. Okay. So as a company

[8:51:17] as an organization if I want to use Kubernetes I need to hire people who understand Kubernetes. I need to hire the uh the personal the people who have experience with Kubernetes who have deployed the cluster from scratch. I

[8:51:32] need to hire those kind of people. So what cloud providers did they came up with their own managed service AKS. Okay you don't know Kubernetes fine you use our managed service Azure Kubernetes service.

[8:51:47] Everything will be managed for you. We just have to deploy the Azure Kubernetes server. That means this cluster will be deployed for you by Azour. All right. Now, what is the advantage is? What is the advantage of using AKS

[8:52:04] over ACI? ACI is Azure container instance. What is the advantage? As you can see, as I say, the limitation in ACI is uh you cannot scale it up. With Kubernetes, you get this advantage. Self-filling.

[8:52:20] What is the meaning of self-filling? For any reason if your clust if your cubernet uh if your pod that means your container is going down Kubernetes will container is going down Kubernetes will bring another container.

[8:52:35] going down Kubernetes will bring another container so that your application is self-filling. Automatically a new container will be Automatically a new container will be created for you. Dynamic scaling you can

[8:52:49] created for you. Dynamic scaling you can scale uh you can scale your container dynamically that means automatically in case there is a there is a high usage. Okay. So we can we can uh configure Kubernetes in such a way that it will

[8:53:05] automatically add extra instances depending on the number depend depending on the traffic dynamic scaling. Okay. If traffic is is moved, it will remove the extra instances. Rolling updates with Kubernetes, we get

[8:53:19] Rolling updates with Kubernetes, we get the option to update uh we to do the rolling update? You have version one of your application running in three instances, three pods, three containers. Okay. Now version two is ready. So what

[8:53:34] Kubernetes gives you? Kubernetes gives you an option to deploy version two in container one first. Okay. So, new container will be first. Okay. So, new container will be up with version two. The once the new

[8:53:48] container is up with version two, the first container will be removed. Then second container will be created with version two and the old second container will be removed. Then third container will be created with version

[8:54:01] two and old third container will be removed. So this is known as rolling update. With rolling update what advantage you have? The advantage you have is I'm not bringing my application down

[8:54:14] when a new version is available. I'm doing a rolling update. That means I'm only bringing one container. Two containers still with old version still up and a new container with version two is up. Then new container with version

[8:54:29] two will will come up. The old container with version two will go down. Then the come up. And the third container with version one will go down. So by doing this my user my end user services are still being served the request still

[8:54:44] being served. They're not we are not bringing a entire application down. So by this way we can achieve zero downtime with rolling updates. All right. So that's something you can achieve with Kubernetes which is

[8:54:58] instance. Okay. You can dynamically adjust the number of container instance. If I say uh Kubernetes that I want three instance. So at any point in time Kubernetes will make sure that you have

[8:55:11] three instances of your application running for any reason if one instance goes down Kubernetes will automatically bring back the third instance. So it will make sure that any point in time you have three instances up and running.

[8:55:26] All right. So it gives you the container orchestration. The orchestration is like managing containers on on scale. You can bring like thousands of containers. You can host thousands of applications on a single Kubernetes cluster. Uh it's a

[8:55:42] managed service. So the control plane and the uh uh data plane is managed for you. Right? Ease of deployment. So you you saw the the complexity involved in

[8:55:55] installation of Kubernetes cluster. With AKS, it becomes very easy to deploy Kubernetes. Since this is an Azure service, we can integrate it with any other Azure service. We can add extra number of instances whenever required.

[8:56:10] Okay. Uh your data is secured since whatever you're you're you're pulling or pushing in Kubernetes cluster behind the scenes in the data center everything is encrypted automatically. Okay. And you

[8:56:22] can optimize cost by bringing down the nodes which are not required. So if I need only two nodes, I keep two nodes. If I need third nodes in next month, I can add third nodes. So those kind of thing you can do which

[8:56:36] helps you to optimize the cost for Kubernetes cluster. Okay. All right. So that's about Kubernetes cluster. So during the break I created I've deployed the Kubernetes cluster. So if I go to the resource group you should

[8:56:51] see the Kubernetes cluster already here. So I deployed it with the name my AKS So I deployed it with the name my AKS cluster. Now how how did I deploy it? I cluster. Now how how did I deploy it? I use the command line. Okay. Um it's very

[8:57:03] easy to deploy the cluster using command. But if you go via the graphical way, it's very I mean there are a lot of options that you need to select. So I'll just paste the command here. So if you want to work later uh

[8:57:16] in in your time whenever you are whenever you are doing the hands-on so whenever you want to work you can use this command. Okay. Uh where will you be running this command? You can use cloud shell. Okay, remember from the uh guided

[8:57:32] shell. Okay, remember from the uh guided tour on the first day I we we I I explain what is this? This is a cloud shell, right? So using cloud shell, you can run this command using bash or

[8:57:44] powershell whichever you prefer, right? I prefer bash mostly when I'm working with azure but if you prefer powershell you can run the same command in the powershell. So what this command is doing as the name as the command

[8:57:57] doing as the name as the command specifies quite simple. It says a is nothing but the Azure CLI AKS AKS is Azure Kubernetes service create. So what we are we are saying we are saying create an AKS cluster. The name of

[8:58:11] cluster should be my AKS cluster. The resource group where it should belong to. The location where you want to deploy and the node count how many nodes you want. Okay, you can go n number of nodes since this is a cloud. Okay, so I

[8:58:26] went with one node uh which will obviously uh incur less charges, right? So this is the command that you can use. So I'll copy this command and paste it in the chat. So you can use this command whenever you want. Okay, whenever you're

[8:58:40] working, just make sure you're matching the resource group name. If you do not have this resource group, please create one and then deploy this resource or according to your resource group. Whatever name you want, you can keep. So

[8:58:53] I kept a very simple name, my AKS cluster and the location where you want to deploy. Right? So if you see my resource group, I mean my cluster is already created. So if I log into portal in another tab,

[8:59:08] if I log into portal in another tab, [clears throat] I should see my cluster.

[8:59:21] yourself that means not on cloud you create yourself on prem uh you need to mentioned earlier using kubernetes documentation right so we don't need to do that just run this command and cluster is is ready so this is my

[8:59:35] cluster now using this cluster I can host uh my application on this cluster a zero kubernetes uh service all right now how to host the name uh sorry how to host the application now in order to host the application in Kubernetes we

[8:59:51] have like different workloads. Okay. Now again from AC305 point of view you don't need to know all the workload you just need to know that there is a service in Azure which helps you to host the cu host the workload in cubernetes using

[9:00:06] Azure Kubernetes service. So if I go to Kubernetes documentation go to the concept there you should have workload. So there are the different

[9:00:21] workload that we have like pods uh you have uh deployment you have services like load balancers and all. So in order to host an application you need to host that in a pod. Pod is the smallest unit in Kubernetes. Doesn't matter where your

[9:00:37] running on prem whether it's running on AWS on GCE concept is same once you understand Kubernetes anywhere you can work with Kubernetes doesn't matter

[9:00:49] where where it is hosted okay so the important thing to understand is Kubernetes first in order to work with AKS EKS or GKE so what is pod pod is the smallest uh

[9:01:02] unit in Kubernetes where your application is actually hosted If I want to host an application, I need to host that in a pod. Okay. So, how do I run a pod? So, if you see here in in in the Kubernetes cluster, you have the

[9:01:15] workloads here under Kubernetes resources, you have the workload. So, if I see the workload uh the existing workload will be uh will be visible. Now, what these existing workloads are? These existing workloads are the uh

[9:01:30] components of Kubernetes cluster. Now this is where Azure uh is managing your Kubernetes cluster. So it is already it has already deployed some components uh which has nothing to do with your application that you're

[9:01:44] have different types of workload which is mentioned there. Okay. You in in order to host an application you can host that as a pod or as a deployment. So what is the difference between pod

[9:01:56] and deployment? Pod is like a single instance like a container. You're you benefit over as your container instance. When you want to run your your application in multiple instances then you need to run that as a deployment.

[9:02:10] to run or deploy anything with Kubernetes, there are two ways. Kubernetes, there are two ways. So if you go to the workload,

[9:02:22] they should mention somewhere how to deploy a work how to deploy a pod. So if I scroll down somewhere, we should have a YAML file. So in order to work with Kubernetes you have two ways either work like this I mean define everything in a

[9:02:36] like this I mean define everything in a YAML. YAML is a way uh it's like a JSON but it's not JSON. It's another markup language where you can deploy uh your application. I mean your you can define your configuration not application. So

[9:02:50] here kind pod. If I want to deploy a deployment set I will change that as a deployment set. Okay. Uh the name of the pod will be web server. If you see there is a image. So here you need to put your image. All right. What image you want to

[9:03:07] uh you want to use. So this is one way of deploying the the the workload on Kubernetes. But since this is quite complicated for freshers and all I'll give you single command. So you can use a single command as well. But in order

[9:03:22] to work with command we need to use the cloud shell. Okay. Now, in order to work with a Kubernetes cluster, the first thing that will be that you will be that we need to do is authentication.

[9:03:37] So, I need to authenticate even though I am logged in using the same cloud shell using the same user and I'm I'm I'm this user using this user I have deployed the Kubernetes cluster. I need to connect to the cluster and while connecting to the

[9:03:51] cluster it will authenticate me. So in order to get the credentials of the cluster you can go to the overview page and here you have the connect option. You can click on the connect option and this is the command that you need to run

[9:04:06] a AKS get credential the resource group name where where your cluster is deployed and the cluster name. That's all. Once you copy that, you paste it in a command line and whatever command you'll be running that will be run

[9:04:21] you'll be running that will be run against this cluster. Okay, it's not against this cluster. Okay, it's not giving me the the access. Okay, now I have the access. So what I missed? I missed the first command. So I

[9:04:33] copied this command as well. I thought this command is not required, but this that I might not have access. So I need to set the subscription first and then I need to download the cluster credentials. When I once I download the

[9:04:46] cluster credential, I should be able to communicate with the cluster. Now we have come to the end of our session on a 305 designing Microsoft Azure infrastructure solutions. Thanks for watching and keep practicing because

[9:04:59] cloud architecture is not just about knowing services and do not forget to subscribe simply learn for more such valuable courses.