AZ-305 Full Course Breakdown & Transcript

[00:09] is important, but using them correctly is even more important. The real question is, is your cloud infrastructure secure, scalable, reliable or costefficient? Can your application handle more users? Can your

[00:21] data stay protected? Can your system recover quickly if something goes wrong? Welcome to the session on a 305 designing Microsoft Azure infrastructure solutions. In this course, we will understand how businesses design cloud

[00:35] infrastructure using Microsoft Azure. We will start with the basics of Azure infrastructure and understand why companies use cloud platforms to host applications, manage data and scale their services. Next, we will explore

[00:48] important Azure concepts like subscriptions, resource groups, regions, availability, zones and governance. Then we will explore compute services like virtual machines, containers, app services and Kubernetes. These services

[01:02] help businesses run applications based on their workload needs. Next, we will look at Azure storage and database solutions where businesses store files, backups, application data and structured information securely. We will also

[01:16] understand networking concepts like virtual networks, subnets, load balancers, application gateways and private connectivity. These help cloud resources communicate safely and keep applications available. Finally, we will

[01:29] explore monitoring, backup, disaster recovery, high availability and performance optimization because cloud architecture is not just about deployment. It is about designing systems that work reliably in the real

[01:43] world. So before we begin our session, just a quick information guys. Simply learn offers a certification program in cloud computing and devops in collaboration with triple IIT Bangalore. This program helps you master genai

[01:57] devops and cloud tools across AWS, Azure and Google cloud through live online classes, integrated labs and real world projects. Here you will gain hands-on experience with tools like Docker, Kubernetes, Terraform, Genkins and

[02:11] Cibil, AWS, Azure and Google Cloud and even build your portfolio with 30 plus hands-on project and three industry oriented capstone project. Here learners will also receive a program certificate and transcript from triple Bangalore

[02:25] along with official Microsoft learn certificates in relevant Azure modules. The program also includes AI powered job assistance, réumé building, LinkedIn profile optimization, mock interviews and career support. All of this under

[02:40] just one course. So now before we begin, let's have a short quiz question. And the question is, what is the main goal of Azure infrastructure design? And your options are option A to randomly deploy cloud services, option B to design

[02:54] secure, scalable and reliable cloud solutions, option C to avoid cloud networking or the option D to remove security from applications. delivery of services. Now the first question that most of my student ask is

[03:10] why do we need these services? Compute, storage. Do you guys know why do we need these services? Let's say there's no cloud. If there's no cloud and you want to host your website or an application, where do you host it?

[03:24] You want to host a website or a web application, where do you host it? So, if there's no cloud, we need to create a data center. Okay, we need to first have a data center before I or Windows Server, we

[03:37] need to have our data center. Now, what do you think? How much charge or how much cost will I have to bear as a company or as an organization if I want to have my own data center? First of all, I have to pay for the

[03:53] infra. I need to find a place and imagine a uh imagine having a big big space in a city like Mumbai or Bangalore. How much you have to pay

[04:05] right before even starting your business? You'll have to pay for that infra. You need to buy that that place first. You need to buy that that place first. You need to put your racks, your servers

[04:18] there. Then you need to think about the the power power supply. You need to think about the redundant power supply since I don't want to rely on single since I don't want to rely on single power supply. Right? So this is the is

[04:31] power supply. Right? So this is the is the uh cost that you have to bear if you the uh cost that you have to bear if you do not go for cloud. But as Har is mentioned that we har is mention mentioning that we can go for colo. Yes

[04:43] you can go for collocation as well but for that as well someone has to has a data center. You can go for colo but someone has to has a data center right? you. Yeah. So that colo is like you're just

[04:59] renting spaces. So you're just renting the data uh you're just renting one or two uh servers or you're just renting entire rack in that particular data center and you're putting your own servers there. So that's that is the

[05:11] right so that was also possible before cloud but after that not everyone can afford of creating a or or developing or uh building a data center. So what

[05:23] uh building a data center. So what happens the big companies like Amazon, Google and Microsoft and there are a lot of others or all right so these big companies what they did they created

[05:37] data centers and they started providing the computation services like compute storage database networking on rent. All right. So

[05:52] today when someone says that we need to move to cloud or we need to migrate to cloud or we want to use cloud computing they're mostly mentioning that we want to use the AWS infra GCP infra Google infra or Microsoft Azios infra or

[06:04] Oracle's infra depending on uh which part of world you are we need to use their infra and deploy our computation resources all right so what is why do we need this computation resources compute resources

[06:18] like for example let's Say you have an idea and you need to use information technology to bring that idea to life. That means you have a business. A simple example I can take is let's say Swiggy. So what is the idea behind this

[06:32] business? Deliver deliver food delivery service. So when you use Swiggy, are you making the food? Obviously no. Someone else is making for you. So you're ordering it from their place, right? So what is

[06:45] this? This is like a food as a service. So it's again a uh cloud service right? So you can say that it's it's a cloud kitchen from where you're ordering. So to build something like this or whatever your idea is and you want to use uh

[07:00] internet to deliver services. So in order to use internet in order to develop or in order to bring my idea to life first of all what I need I need to hire a developer.

[07:16] Why do we need a developer? Developer will write the application for me. So what is an application? Application is nothing but some files. So if you have nothing but some files. So if you have ever developed a very simple HTML uh uh

[07:29] page or HTML website, static website, if you have developed that you know that an application is nothing but list of files. There there will be a lot of files. If you're writing application inn net or Java or whatever you're just

[07:42] coding. If you're a developer, you might know better, right? You're just coding. So that code is saved in nothing but a file with some extension, file with some extension, right? So in order to make sure that my

[07:55] right? So in order to make sure that my website is is is reachable to to my customers or to my users who wants to deliver food or anything, whatever your idea is, I need need to keep this file somewhere and that somewhere is nothing

[08:10] somewhere and that somewhere is nothing but a server. you place that server? You need to place that server in a data center.

[08:23] So as as Har mentioned, you can collo col co uh you can get a collocation place in one of the data center. You'll be paying some rent or you can simply launch the server on a cloud company. Now tell me what what what do you think

[08:37] what will be the cost of buying a server from IBM or from HP? What will be the cost of buying one server? Around $1,000, right? It's around one

[08:49] lakh or two lakh or three lakh rupees. Depends on which company you go for and what configuration you want. Right? If you have never heard of server, what server is? Server is nothing but a computer. So if you go

[09:03] today to buy a new laptop, what do you what do you see or uh which laptop you So what do you see in that laptop? You'll see the config, right? You'll see the storage, what is the SSD given,

[09:18] you'll see the processor, what processor is being used or being uh installed in this laptop, right? You'll see memory, the RAM. So these are the three most

[09:30] important thing that we see. Similarly, server is like you can say a powerful computer which provides services. So you know the laptop is like for commercial know the laptop is like for commercial use that means for us just to uh do a

[09:43] use that means for us just to uh do a meeting or do or or for entertainment purposes like I want to watch a movie I can watch it on a on my laptop. I can do some of my business business things. But you cannot host your website on laptop.

[09:56] Technically you can but your laptop is not as powerful as server to provide the services. Okay. So similarly similar to laptop you'll server you'll be having some operating system in laptop you have an operating

[10:12] system right you have windows right so you you you go for Windows 11 nowadays or if you're uh fond of Mac you'll go for Mac. So Mac has their own Macintosh.

[10:24] Apple has their own Macintosh operating system like or there's another uh variant in market which is Linux right so on top of that server you'll be having an operating system what is an operating system operating

[10:40] system is the mediator between human beings and the uh hardware if I give you a hard disk can you just see that hard disk and try to figure out what do we physically seeing that hard disk like Can you do that? [snorts] No. Right. We

[10:57] need to connect that hard disk to the laptop. How the the laptop reads hard disk. Laptop has the operating system installed and that operating system can detect and read the hard disk and then

[11:10] we can identify what kind of files we have in that hard disk. have in that hard disk. Right? So similarly here we deploy OS on top of our server and then we keep our files.

[11:28] like Swiggy and I also want to come up with a food delivery service first of are a developer you can write your own code but in order to host that code but in order to host that application you need to have the server.

[11:44] So using that server only you can host right now in order to buy that server you have to spend certain amount let's say $1,000 and that amount is upfront That is an upfront cost. When you say upfront cost that means I have to pay it

[11:59] now even before starting my business I have to invest like $1,000 for one server. Now tell me you're buying one server and if that server goes down what happens? Say you're buying one server and you're

[12:12] hosting your application on top of that server. If that server goes down, will will your user will be able to reach the application? Obviously not. Right? If deliver. You won't be able to order anything from Swiggy.

[12:27] So I cannot rely on one server. So I need to buy another server as well. Just to make sure that if one server goes down, my application is reachable from the second server. So instead of $1,000, I need to spend

[12:43] So instead of $1,000, I need to spend $2,000 for two servers. So that's an upfront cost. And this upfront cost is nothing but capital expenditure for your nothing but capital expenditure for your business capex. Okay.

[12:56] Now for for an individual user who or for an startup for a startup investing this amount could be huge. So what they can do they can simply launch portal.azio.com

[13:13] portal.azio.com cloud create a server deploy their and that's all their their website is live. What is cloud computing? If you have a laptop and if you have an internet

[13:26] laptop and if you have an internet connection you can get the server the storage the networking through that internet through the internet. That's all that's cloud computing. Cloud computing refers to the delivery of

[13:39] the internet. What is comput service? Compute services are nothing but you want in order to host a website you would need uh storage, you would need RAM, you would need CPU. So all these services are

[13:54] given to you over the internet. You don't spend spend this much of amount up front. So you're saving already you're saving $2,000 right now. Here you deploy two servers, five servers, doesn't matter. On cloud

[14:08] you deploy two servers, five servers, 10 server. You're not paying $2,000 upfront. That means right now I'm not paying $2,000. So when I'll be paying, I'll be paying as per my use. Pay as you go. So this month, if I'm using five

[14:23] servers, I'll have to pay for the five servers. Next month, if I don't require five servers, I'll remove two servers and I'll pay for What is pay as you go? It's like your

[14:36] electricity, right? So, every month do you get the right? So, every month do you get the similar bill for your electricity? Depends on your usage, right? In summer, we use air condition, uh coolers and all

[14:50] those stuff. So, we pay more in summer, but in winter, do we pay more? Totally depends on your consumption, right? So, that's nothing but the pay as you go approach. Pay as you go. As much as you use, you pay for that. If you use

[15:07] 10 servers, 20 servers, for that much, you'll pay more. If you use only one server, you'll pay for only one server. Okay. I hope you have understood what cloud computing is and why do why you will be

[15:20] using cloud computing. Okay. All right. computing? Cost optimization. As I mentioned that uh if you want to use two

[15:33] servers, three servers, you use that. So depends totally depends on your requirement. You'll be using two servers, three servers, right? So it helps you to achieve the cloud uh uh achieve the cost optimization, right?

[15:46] Optimize the cost. I'm not paying upfront everything. I'll be paying according to my use. performance efficiency very quickly you can uh get the performance increase the performance of your app right I want two

[16:02] servers I want more CPU I can I can do that I want more RAMs I can change change u the amount of RAM assigned to my compute service right so all those thing you can do very quickly apart from that accessibility

[16:17] if there was there's no cloud and you want to come up with your with your IT want to come up with your with your IT business or business using it where you'll be creating or deploying your server. You will be creating or

[16:29] deploying your server depends on wherever you you are. You let's say I stay in Mumbai and I want to I I have an idea and I want to come up with a service. So I'll be searching a place in Mumbai itself

[16:44] and if my user base in is is in US I need to go to US and there I have to deploy my server in one of the data center right so with cloud it has become very easy I can deploy wherever I want depending on uh let's say I want to

[17:02] deploy a server so in cloud it's it's quite is known as virtual machine so I'll click on create create virtual machine and And here you see if you want to deploy it in US you can select US

[17:16] East US west. If you want to deploy it in Australia you can select Australia. you need? You just need an internet connection and you can deploy wherever connection and you can deploy wherever you want. Wherever Azure has it presence

[17:28] right? I want to deploy in Europe. I can go for Europe. I want to deploy in uh go for Europe. I want to deploy in uh UK. I can go for UK. Right? So these are the different uh these are the benefits of using cloud computing. These benefits

[17:40] you cannot get when you are deploying everything on prem. Okay. Reliability So cloud is reliable. Why it's reliable? Because they by default monitor it.

[17:57] Okay. Uh by default monitoring as in it's not like that they will take actions on your behalf. only if you configure they can take actions on your behalf but if you don't configure uh they'll not they'll not take that action

[18:12] they'll not they'll not take that action right so cloud is reliable flexible you accessibility you can deploy wherever you want whatever size of uh server you want you want more CPU more RAM depends totally on your requirement and security

[18:28] whatever data you you are keeping on cloud uh by default is it is secured you don't need to worry about security. Why? Because what I'm putting in my uh

[18:41] storage account in my storage Microsoft is automatically encrypting that. What is like uh a security algorithm which is making

[18:54] your data unreadable. Okay. Sorry. >> So secure uh encrypt encrypting is a way is a security algorithm which is making your data whatever data you're putting on cloud unreadable

[19:10] that means when I'm putting a data in in your own laptop where do you add your where do you store your data we have hard disk right solid state drive or hard disk in that hard disk we keep our data so if you

[19:27] remove that hard disk from your laptop and attach it to another laptop. Can you read the hard disk or no? If I remove the hard disk that I have over here, remove it from laptop number one and connect it to laptop number two,

[19:42] will I be able to read my data? Yes. Right? I'll be able to read my data. So, cloud, what cloud is doing? Cloud is nothing new. Cloud is also using hardress drive or solid state drive to keep your data. So, what happens when

[19:55] you keep your data in cloud? it goes to the cloud data center within that data center they'll be having servers or sand storage and in that storage your data is stored. So if someone goes there who has the

[20:08] physical access to the data center if someone goes to that hard disk take out the hard disk connect it to our laptop where's the security then he or she will be able to read the data right similar to this scenario if someone goes to the

[20:23] cloud take out the hard disk where your data is stored connect that hard drive to its to his own laptop he'll also be be able to read that data right so to avoid this situation what every cloud cloud provider is doing is encrypting

[20:38] your data. What is the meaning of encryption? Whatever you're writing, you're writing ABC, so that is stored in an encryption format. hard disk and connecting that hard disk

[20:52] able to read the data unless and until able to read the data unless and until that data is decrypt. decryption we require the encryption and decryption keys. So Microsoft stores

[21:09] keys. The uh you have the option to use your own keys as well. Right? So this is one of the benefit that we have in the cloud. Even if the data is even if the device where your data is stored is stolen, the data is secure. No one will

[21:24] be able to read it unless and until they decrypt it. Okay. encrypted. Doesn't matter what cloud provider you're using. [snorts]

[21:36] Okay. Now what is Microsoft Azio? Microsoft Azio as you know is the leading cloud provider from Microsoft. So Microsoft is the owner and Microsoft has created lot of data centers and those services are given to you as uh as

[21:52] a service. Whenever we talk about cloud you will be hearing something a term known as as a service. So Microsoft Azure is a cloud provider. It's a leading cloud provider which offers 200 products and cloud services

[22:07] to you to the users so that they can bring their own idea to life. Okay.

[22:27] well. So you you might uh see me going uh mute a lot of time. Okay. So just bear with me. Maybe tomorrow I I'll I'll feel better. All right. So what is Microsoft Azio? Microsoft Azio is a leading cloud

[22:41] provider available in the market which offers around 200 products. So this is the second I mean if you go 5 years back Microsoft Azio was the second leading cloud provider. But now if you see we have like 55 45 uh ratio in the market.

[22:59] have like 55 45 uh ratio in the market. The competitor to Microsoft Azure is AWS. Depends on which area or which part of world you are. You would see that AWS is used more or Microsoft Azure is used

[23:13] more depend on which part of land. I I stay in Malaysia. So in Malaysia I see a lot of opportunities for Microsoft Azure. Whereas if you stay in Bangalore side in India in Bangalore side you would see AWS requirement more. So

[23:26] you are. If if you're staying in Middle East, Saudi or Dubai, you would see Oracle being used for okay. So totally depends on which part of area you are. But it doesn't matter that uh

[23:42] which cloud you are learning. If you learn one cloud, you'll automatically understand the second cloud because services are are are same. The only difference is Microsoft might be having few different services. AWS might be

[23:55] having few different services. The names for those services are changed. Like in Microsoft Azure we say virtual machine whereas in AWS they say uh elastic cloud compute in Google they say compute engine. So

[24:11] totally depends uh which cloud you're using. Services uh which cloud you're using. Services are same the names are different. Okay.

[24:27] whatever benefits we have we have discussed for cloud computing same benefits applies here as you can see security cost effective scalability data recovery flexibility. So all the benefits you'll get on every cloud

[24:42] doesn't matter what cloud you're using you're using Microsoft Azure same benefits you have security cost effective data recovery scalability flexibility but then the question arise if all clouds have the same benefits

[24:58] uh why should I use Azure over AWS or why should I use AWS over Azure or why should I use GCP why should I learn Azure or why should I why should I learn Azure or why should I learn uh AWS Yes. So that question only

[25:11] I have only one answer to that question that if you are already familiar with Microsoft product or let's say as a company if I'm already using Microsoft products which most company are if I'm

[25:27] already using Microsoft product I can crack a good deal with Microsoft if I want to use Azure. If you're using Microsoft products, it's possible that your company is already Microsoft partner. So they can crack a

[25:43] good deal and they can get get a good discount uh with Microsoft uh if if they want to use Azure, right? right? AWS benefits you like uh if you're

[25:58] already I mean Microsoft Azure started late as compared to AWS. AWS was the first cloud in the market. So that's why AWS has had lot of shares if you go five years back. So if you're already with Amazon and if

[26:12] your sales team can crack a good deal with AWS, your company might be using AWS. If your Microsoft partner in your company can crack a good deal with Microsoft Azure, they will be using Microsoft Azure. Another way is if let's

[26:27] say your company is getting a new project and in that project they will be hiring few people so they will be hiring people and those people are familiar familiar with Azure so for that particular project your company will go

[26:41] with Azure if your company is launching another project and they're hiring people and they see that yeah we have lot of professionals who who understand AWS so for that project they'll go for AWS I've seen this in lot of companies.

[26:57] For my own company, we have few services on Azure, we have few services on AWS. When I raised this question to my manager, why do we why do I why are we using two different services? So, they said that whatever developer we have in

[27:10] this project, they are familiar with Azure, they're familiar with net. So, they are familiar or more aligned to white towards Microsoft project. So that totally depends on your comp on company by company scenario which cloud you'll

[27:23] by company scenario which cloud you'll see more. Okay. But AWS and Azure are see more. Okay. But AWS and Azure are the top contender. GCP is also coming three are the top contenders in the market. So if you're choosing Azure uh

[27:37] you'll definitely land a job and you'll get a good good pay as well. Okay. So the two things that we didn't discuss in the benefit is scalability and data recovery. So what is scalability? Scalability is a way to add or remove

[27:55] the instances from your solution. So let's say I have from your solution. So let's say I have a website. host this website. How do I decide how many servers I should be uh launching on

[28:12] many servers I should be uh launching on Azure and on how many servers I should be launching my website or installing my website? How do I decide that? I can't

[28:24] decide when when the website is new. You cannot predict the amount of traffic your product is going to receive. Can you predict that? Obviously no. So what you'll do? You'll start with less number of servers. Let's say I'll start with

[28:39] two two servers and suddenly my marketing team has done and suddenly my marketing team has done a quite fantastic job and promoted my a quite fantastic job and promoted my website on on so on some popular show.

[28:53] So as soon as my as my website was promoted I saw the spike in the traffic. promoted I saw the spike in the traffic. So in that case if the traffic is more can you u can your two servers handle all all

[29:08] all that all that traffic obviously no depends on what what configuration you have right so as soon as the traffic as the traffic increases I need to add extra servers so

[29:23] increases I need to add extra servers so that adding or removing of extra servers is known as scalability Either adding the services or removing the adding the services or removing the services is known as scalability.

[29:36] All right. So there are two types of scalability horizontal and vertical. So scalability horizontal and vertical. So you can increase the configuration that means you can scale up. Right now let's say you have 2 GB of RAM

[29:53] Right now let's say you have 2 GB of RAM and uh four virtual CPUs. So you want to increase the config that means I want now 16 GB of RAM and eight virtual CPUs. So this kind of scaling is known as scale up or scale down from 16 to 4 GB

[30:09] and two virtual CPUs. Right? So you are either increasing or decreasing. So that is known as scale up. If you're increasing that is known as scale up. If you're decreasing that is known as scale

[30:23] Similarly, if you're adding the number of instances, that means you're adding extra servers. So, you're scaling out. You're decreasing the number of servers. You're scaling in.

[30:37] Okay? When someone says scale up, that means you're increasing the size, the means you're increasing the size, the configuration, amount of RAM. configuration, amount of RAM. If someone says scale in sorry scale

[30:50] down then you are decreasing the amount you're decreasing the configuration. When someone says scale out you are adding number of instances. Someone says scale in that means you're removing the extra instances. Okay? Doesn't matter if

[31:06] you remember scale up scale out. You just need to remember scalability. Scalability means adding extra instances or increasing the configuration or decreasing the configuration. That's all. Okay. Data recovery.

[31:20] all. Okay. Data recovery. Uh by default there's no data recovery. You need to configure it. But when it comes to cloud, it's very easy to configure the data recovery. So as we progress in our Azure journey, we will

[31:33] have one chapter where you'll understand how you can recover your data in case uh there's a failure or in there in case there's a loss of data, how can you recover it? Okay. So data recovery is very simple when it comes to cloud.

[31:48] Cost [snorts] effective and security we have already discussed right. Salman is asking difference between scalability and flexibility. You are flexible to deploy in any region. So any cloud gives you option to deploy

[32:04] your ser services in different regions like I can deploy in India, I can deploy in US, I can deploy in Australia. So depends on my requirement I can deploy it anywhere wherever Azure has its presence. So that is flexibility. You're

[32:19] flexible enough to deploy in any region plus you are flexible enough to deploy plus you are flexible enough to deploy in any size of of the server any configuration which is provided right. Scalability is

[32:33] something where you're adding or removing the extra instances. Now a a very good example of scalability is

[32:47] the Amazon e-commerce website for uh shopping? shopping? So every year Amazon comes up with a sale right. What? What that sale is known as great Indian

[33:01] What that sale is known as great Indian something? No, we have the sale, right? Great Indian festival or something, right? So

[33:15] during that sale, what do you think? the traffic will be more towards Amazon or traffic will be more towards Amazon or the traffic will be less.

[33:29] platform, do you think the internet traffic will be high or will be low? During the sale period, it will be high. Right? So when the sale when when sale is announced, you know that for 4 days we need extra servers.

[33:46] Since that four days we have sales. So we might have lot of traffic. So we know we can predict. So if we have lot of traffic we can add the extra instances instances and then when sale is done after 4 days

[34:01] obviously the traffic will reduce to it normal will have normal traffic. So we can reduce the number of servers. Now I don't know uh how old are you but the first sale that flipkart announced big billion something the first sale was

[34:17] big billion something the first sale was a flop why because flipkart didn't scale its servers and it was it it failed for the first day so they had to increase or add one more day there so they will be adding the scaling uh they they have to

[34:32] add the servers when when they are receiving lot of traffic receiving lot of traffic Okay,

[34:48] screen. Okay. So, these are the Microsoft Azure benefits to the business when they are opting out for the Microsoft Azure. Sisha is asking horizontal vertical scaling bins. I just explained scale up

[35:03] >> [snorts] >> So when you're scaling like this, what horizontal, right? Or sorry, this is vertical, right? So you're adding or you're increasing the configuration of your your server. So earlier you are

[35:19] using let's say 2GB now you're using 4GB. That means you you now you're using 4GB. That means you you have added 2 GB RAM extra. So that is known as vertical scaling. Whereas horizontal scaling is you're adding

[35:32] extra instances. [snorts] You had one instance, you added two instance. So now you have total three instance. This is known as uh horizontal scaling.

[35:45] This is known as uh horizontal scaling. Clear?

[36:12] So, what skills are we going to cover in A305? Now, AZ305 has a study guide. So, A305? Now, AZ305 has a study guide. So, let me just launch

[36:39] exam, I would ask you or I would encourage you to please uh go to this encourage you to please uh go to this website. Okay, this is the official page website. Okay, this is the official page from Microsoft.

[36:57] So, wherever you are sitting before sitting for the exam just go to this. sitting for the exam just go to this. Okay, [snorts] just go to this page. So, what this page is having this page if you go to this

[37:10] page you will see the learn path. Okay. What is this learning path? The learning path is the modules,

[37:22] the flow or the topics that Microsoft expects you to know before sitting for the exam. So what skills are we going to cover? Now I'm not covering the skills from from the PPT. What skills I'm going

[37:37] to cover? I will be following this Microsoft learn path since this is up to Microsoft learn path since this is up to date as per the current exam. Okay. So what are we going to cover? We are going to cover all these uh topics whatever is

[37:49] mentioned like if I go for the first module which is design identity governance and monitor solution. If I click on it uh this is what we are going to cover. So everything is mentioned here topic by

[38:02] topic what you should be knowing before setting for the exam. setting for the exam. Okay. Now if I go one page back and if you see here somewhere you should see the study guide. So what is the study

[38:17] the study guide. So what is the study guide? The study guide is uh is again a guide? The study guide is uh is again a web page where Microsoft has defined web page where Microsoft has defined uh what skills will be measured.

[38:29] Compute network storage monitoring security. If I scroll down, every skills is given certain percentage like every module is given a certain percentage. So

[38:41] from identity governance and monitoring solutions you can expect around 30% of questions from storage you can expect around 20 25 from business continuity you can expect expect around 15 to 20 right similarly

[38:56] from infrastructure solution you can expect around 35%. So what you should be knowing you should be knowing some logging solution like routing logs where you can keep the logs where you what monitoring solutions Azure has to offer

[39:10] what is an authentication solution right so all this topic by topic is is is provided in this study guide. Now same thing is for any certificate that every certificate is mentioned over

[39:24] preparing for before sitting for an exam, make sure you uh glance here to see if you know this, if you know this, if you know this, right? If you do not know this, please try to see what this topic is [clears throat] where you can

[39:40] see you can see it in the learn path. Right? Right? All right. that we are going to cover. Okay. Everything whatever mentioned is here we

[39:55] we are going to cover. Now why I I ask you to visit here because if you see Microsoft keeps on adding or removing something from their exam

[40:07] every 6 month or 1 year right so if you read this this note if you read this read this this note if you read this note says the exam will be updated on note says the exam will be updated on April 17 2026. When was the April 17th?

[40:21] April 17 2026. When was the April 17th? Yesterday. So something is changed. is changed, you should review this study guide.

[40:34] Okay. So if let's say next time, next year or after 6 month, if they don't year or after 6 month, if they don't want this particular topic uh in a 305, so they will remove it from from the study guide. So you don't need to need

[40:46] that uh need to know that. So whatever Microsoft is making changes they will put that in the study guide. Okay. So I went through the old study guide and the new study guide but I don't see a lot of things have been

[41:01] changed. The only thing that Microsoft changed was audience profile. Okay. So it's a minor change from the syllabus wise. Nothing changed. Only audience profile change. So if you

[41:16] see the audience profile here, you should have all the audience profile should have all the audience profile somewhere.

[41:29] here. So this part is only changed. Now what Microsoft added as as far as I know Microsoft only added this. This wasn't part of the old study guide. Okay. But that's that thing which is added course wise. Nothing is changed. The topic wise

[41:44] I have went through the old and new study guide. Nothing is changed. Everything is same from the course point of view. Okay. Uh there the link is shared if you see the chat box. Okay. I already shared the

[41:59] the chat box. Okay. I already shared the link.

[42:11] Now if you see the simply learn syllabus we have like uh we have divided this into 15 different topics but I'm not going to cover it topic by topic as defined here 15 everything I'll be covering or

[42:24] summarizing in 10 or 11 topics okay whatever is mentioned over here everything is summarized in 11 topics since we have 10 days so I've I've summarized everything whatever we have here from identity until uh infra

[42:42] everything I have summarized into 11 topics. Okay, since we have to do the the the uh projects as well. So we need to uh projects as well. So we need to complete everything in 10 days.

[42:56] Whatever Microsoft is asking me to cover, we will be covering everything which is defined in the study guide. Clear?

[43:11] brings to you? The course uh is bringing you the uh some projects, some co-ign projects, some assisted practices. So what these assisted practices are? Assisted practices is is the word documents that

[43:25] I'll be adding to the LMS. So you will be having access to that. You can download it. It's like a stepbystep guide on how to do the demonstration on how to do the hands-on. So those assisted practice I'll be adding we will

[43:39] be having case studies we will be having course and projects ebooks Microsoft has stopped providing ebooks. So your ebook is the learn path.

[43:51] So this is your ebook. Okay the first link that I shared please follow that link that I shared please follow that link uh or simply search for easy 305 in your search engine and you'll be landed to that page. Okay. So here you can find

[44:04] your learn path. Now why I'm stressing on this learn path? Because in exam you have access to the learn path. So when you sit for the exam uh you can access the learn path learn path from there. So if you are stuck or if you don't know

[44:19] the learn path and you can try to read it there within the exam itself can try to find out the answer. So access is there. That's why I want you to go through the learn path so you know in which page what service can get

[44:35] me the answer. All right. getting with this course. Now when it comes to the exam a305

[44:53] The name is design Microsoft as your infrastructure solution. you will be having around 60 to 70 multiple choice question. Totally depends on your set of paper that you're getting. So when I set for the exam I had like

[45:08] for 53 questions multiple choice question and rest of the questions were question and rest of the questions were under case studies. Okay. The total 60 to 70 questions you'll be having including case studies.

[45:21] Then the um the time that you'll be getting is 2 hours. So you'll be getting 120 minutes to complete the exam and then in order to pass the exam uh you'll have to get 700 that means 70%

[45:37] of passing mark out of 100 you'll have to have you'll out of 100 you'll have to have you'll have to get 700 and uh have to get 700 and uh there and once you click on submit there

[45:50] only you'll come to know the result you don't have to wait for the result okay everything is protoced Everything is computer basis. So once you submit uh it will calculate the software will calculate your percentage and you'll

[46:06] pass you need to have 700 you need to get 700. Clear? different languages English, Japanese, Chinese. So whichever language you

[46:18] Chinese. So whichever language you prefer you can uh book exam in that language. Now where to book the exam from? [snorts] So if you go to the 305 page from there itself you have the option to book the

[46:31] itself you have the option to book the exam. Okay. So if you are in India you exam. Okay. So if you are in India you select your region wherever you are. Then click on uh then click on schedule exam and from there it will take you to

[46:44] exam and from there it will take you to the Pearson VOE page. And from there you can schedule you can select the date when you want to sit for the exam. All those stuff you can do in a Pearson VOE site.

[46:58] All right. [snorts] From Microsoft page itself you can book the exam. So that's all about the introduction about cloud computing about Simply Learn and about 305. Any questions on the basics yet?

[47:19] platform as a service and software as a service? Now this is uh important to understand. Uh it's a it's a basic cloud computing service model. Okay. Um

[47:34] when you are dealing with different compute services, you'll have to understand the different between is PA and SAS. [snorts] All right. So what is before going on break let me answer this quickly uh

[47:51] and then uh if I'm not able to complete this in in in the next 7 minutes we'll continue this since this is important to understand is pass and SAS. Now how do I understand is pass and SAS. Now how do I see this is pass and SAS from for me

[48:08] see this is pass and SAS from for me or for you to understand is P and SAS from a305 point of view. Okay, I'm not going at the A900 level since this is going at the A900 level since this is something which we cover in a 900 uh and

[48:23] a 104 as well. I'm not going into that level. So, I'm I'm explaining it to you level. So, I'm I'm explaining it to you from a 305 point of view. Okay, [snorts] the full form is quite simple. Infrastructure as a service, platform as

[48:35] Infrastructure as a service, platform as a service and software as a service. All right. Now, what is infrastructure as a service? So in infrastructure as a service your responsibility is more your as in you are the customer of Azure or

[48:49] any cloud provider. So your responsibility here is more in p your responsibility is less as compared to infrastructure as a service. Uh we are not saying that there's no responsibility there is responsibility.

[49:03] responsibility there is responsibility. Okay. So how does this is pas and SAS Okay. So how does this is pas and SAS are are defined is defined in a shared responsibility model. People people think that since we are

[49:16] provider's responsibility. That's not correct. We are sharing responsibility with the cloud provider. Okay. So what is our responsibility? What is cloud provider's responsibility? that will be defined

[49:32] depending on the model depending on the service model you are selecting service software as service now just to explain this in a simple term [snorts] I just gave you an example of of suiki let's say you have an you have a similar

[49:48] idea and you want to use uh internet for your business so what you need to do you need to come up with an application first what is an application in simple term application is nothing but collection of files where your developer

[50:02] or if you are a developer you will be developing the application. So how do you write how do you code code an application? You simply open a file if you are using visual studio code or whatever you are using you simply start

[50:15] writing your code and that code is written in a in a file. So you'll be having multiple files or you having single file depending on how big your application is. Now in order to store this or save these

[50:27] files, I need a server. Okay. So when I'm when I'm selecting cloud within the cloud, I have two options to select from. Infrastructure as a service or platform as a service. In infrastructure as a service, the

[50:43] hardware server is cloud provider's responsibility. Okay. uh if you remember the data center model where you have to spend $1,000 or

[50:56] whatever the server cost is [snorts] you have to spend that upfront we are not using onrem model right so we are not going to spend this up front so what we are doing we are using cloud even in cloud there is a hardware server someone

[51:10] has bought the hardware server who has bought in our case it will be Azure so if I'm using infrastructure as a service this hardware server is cloud provider 's responsibility. Now within that

[51:25] hardware server, the cloud provider will be deploying their own operating system. So in case of Microsoft Azure, they they are deploying HyperV. HyperV is nothing but an operating system. It's a hypervisor

[51:41] which allows them to create multiple uh machines on or multiple virtual machines on top of this hardware server. Okay. So this HyperV is also their responsibility. [snorts] All right. Now on top of this HyperV, I

[51:55] All right. Now on top of this HyperV, I will be creating my virtual server. This is a physical server which is cloud provider's responsibility. The operating system which is again cloud provider's responsibility. On top of this HyperV, I

[52:08] will be creating my server, my virtual server, let's call it virtual machine server, let's call it virtual machine 01. responsibility. Now within this virtual machine 01 I will be deciding whether to

[52:23] go for Windows operating system or Linux operating system that's I'll have to decide as as a customer I have to decide this okay so here what uh what Microsoft

[52:36] what we will do we will select let's say we select Windows operating system and on top of that Windows operating system you have to use the runtime or

[52:48] the framework work. So when you are writing an application your developer will write that application ill in certain code in some code right he might be using Java he might be using Python

[53:01] might be using net whatever he's using you need to ask your developer or if you're a developer you should know that that there is framework I need to I need to use that language so in order to host the application I need to have this

[53:15] runtime installed on the server where I want to host my application where I want to add my files. So on top of Windows operating system, you will be deploying the .NET framework. Okay.

[53:29] And on top of that net framework, you will then host your application. That will then host your application. That means you will add your files. So what is my responsibility as a user here? My responsibility is the operating

[53:41] system that I'm choosing, Windows operating system. My responsibility is the framework that I'm choosing.NET my responsibility is to take care of my application. That means I have to either hire a developer or if I'm a developer

[53:54] hire a developer or if I'm a developer I'll have to develop the code. Now tell me every month Microsoft launches the update right? you know the update patching

[54:11] receive the update for the applications that you have installed right every that you have installed right every month or every week whatever so since this is hosted on cloud the Windows operating system on my virtual

[54:23] machine who will be responsible to patch that

[54:35] your responsibility you as a user Azure will not patch it for you okay yes there are way to ask Azure to patch uh but Azure by default

[54:47] will not patch you to patch your operating system so you have to patch it then if there is a new version available forn net who will be installing that new version again you so whatever above hyperv

[55:01] is our responsibility So infrastructure as a service model requires more responsibility uh from from the user whereas paz model is same there will be physical hardware server

[55:16] on top of it there will be any hypervisor like hyperv or esxi whatever cloud providers is using there will be virtual machine there will be a virtual machine there will be a framework like net java whatever when

[55:31] I'm using pass all this stuff becomes the cloud provider's responsibility. What is my responsibility when when I'm using p the the application code is my

[55:43] responsibility. So if I'm a developer p is something that I'll be choosing. Why? Because I'll get more time to focus on the development the virtual machine whether it's Linux or operate or Windows. It's Microsoft

[55:57] responsibility to patch. Your responsibility Your responsibility uh reduces when you use the paz model. The p service model clear

[56:15] entire software is given to you as a service like m365 Microsoft 365 you're using Google drive. So Google Drive is a software as a storage service given to you. What are your responsibility when you are using Google Drive?

[56:31] What is your responsibility when you're using Google Drive? Just adding data and sharing that data with whoever you want. That's all. That's your responsibility. So you're using that software entirely. Do you know where Google is hosting?

[56:45] saving in India, Australia, US, wherever, how Google is storing that? Is is that something we need to bother about as a user? Obviously not.

[56:57] So software as a service what is your responsibility? Reduced entirely zero. using free version you can store up to 15GB. If you need more you just subscribe for a plan that's all software as a service. Netflix software as a

[57:12] service. Are we paying for each movie separately? No, we are buying a plan. Do we need to keep a CD of all the movies? No, we just subscribe to a plan. We watch our our content, right? Software as a

[57:28] service. What is the infrastructure as a and a platform part of Netflix? Do you know CDVD for CDVD? What what what was required?

[57:40] We need the CD player or the DVD player, right? So, we need to buy it. So, I am responsible for the hardware. I am responsible for bringing the CD or DVD. I'm responsible for placing that CD DVD within the DVD driver uh DVD reader and

[57:55] then I can enjoy my movie. If I don't have a CD of one particular movie, I don't have the CD right. The CD DVD player becomes the infrastructure as a service part in case of movies and all. What could be the

[58:09] platform as a service part? Uh I cannot think of any here. Okay. for infrastructure service model who will do the service of CDVD

[58:21] obviously I have to do as a as a as as a owner of that right in Netflix however they are hosting it I don't care I just pay them I enjoy their service that's all clear any questions on this we will

[58:36] revisit this when we are on the compute section okay so let's move on to our first topic which this uh authentication and authorization. So

[58:48] from the study guide we will we are covering uh this topic this module design identity and governance and monitoring solutions and there we are covering authentication and authorization. This is the uh these are

[59:04] the topics that we are going to cover. Okay. Okay. And from the learn path

[59:18] covering this one design identity governance and monitor solution. So first three topic will be identity and governance. Monitoring we'll cover once we have done uh covering all the services. So at the end of the uh I mean

[59:32] monitor solutions. Right now we are starting with identity and governance. Okay. Now before I start I need an answer from you. How many of you have worked with uh adds active directory domain services

[59:47] or if you're from the Linux back background uh how many of you know what LDAP server is? What are these two services?

[59:59] And those who are who are freshers, please uh wait. I'll explain what I'm uh what this topic is about. Okay. Okay. So, what is ADDS? Those who have worked So, what is ADDS? Those who have worked with Active Directory, what is this?

[1:00:20] So, what are these services? Adds an LDAP. Okay, never mind. Those who don't know, please pay attention. Okay,

[1:00:35] those who haven't worked with any of these services, you might have uh these services, you might have uh account right in OTD platforms like Netflix or Amazon Prime. Do you hold the account?

[1:00:53] Amazon Prime. Do you hold the account? How many of you have account in Netflix?

[1:01:05] order to access or watch any any web series or a movie, what do you do? First, you go to dubdubdubnet.com, right? If you're using uh laptop, you go to this website. What happens? First thing, what it ask? Does it allow

[1:01:21] directly to watch the movie or there is something to watch the movie or there is something which we need to do? login right so we need to provide our credentials login we need to provide our username

[1:01:33] and password so what happens when we provide username and password Netflix service checks your username and password it checks whether you are providing correct username and password

[1:01:46] if you are providing correct username and password you are allowed if you provide wrong username and password it may deny deny you the entry and you won't be able to access those services. Right? So this process of

[1:02:02] providing username and password and identifying that username and password is known as authentication. That means That means I am not I am Netflix is authenticating

[1:02:17] me checking me whether the credential that I have provided is correct or not. Okay. So, what is authentication? Authentication is a way to to check someone with a certain credential. Apart

[1:02:34] from credential, how you can check someone? You can check them with with their card, smart card. If let's say you work, you go to your office. When you go to your office, there is a door. In that door,

[1:02:48] you have to there's a reader where you have to place your your smart card. Those who are working might know right you have to place your smart card without smart card there's no entry you cannot go in right unless your [snorts]

[1:03:04] company has no security most of the company do have security and they do provide the smart card to their uh employees and in order to enter the building you need to place that smart card. So when you place that smart card,

[1:03:17] the identity service that is deployed within that building checks whether your smart card is valid or not. If it's valid, you can go in. If it's not valid, valid, you can go in. If it's not valid, you cannot go in. Okay. So what runs

[1:03:32] you cannot go in. Okay. So what runs behind uh behind that authentication is this kind of services adds or LDAC. >> They runs behind the services and they checks whether your username or password

[1:03:45] is correct or not. You use your laptop, you use [snorts] your company laptop or provide your username and password correct or not. We need to provide

[1:03:57] nowadays Microsoft has made this made it compulsory to enter your Hotmail address. So once you provide your email address and password then only you can enter your laptop and do whatever changes you

[1:04:10] want. So this part of verifying the user the application or whatever you have whoever needs access

[1:04:23] is known as authentication. Authentication is a is a is a process of verifying a person person is nothing but a user or application to see whether the

[1:04:35] credentials provided are correct or not. Okay. So that authentication is done by the services. Then once you are in once you're inside the building

[1:04:51] which flow you can access which flow you cannot access that path that part is cannot access that path that part is known as authorization.

[1:05:05] when you log into Netflix you have different plans right? you subscribe for different different plans. We have mobile plans, we have standard plan and then we have HD plan, right? I don't know the current plans but this was the

[1:05:18] know the current plans but this was the plans we we had right. So you have uh mobile plan where when you log into Netflix you can only watch Netflix within I mean within your mobile app. Then you have standard plan where you

[1:05:32] Then you have standard plan where you can uh watch in two different screens uh at at the same time and then you have some plan where you can watch in four different screen. So once you log in once Netflix authenticates you once

[1:05:47] you're inside the application that means you have got the access now it totally depends on the plan that you have subscribed to depends on that you're authorized to watch either on mobile or on two screens at a time or on four

[1:06:02] on two screens at a time or on four screens at a time. So that part of application [snorts] and then checking what you are authorized to do, right? So like in cloud world, cloud

[1:06:18] world you are logging into Azure portal. So that login thing is nothing but authentication. And then once you are logged into that application, what you can do? Can you create another user? Are

[1:06:30] [snorts] Can you delete the existing users? Are what you can do, what can what you cannot do is known as the process of

[1:06:42] checking what you can do, what you cannot do is authorization. Okay? Clear? What is authentication? What is authorization? Is that clear? Now this is basic of any identity

[1:06:57] uh any identity and access management system. All right. So, [snorts] authentication and authorization. If you want to implement in your organization, you need some kind of

[1:07:12] identity and access management system. If I want to implement authentication and authorization in my organization, I need some kind of AM service. IM stands

[1:07:24] need some kind of AM service. IM stands for identity and access management. for identity and access management. Okay. So if I want to uh implement that let's say I I'm not using cloud I'm using on-prem network. So in my on-prem

[1:07:37] data center I can either use active directory domain services or if I'm good directory domain services or if I'm good with Linux I'll be using LDAP services. How do you use these services? You need to have a server first

[1:07:54] hardware server or or virtual server whatever if you're using on-prem server on top of that hardware server depends on whether you are using virtualization or directly physical server you'll have

[1:08:07] to have Windows OS if you want to use ADDS or Linux OS if you if you want to ADDS or Linux OS if you if you want to use LDAP okay on top of that on top of Windows operating system you'll be deploying the active directory domain

[1:08:20] deploying the active directory domain services role and then on top of it you will be promoting this server to domain controller where you'll be creating your domain and once it's promoted and your domain is ready then

[1:08:33] you can go ahead and create your users users groups whatever you want you can users groups whatever you want you can add computers and all right [snorts] so this is all all all the stuff you need to do when you're doing onrem that means

[1:08:46] your own data enter everything you need to do. You need to everything you need to do. You need to bring a server. You need to install the or uh install the operating system. Then you need to install the adds role on top

[1:09:00] need to promote it to domain controller. Once everything is done, then only Once everything is done, then only you'll be able to create users and uh groups and uh add computers.

[1:09:14] groups and uh add computers. Okay. Now if you want to use Azure for IM, Azure has Microsoft Entra ID which is

[1:09:26] Azure has Microsoft Entra ID which is nothing but a cloud-based AM service. When we say cloud-based I uh AM service, we don't need to bother about all this stuff. We don't need our own server. We don't need to install Windows operating

[1:09:40] system. We don't need to install ADS on top of it and then promote it to domain. Everything will be handled by Microsoft. What we can do if you're using Microsoft Enra ID, as I mentioned, Microsoft Enra

[1:09:52] Enra ID, as I mentioned, Microsoft Enra ID is a cloudbased AMF tool. You sign up and start using it. Just sign up for Azure service for Azure portal and start creating your users. Don't need to bother about all this stuff.

[1:10:07] scratch, then you you are responsible for everything from scratch. If you want to go for cloud, we have we [snorts] can sign up and we have access to Microsoft enter ID. We can start creating users

[1:10:21] uh directly. Okay, [snorts] is IM clear? It was just basically just giving you an overview of IM. So what is ZTM? ZTM stands for zero trust model. Yeah. Now

[1:10:37] zero trust model is not a service. It's not a policy. It's just a framework uh based on the principle of never trust always verified. [snorts]

[1:10:50] Now if you go back few years like before cloud if you go back 10 years cloud if you go back 10 years how do we used to consider the security? If you go back 10 years, if you go 10 years back, uh at that point in time, we

[1:11:06] had the parimeter network where you used to keep the firewall, uh IDS, IPS, all these devices we used to keep in a parimeter network. Before anyone can get into our network, uh the traffic was verified by these devices. And once the

[1:11:22] traffic considered as safe, then it can go inside our network. then it can access our servers whatever servers we had right so this is how we used to keep not using firewall now we still using firewall but back in the days the

[1:11:39] security related decisions were were were kept in the demilitarized zone in the parimeter zone here but now we need to protect

[1:11:54] we need to protect our identities Since if everything is cloud now uh 90% of the workload is in cloud only the banking the airport the cloud only the banking the airport the airline those mostly are still using

[1:12:08] airline those mostly are still using on-prem but 85 to 90% traffic is already uh in the cloud. Now if someone logs in and if he is authorized to do something and if let's say the login credentials are compromised then we are gone right.

[1:12:24] So with the changing pattern a new model came in which is known as zero trust model. So what zero trust model does it's just a framework which based on this

[1:12:38] principle never trust always verify. You have to always verify whatever request is coming in. Okay. So what are the key principles? We need to implement this zero trust model. And in order to implement this zero

[1:12:52] trust model, you need to have certain IM service in place in your organization. So zero trust model based on this principles like verify the request principles like verify the request first. So every access request whatever

[1:13:07] request is coming in. So if someone is entering your building, you need to verify that you need to verify uh him or her. How do we verify? We use smart card, we use biometrics, whatever. Right? We need to verify that.

[1:13:23] Then second principle we have is least privilege. What what is least privilege? Now in in an organization or in an office building, we have different different areas like we have common areas like

[1:13:37] areas like we have common areas like cafeterias, like gaming zone, right? And then we have some sensitive areas. So in IT we have data center, right? In airport, if you go to airport, we have immigration.

[1:13:51] Then before immigration, we have the check-in area. So check-in area is not sensitive area. Anyone can go there and and and do the check-in. So it's like a and and do the check-in. So it's like a common area. So we need to provide the

[1:14:04] least privilege to the users. Like common areas everyone can go but common areas everyone can go but sensitive areas only authorized person should go. So when we are using smart card based authentication we will divide

[1:14:17] the smart card into different types like everyone will have in uh whoever has the smart card they will have access to the common areas whereas only authorized people will have access to the sensitive areas like data center building itself

[1:14:33] right like [snorts] knock room what is knock room is network operation center where from where you can monitor your your client's network, your own network. So those areas are sensitive. Why? Why?

[1:14:48] Because knock rooms have access to the servers, remote access to the servers. So I cannot allow everyone to go to the knock room. So we need to uh give the lease privilege. That means only people

[1:15:01] belonging to the knock team, they can enter the knock rooms. Lease privilege, right? Micro segmentation. Micro segmentation is like dividing the

[1:15:14] segmentation is like dividing the uh area or the network into smaller uh area or the network into smaller smaller uh VLANs or smaller smaller segments so that we can keep our monitoring uh continuous.

[1:15:29] We need to divide our area into smaller segment. Like here [snorts] we can have certain CCTVs. Here we can have certain CCTVs. Here we can have certain CCTV. So this is my one area. This is another area. This is another area sensitive

[1:15:44] area where I can have multiple CCTVs. Uh this is knock room. So within that room we can have uh three or four different uh CCTVs from different different uh CCTVs from different different angles. Right? So I need to divide my

[1:15:57] angles. Right? So I need to divide my uh let's say network or areas into micro segments. All right. So that I can have a continuous monitoring. So these are few principles that we have

[1:16:13] uh in zero trust model. Now again I'm saying zero trust model is not a saying zero trust model is not a security uh policy or is not a a tool it's just a framework which defines some principles and you need to make sure

[1:16:28] when you're implementing IM or you're designing IM you need to keep these things in mind all right verific

[1:16:43] have a team who can continuously monitor and always assume breach. What do you mean by assume breach? We have to do continuous monitoring

[1:16:55] and we have to assume assume breach and continuous monitoring works hand in hand. Assume breach as in let's say we have applied all the zero trust models it doesn't means we are secure. It's possible that someone who has the access

[1:17:11] has lost the credential has uh the credentials he was he or she has uh the credentials he was he or she was having uh was compromised and some person who should not be having his or her credential has got the credential

[1:17:25] and now roaming freely everywhere. Right? So every time we need to assume breach. Now how do we assume breach? What what is the meaning of this assume assume breach? [snorts] How many of you uses uh Gmail?

[1:17:44] you uses? I'm sure 90% of people are using Gmail, right? So, have you ever tried logging into Gmail from a different device, from a from a totally new device? Back in the days, we used to have cyber cafe, but I don't know if we

[1:17:58] we still have the cyber cafes. But let's say you change your mobile and you log in from from from a new mobile. So what happens when you log into your Gmail account from a new mobile, you get a message, right? You tried uh

[1:18:13] from a different mobile, please uh please uh approve your notification in already existing mobile or your YouTube application or or wherever. Right? So we get that kind of message. So what is that? Gmail is assuming

[1:18:29] that it's not you who's trying to login. So it's not you who's trying to login. So that's why Gmail is uh sending you that popup please notify uh please uh approve please approve. So that's that is the

[1:18:42] please approve. So that's that is the meaning of assume breach. Okay. Even though you have applied all the principles of zero trust model, you need to make sure or you need to assume breach so that

[1:18:59] breach so that wrong person or a hacker cannot get into your account. It's possible that my username is compromised since Gmail we have used or we have given our email id to lot of people. So email ID is already

[1:19:13] compromised. Now what hackers can do they can launch different kind of different kind of attack against the username since username is already uh public right everyone knows my email id obviously not everyone knows but who I

[1:19:27] have shared my email ID with banks with e-commerce applications with Netflix with with different different service providers who knows who's selling my data right so if someone is has sold my data my uh uh email id is already in

[1:19:43] public so hackers can get that get my email ID and try to launch different different kind of attack. So that's why we have to assume reach. If you log into your Gmail from a new location from a new device, you would see that popup.

[1:19:58] new device, you would see that popup. All right. So in order to make sure that [snorts] your data is secured, your access is secured, you need to follow the zero trust model framework. So what does zero trust model says in

[1:20:12] So what does zero trust model says in short? Never trust always verify right even though when you're logging into logging in from new mobile you're providing correct username you're providing correct password still

[1:20:26] providing correct password still Gmail is popping uh popping up to you to Gmail is popping uh popping up to you to approve that that login right even though you have provided correct username password Gmail is thinking that

[1:20:38] it's might be a breach clear so So that's what zero trust model is. Now how to implement zero trust model? You need to have some kind of IM service. So in Azure we have Microsoft Entra ID.

[1:20:53] management? Identity and access management is just a service which helps you to implement authentication and authorization. It al it also gives you a authorization. It al it also gives you a way to manage accounts.

[1:21:08] uh some IM also gives you the way to do the reporting right I want to fetch a report of my users who log in when from where so all those stuff identity and access management gives you in simple what is identity and access management

[1:21:23] what is identity and access management you have an identity that identity is is you have an identity that identity is is some object which requires the access to your resources okay in simple term identity is a is an

[1:21:37] okay in simple term identity is a is an object which requires access to the resources. In basics of cloud computing, we understand we understood what cloud computing is. What is cloud computing?

[1:21:49] I'm again going back to the basics. Cloud computing is a way to deliver cloud uh to deliver the compute services over internet. Why you will be using

[1:22:03] over internet. Why you will be using cloud? To deploy the resources. What those resources are? You need to deploy server. You need to deploy database. You need to deploy storage. So these are your resources.

[1:22:16] Now how are you going to deploy these resources? You are deploying these resources. So you are the object who is deploying these resources. So you are the identity. Whether or whether you can deploy or cannot deploy. We need to

[1:22:29] first identify this guy who wants to deploy. So he needs to go to portal.azio.com. com and our AM service will identify that user will identify that identity will

[1:22:45] identify that object who's trying to coming into our uh system right after not we the identity and access management service will authenticate

[1:22:58] that user whether the username and password provides provided are correct or not okay Then the authorization kicks in. Once you are inside the cloud, what

[1:23:11] you can do? Can you deploy server? Can you deploy database? Can you deploy storage? Can you do that? Authorization. Account management. You want to create few new users. You can do that using any

[1:23:26] IM service. Whatever MMC services you have to access control what a user can do cannot do you can define that using access control. Okay. And then auditing

[1:23:38] and reporting any IM service uh most of the IM service gives you the auditing and reporting thing. So what is IM? Is that clear? Now in Azure we have Microsoft Enra ID. So, Microsoft

[1:23:54] Entra ID is the service uh which is a cloud-based identity service. [snorts] So, as I mentioned earlier, you don't need to deploy a server or anything. You just sign up for uh Azure and you have your Microsoft

[1:24:08] Entra ID. We don't need to do anything. We just need to sign up for Azure. That Azure. And once you have created your account, you already have Microsoft Entra. So it's a cloud sorry it's a cloud-based identity and access

[1:24:23] management solution. All right. So it gives you centralized centralized identity management. If you have a single Microsoft entra tenant you can simply use that tenant and start creating your users. Right? If someone

[1:24:37] is already using active directory domain services they have an option to synchronize their users with Microsoft enter ID. So, Microsoft enter ID previously known as Azure Active Directory it was launched in

[1:24:53] Directory it was launched in 2013 or 15 I'm not sure on the exact year but during that time it was launched before that Microsoft had this service active directory domain services which uh the short form for that is adds

[1:25:09] which uh the short form for that is adds which people were using on prem cloud which people were using on prem cloud started gaining pro uh popularity after 2010 or 2011. I think 2006 or 7 AWS got launched and

[1:25:23] I think 2006 or 7 AWS got launched and 101 Microsoft came in and by 15 it was 101 Microsoft came in and by 15 it was all popular 1516. Okay. So before that when cloud was not there people were already using ads for their on-prem

[1:25:35] identity and access management services. So those those organization who are already having ADDS and they want to use Microsoft Enra ID then which identity and access management service will do the

[1:25:50] authentication will do the authorization will do the verification. So you have adds you have Microsoft enter ID both are IM service which will

[1:26:02] enter ID both are IM service which will do the authentication which will uh if you are resetting password which will be considered as as the uh having the highest control. So all those question were arises arised if you use two

[1:26:16] different identity and access management services. So what Microsoft did Microsoft created Microsoft Entra connect. So it's a tool which you can install on your on-prem server and using that you can synchronize your on-prem

[1:26:32] that you can synchronize your on-prem users to Microsoft Entra ID. Okay. So if I have hundreds of users on prem and if I use Microsoft Entra connect all hundreds of user will be synchronized to Microsoft Entra ID.

[1:26:48] Okay. So whatever user you have over here, all users will be synchronized. Instead of recreating user in Microsoft Endra ID, you use this tool and

[1:27:01] synchronize your users. That's all. All right. So [clears throat] that option Microsoft uh gave to the people who are already using Microsoft uh active directory domain services. Microsoft created a tool. You deploy that tool on

[1:27:17] a server and you start synchronizing your user. If you create a new user, that new user will also get synchronized. All right. So, Microsoft Enra ID in short is a

[1:27:30] cloud-based identity and access management solution that you can use once you sign up to the Azure. It's free of cost. Obviously, there are different plans and pricing, but uh when you start, it's free of cost. Okay. So how

[1:27:45] start, it's free of cost. Okay. So how to see Microsoft enter ID in action. to see Microsoft enter ID in action. If I go to uh Azure portal. All right. [snorts] Now in Azure portal before I show you the Microsoft Tendra ID let me

[1:27:59] show you the Microsoft Tendra ID let me just explain or give you the tour of Azure portal. Okay. So I'll do it from scratch. Let me Okay. So I'll do it from scratch. Let me sign out.

[1:28:21] thing that you need to do whenever you want to interact with Azure platform, want to interact with Azure platform, you need to go to portal.azure.com. So this is the uh link where you should be going when you want to log into Azure

[1:28:35] or when you want to interact with Azure portal. when I click on uh when I press enter first thing that Microsoft Azure portal or Microsoft is doing is what

[1:28:48] portal or Microsoft is doing is what it's asking what is this process I went to portal.azzio.com azio.com and it directed me to this what it is doing right now authentication. Okay, it is asking me to prove my

[1:29:04] Okay, it is asking me to prove my identity. So this step that we are going that we are doing right now is authentication. All right. So authentication is the process of

[1:29:18] verifying and identifying the identities. This is my username. How do we usually authenticate? We ask for the username. So my username is already selected here. Already mentioned here. If it's not

[1:29:31] mentioned, I can simply provide my email ID. Whatever my email ID is, right? This providing that. I click on next. It will ask me for the password. I provide the password. I click on sign in. Okay. Once

[1:29:45] username and password are correct, I'll be inside. So I'll I'm in my application. All right. Now this is Azure portal. Now

[1:29:57] those who do not have access to Azure portal, what you can do is either if you want to use your own account uh unrestricted account, you can sign up

[1:30:09] for free tier. You search for Azure feed free tier and You search for Azure feed free tier and you will see uh the Microsoft Azure page

[1:30:26] Azure free tier. [snorts] Go to the first link that Microsoft is providing and there you'll be having a button which says get started with Azure. Click on it.

[1:30:41] Once you go, once you click on it, you can click on try Azure for free. Once you click on try Azure for free, it will ask your email ID and your password. Right? So, you need to provide your uh Microsoft email id. If you do not have

[1:30:56] one, you can create one from here. So, whatever email ID you have, you provide that. Now, in my case, I have already utilized. So, if I enter my email address, uh it will trigger it will say that I'm

[1:31:09] not eligible. Why? because I've already used it. Okay. So, I've already used it. So, it will say I'm not eligible. So, uh in order to

[1:31:23] say I'm not eligible. So, uh in order to utilize Microsoft Entra ID, sorry, utilize Microsoft Entra ID, sorry, in order to use Azure free tier, you need to have a unique email address that you have not used before, [snorts]

[1:31:38] you have not used before, [snorts] right?

[1:31:53] email address that you have not used before. Right. So [snorts] here it says I'm not eligible. Why? Because I've already utilized it. So I can sign up

[1:32:05] for a pay as you go go pricing. I cannot sign up for a free tier. What I'll do? I'll see if I have any other email address. But I'm not signing up since apart from email address, you also need a unique credit card. Right? So I don't

[1:32:21] have a credit card. I've already utilized all my credit card. So if I have any other email address, I can use that. So let me see. [snorts]

[1:33:39] able to demonstrate how you can come up with the but it it's very basic. You just provide your email address. Once you provide the email address, you can then uh provide your details like your mobile number that should also be

[1:33:51] unique, your email address that should also be the one that you have never used before and the credit card which you have never used before. So Microsoft Azure has this restriction where [snorts] you cannot use the same email

[1:34:04] [snorts] you cannot use the same email twice to avail the free services. So you need to use new email every time but with new email you need to have a new credit card as well as you need to have a u a different mobile number that you

[1:34:17] have never used before. All right AWS I think doesn't have that issue. With AWS you just need a new email address. You can use the same credit card again. [snorts] Okay. So that's how you can sign up for

[1:34:32] a free tier from here. Once you have the free tier um free tier um you can then sign into portal.azio.com. So once you get your free tier you can then sign in by going to portal.azio.com

[1:34:46] providing your email address that you use to sign up and your password. That's all. All right. Now let me introduce you or give you a tour to Azure portal. So the first thing that you see on left hand side here

[1:34:59] uh where where you see nine dots. So this nine dots is a cloud menu. Okay. What what what do what what is the cloud menu? This is a newly uh uh new feature menu? This is a newly uh uh new feature or or or new option that Microsoft has

[1:35:13] added where you can launch different Microsoft portal directly from here. So I click on GitHub, it will take me to the GitHub. I want to work with Intune. I click on Intune, it will take me to the Inune. Right? So different different

[1:35:27] portals. shortcut to that portal Microsoft has just added here doesn't uh it is helpful when you want to switch between different u

[1:35:40] different portals if you want to uh go to GitHub from here click on this shortcut and go to that right after the cloud menu the second

[1:35:52] thing that you that you see with the three lines uh is known as [snorts] uh portal menu. So if I click on it, you'll see the menu over here from where you'll see the menu over here from where you can go to you create any resource.

[1:36:07] Uh some shortcuts are given, right? Go to homepage, go to dashboard page, uh go to Microsoft enter ID, go to monitor services, right? So shortcuts are given. want. I want to work with virtual

[1:36:20] machine. I click on this portal menu. I launch the virtual machine and I go to the virtual machine page. Right? Similarly, any service that that we want to use, we we go there and we can use it. Okay. [snorts]

[1:36:33] Next, after that, you have this Microsoft Azure mentioned there. It's it, you'll be landed to the homepage. Whatever page you have selected, you'll be landed to there. All right? So, it's just a shortcut to go to the to the

[1:36:47] homepage or to the dashboard whichever you have selected. Then, if you go right hand side, you have the search bar. So if I want to, we will be using this search bar every time we want to work with any service. So this search bar

[1:37:02] will help me to search for different resources. Like if I just type virtual, it will list out all the services which has uh virtual in it. Like I want to work with virtual machine. I search for virtual. Virtual machine is there. I

[1:37:15] landed to the virtual machine page. From here I can create virtual machine. I can stop existing virtual machine if I want. start, restart, whatever. Right? Similarly, if I search for database, so anything related with with

[1:37:30] this particular keyword will be uh placed over here, right? Database watcher, SAP solution, whatever. I search for SQL, all the SQL related services will be provided. Right? So, this is just the search bar,

[1:37:44] a shortcut you can say to search and go to any service that you want. Then if you go on again on right hand side you have copilot. What is copilot guys?

[1:37:56] So copilot is a gen AI tool from Microsoft right. So if I click on co c co c co-pilot within the browser itself I will get a way to chat with the

[1:38:08] I will get a way to chat with the co-pilot. So if I have any issue like I co-pilot. So if I have any issue like I want uh copilot to answer any of this any of the question like I just uh added hi it it gave me the response right I

[1:38:23] hi it it gave me the response right I want copilot to create an ARM template want copilot to create an ARM template for me

[1:38:37] me a give me a response depending on my prompt. So the better the prompt is the better the response will be right. So it is now generating the template. I can use that template then right apart from that it also has few

[1:38:50] boards kind of question already created. So if you click on it that will be the prompt for for your copilot. So copilot option is is given there. If you want to utilize it for anything you can

[1:39:05] want to utilize it for anything you can utilize. So uh nowadays Gen AI is quite utilize. So uh nowadays Gen AI is quite smart. Okay. So if you see this, it has created a template for me. I can now use this template. If I don't know how to

[1:39:17] deploy the template, I can again ask the copilot how do I deploy this template? copilot how do I deploy this template? It can help me. Right? So, anything I I It can help me. Right? So, anything I I need

[1:39:34] on your prompt, how good your prompt is, it will give you the answer. Now, obviously, I'm not saying that it's it's perfect. It can make uh mistakes, right? perfect. It can make uh mistakes, right? So whatever you're using uh use it

[1:39:51] uh try it and then if it's wrong ask it ask the copilot or the chat GPT again ask the copilot or the chat GPT again right so you see how how to deploy this it has given you the the the steps right so nowadays it has become very easy to

[1:40:06] do the hands-on by use by using chat GPT or copilot or whichever genai tool you prefer [snorts] right so it's just a a simple way instead of launching copilot

[1:40:18] in a different tab Microsoft has given you that uh option within the portal itself then after copilot the next option or then after copilot the next option or the next icon that we have is the cloud

[1:40:31] shell so what is cloud shell so if I click on the cloud shell it will launch click on the cloud shell it will launch the command line interface within the portal itself so within the graphical portal azio.com I have the

[1:40:47] option to launch the cloud shell directly. So what is this cloud shell? It will allow me to interact with the Azure platform using the commands. So if I want to interact with Azure virtual machine I need to use certain command.

[1:41:01] machine I need to use certain command. What that command is uh you need to uh rely on Microsoft documentation to get the command or you can take help as well. Right? So type help to learn more. type a to use Azure CLI right a VM stop

[1:41:17] and then the VM name and all if I give it will simply stop that VM so these are the required field if I want to stop any a VM it's just a way to interact with the Azure portal or Azure platform we can

[1:41:32] say using command line so you can use either the bash shell the Linux shell or if you're more comfortable with Power p PowerShell you can switch to PowerShell

[1:41:45] as well. Okay. So now if you see I have clicked on switch to PowerShell this button. Right now it's showing us switch to bash but when you are in bash it will show switch to PowerShell. So I clicked on that and now I am in PowerShell. So I

[1:42:00] can run the PowerShell commands now to interact with your portal. All right. Now if you want to restart the terminal I mean the cloud terminal you can click on restart and it will give you a new uh terminal right as as

[1:42:15] soon as I clicked on restart it is now requesting a new cloud shell. requesting a new cloud shell. All right then the next option that you have is manage files. So you can upload or download files

[1:42:30] uh to cloud shell. So if I want to work with file I can simply click on manage file upload and if I want to upload any local file I can upload it like for example template.json I want to upload it it's uploaded right where it is

[1:42:45] uploaded to this path. So if I do ls now here which is list you see template.gs

[1:42:57] to upload or download. Now new session will simply give you a new PowerShell a new portal and then within that portal you'll get new cloud shell session. Okay. So that's the option as well. Now after that we have a very basic visual

[1:43:14] studio editor. So if I click on editor a visual studio will open. It's a very basic visual studio editor. Okay. It's a file editor. So if I want to edit my files from here I can do that. I don't need to switch between

[1:43:29] the desktop and the and the portal. I can simply if I if I have obviously it's not featurerich. It's a very basic cloud shell that uh sorry file editor that you have. If you want to make any changes you can do from here right. So if you

[1:43:45] want to close you go over here and you can close it. You have the web preview as well. So for web preview uh if you let's say have deployed any basic application here and you want to see how it will look like

[1:44:01] when someone launch it from from from browser how it will look like you can simply use the web preview from here. Okay. Then the settings like you just Okay. Then the settings like you just want to change text size font or uh

[1:44:16] theme you you want dark theme light theme. So all those things you can change from settings. Then there's help like I want to see all the PowerShell command, all the all the CLI command. So I click on that. It will take me to the

[1:44:30] Microsoft documentation and here I see all the CLI related command. Okay, I want to work with uh virtual machine. So I search for VM and it should give me I search for VM and it should give me the the VM related command. So this is

[1:44:46] you scroll down you'll see all the command that that are that you can use for for VM. Okay.

[1:45:01] cloud shell we have a very simple notification uh tab. So what this notification uh tab. So what this notification tab does uh let's say I'm I'm working with or I'm deploying anything.

[1:45:13] So I'm deploying uh I'm creating a resource group. Don't ask me what resource group is. I'll I'll cover that in detail when we are on that topic. But I'm just explaining the notification tab right now. Okay. So if I search for

[1:45:26] resource group [snorts] and I create a new resource group or I delete an existing one. So a notification will trigger like for example RG02 central India. Click on review create and click on create. So once the

[1:45:42] creation is completed you see resource group created a notification will be triggered. So if I delete the same resource group another notification should trigger which says resource group deleted.

[1:46:11] come in like right now it's deleting resource group once the deletion is completed it will trigger delete. So whatever you are doing uh and if you want to monitor that you can come over here and you can see that all the events

[1:46:24] that whatever you have in you have the option to dismiss as well also no notification you cannot see the history there's no way to see the history okay

[1:46:36] then you have uh settings uh for the portal itself if you want to if you if you are part of multiple Microsoft entra ID over here. If you want to switch between any of the Microsoft Enra ID, you can

[1:46:52] switch from here. Right now, I'm only part of one. If you're part of multiple, multiple directories. I can show you that in my another account. So, if I go to another account and click on

[1:47:04] settings, you see I'm part of two different uh tenants, two different Microsoft Enter IDs. So, if I want to switch between any of the Microsoft Enter ID, I can do that. How I can do that? I click on settings.

[1:47:19] Settings will land me to this page and I can click on switch. It will be switched can click on switch. It will be switched to a new um the other directory. Right? So that you can do from settings. Apart from that you can you can uh change the

[1:47:33] appearance like I want a dark theme. So a dark theme will be applied over here. I want a light theme. Light theme will be applied. So it's just a normal language and region like you want English or any other language. Uh your

[1:47:46] information like your email id and all if you want to uh get a notification right uh sign out and notification uh if you're not doing anything and if it's idle do you want to sign out when when inactive after 15 minutes if you're not

[1:48:00] doing anything for 15 minutes or it will automatically sign out. All right. So all those stuff you can do from the settings tab from the settings option. Then you have support and troubleshooting. So if you have any

[1:48:14] issue with Microsoft Azure portal, you can search for it. If they have the documentation, you will see the documentation over here. Or from here also you can raise the ticket as well. So let's say my subscription is not

[1:48:29] allowing me to deploy any resource. I can raise a ticket and I can ask Microsoft as your team why it's not allowing me to deploy the resource. So they will come up with an answer like maybe your subscription is not eligible

[1:48:41] maybe your subscription is not eligible or you don't have the kota kota whatever right. So you just uh can raise a ticket from here. Now remember this thing where raise from support and troubleshooting option or you can raise it from uh your

[1:48:57] subscription itself. All right. Now why I'm asking you to remember this because in interview if you are fresher uh the interviewer might ask how to raise a support ticket to Microsoft Azure team. Okay then if you

[1:49:13] want to provide any feedback to Azure team you can provide like I'm liking it you're not liking it what you're not liking. So this feedback will will go to liking. So this feedback will will go to Microsoft team. Okay. Then the last

[1:49:27] option that you have within the portal itself is your username. So this is your username. Uh you can switch directory or switch Microsoft enter ID from here as well. Can view your Microsoft account from here as well. All right. So just to

[1:49:42] summarize, you have the shortcut to go to uh uh uh go to any other portal outside Azure. You have the option within Azure. If you want to launch any service, there's a shortcut. If you want to go to homepage from any

[1:49:58] other uh page like for example, I'm here in the network page. I want to go back Azure here. It will take me to the homepage. Then you have the search bar shortcut to reach any service. For example, I want to go to health page. I

[1:50:11] want to see the health. If I have access, I will be able to see it. Right? So, whatever shortcut uh to the services, you search for it and you go to that service. Then you have copilot. You have cloud shell which is like a

[1:50:23] You have cloud shell which is like a like a uh an option to interact with azure platform using command line. You have notifications. You have settings your appearance your language and all you can

[1:50:37] select in the settings or you can change in the setting. You have uh support and tickets related to Azure portal itself. Then you have feedback and then you have your user ting right the user that you have logged in from right it's just a

[1:50:54] have logged in from right it's just a short tour to Azure portal how which short tour to Azure portal how which will help you to navigate from u uh will help you to navigate from u uh within the Azure portal itself right

[1:51:06] all right so now where do I see the Microsoft enter ID question for you guys I want to go to Microsoft entra ID page how to

[1:51:22] Right, we have the search option. We can search for Microsoft enter ID from here and go to Microsoft enter ID or you have the portal menu here. From here you can simply uh click on Microsoft enter ID and you can go

[1:51:37] once you sign up for Azure you have to do nothing. You'll get Microsoft Entra ID for free. You don't have to pay anything. Okay. [snorts]

[1:51:52] identity and access management system which is free of cost. If you see here license, I have got the free license. So you have

[1:52:04] I have got the free license. So you have the Microsoft Entra ID free of cost. uh obviously with free of cost you'll have less features. There are different licenses available for Microsoft enter ID. If you're going for free there is

[1:52:17] certain limitation like I think you can create uh half a million records only that that means half a million objects only. If you want more if you want to go above that you need to go for Microsoft Entra ID premium.

[1:52:33] Entra ID premium. So if I search for Microsoft Entra ID

[1:52:47] this is the page where Microsoft has mentioned uh different features available in different plans. So there are like three or four plans. So if you see we have premium P1, we have P2 and then Microsoft Entra suite. So these are

[1:53:00] the three different plan. By default it's free. you don't have to pay anything. But if you want to use certain premium plans, then you need to go for P1 or P2 or suite depending on what features you want. Now, if I scroll down

[1:53:15] here, you see if you want Microsoft Enra ID protection, it's available here in P2 or Microsoft Enra ID suite. It's not available in free tier. All right. So

[1:53:29] whatever is checked over here is available on the on on that particular available on the on on that particular plan not on free. Okay. So here are the plan not on free. Okay. So here are the limitation that you see with free tier.

[1:53:43] [snorts] Uh it supports multiffactor authentication. It supports the single sign on. It supports the basic reporting. You can manage users and groups. Uh it also

[1:53:57] reset. It can also allow you to sync your on-prem directory users with Microsoft enter ID. So this can be done. But if I want let's say verified ID, it's not mentioned here. I won't be able to use

[1:54:14] that. If I want to use identity protection, it's not mentioned there. I cannot use it with the free TM. Okay. So all these are premium uh plans. All these are premium features. So if you want to use those

[1:54:28] features, you need to sign up for a premium team. All right. [snorts] So in order to interact with Microsoft Enra ID, I can search for Microsoft Enra

[1:54:40] ID and it landed to that page here. what what license I have whether here. what what license I have whether it's a it's a free license or a uh premium license will be mentioned under under your overview page uh within the

[1:54:54] license section. Okay. So that's what Microsoft Endra ID Okay. So that's what Microsoft Endra ID is. Now Microsoft Enra ID comes with two is. Now Microsoft Enra ID comes with two different flavors B2B and B2C. Now since

[1:55:08] it's 10:40 already I have only 20 minutes so I'll cover B2B. I'll explain B2B and then we will stop for the question and answers. question and answers. Okay. So what is Microsoft Entra ID B2B?

[1:55:23] Okay. So what is Microsoft Entra ID B2B? B2B stands for business to business. what does it mean business to business? Uh you have your Microsoft Entra ID. So

[1:55:36] once you sign up for Azure, you'll get Microsoft enter ID and you have a Microsoft enter ID and you have a partner company who will be developing certain products or certain softwares for you. So you have your own entra ID.

[1:55:50] So this is your entra ID and you have your partner company who will be developing certain products for you. Now when you're developing certain when they are developing certain products

[1:56:05] When I'm saying products I mean websites. So when they are developing that website for you you want to host you want them to host that website on your resources. So they will have their their developer

[1:56:20] here. Now tell me this developer Now tell me this developer who belongs to the partner company the user account for their developer will reside where in our entra ID or

[1:56:36] their entra ID when you join a company let's say you join XYZ company so that XYZ company has its own IM service and there's another company ABC company they have their own

[1:56:49] IM service so when you are joining XYZ company your account will be created in company your account will be created in XYZ or ABC

[1:57:02] so my account should be created in XYZ when I'm signing up for Netflix my account will be created in Netflix it's not going to be created in prime video right so similarly these three developers who are

[1:57:16] uh employees of partner company their created in the partner company's entra and this is my entra our entra ID now if

[1:57:33] and this is my entra our entra ID now if these guys wants access to my resources I have a virtual machine here I have storage here I have a database here they want to develop an application for me a product for me a website for me and they

[1:57:48] need access to my resources So with zero trust model how are you going to provide the access? How can you access or let's say you want

[1:58:01] to log into your enter ID and you want to access what happens first? What is trigger? First thing if I want to provide them the access what I need let me explain it from the portal. Okay. So if I go to the

[1:58:17] portal, this is my entra ID with the name as your training. So this is my entra ID. Okay. If I go to the manage section here, in the manage section, you see users. So if I click on users here, I'll see all the users which are part of

[1:58:32] I'll see all the users which are part of my tenant, which are part of my entra ID. These are all the users who are part of my entra ID. Okay. So this is Azure training which is my entra id and these

[1:58:46] are the users who are part of it. I have another entra ID of my friend let's say my partner and they're good in development. So I want them to develop a

[1:58:58] re or develop a software for me but I want them to host that software in my resources in my virtual machines. the virtual machine that we have now in order to provide them the access they have their account

[1:59:12] in partner entra ID they don't have account partner entra ID they don't have account here so what I need to do first what I need to ask what I can do one way is to create their

[1:59:26] account so what I'll do let's say this is user one this is user two this is user three so I'll come over here you see new user I click on new user I create account user 01, user 02, user 03. So I can create an account for them.

[1:59:39] That's the one way. But now think from user point of view. Think from the user point of view. If I create additional account for them,

[1:59:51] what is going to happen? The user needs to remember two different set of credentials. they need to remember these credentials which they they are going to use to access my resources plus they they need

[2:00:09] to uh remember the credentials for their own enter ID as well. Now tell me as a security team member or as an IM solution or IM team member is

[2:00:24] it good to ask your employees or your users to remember more than one set of credential. Is it a good idea?

[2:00:40] forget password. They can forget password. They can forget user ID. Since I might be using a different kind of user ID like if you see here I have different kind of user ID. Some company uses first name, last

[2:00:54] name at the rate their company domain. some uses first name and then surname so different different companies have different different ways of coming up with the user ID right so I don't want them to to remember two set of

[2:01:09] credentials what I can do I can use B2B this is my business this is their business so I'll use B2B here what is B2B business to business Microsoft entra ID business to business I can invite their user

[2:01:25] to join join my tenant. I can invite their user. If you click on I can invite their user. If you click on new user here, we have two options. Create new user and invite external user. So this invitation or inviting an

[2:01:43] external user will create an account here in my tenant. They don't need to remember two set of credentials. They can use the same email ID that they are using, same user ID that they are using in their own tenant. They can use that

[2:01:59] and once they use that they can log into my tenant. How I uh well when I'm I'm I was giving you the the tour I demonstrated this

[2:02:12] directories. Directories are nothing but the entra ID. You have your one directory here. Apart from that you can have another directory as well. So once I invite them they will have the option to switch between the directories.

[2:02:32] Okay. So what is B2B? B2B is a way or sorry external identities external object external users to your own tenant

[2:02:48] to your own directory. Okay. So why we have B2B here to make things easier for the external employees.

[2:03:00] I don't want them to remember different set of password. They can use the same password and they can log in uh to multiple tenants. Now it's possible that the partner company is developing software for different different clients

[2:03:14] software for different different clients like TCS. TCS develop what is TCS? TCS is a consultancy consultancy firm, right? So they develop software for multiple partners. Now imagine you are asking your developer to remember

[2:03:27] asking your developer to remember password for all the tenants. is going to first of all forget all forget most of the passwords right so to make it easier Microsoft came up

[2:03:40] so to make it easier Microsoft came up with this B2B business to business now work we don't have to bother about it why because we are using this as a service what what Microsoft is doing

[2:03:52] behind the scenes is not something we need to bother okay but yeah if you want to come up with your own B2B be you don't want to use Microsoft Enra ID you're you're using onrem services you have active directory domain services

[2:04:08] you need to create something known as federation server so it works in the federation server so it works in the same way but uh lot of work is involved same way but uh lot of work is involved Microsoft has made it quite simple uh

[2:04:22] Microsoft has made it quite simple uh when it come to Microsoft entra ID B2B we just need to click on new user invite external user uh provide proper email address whatever the email address is and once the user

[2:04:37] accepts he or she will become part of my ten all right guys so that's all about B2B now there are a lot of topics that we need to cover obviously we cannot cover today so

[2:04:50] we will cover it tomorrow now what these topics are just to give you an overview uh apart from B2B we have another type of uh tenant in Microsoft oftent ID which is B2C. I'll explain what B2C is tomorrow. Then we have few premium

[2:05:05] features like conditional access, identity protection, access reviews. So these are the these are the premium features. If I go to the Microsoft Entra plans and and pricing uh if you see conditional access is a premium feature.

[2:05:19] It's not available with free tier. So in order to use conditional access you need order to use conditional access you need to have premium at least premium P1. Okay. Then there is identity protection. So identity protection is also part of

[2:05:34] uh premium tier. Then access whatever we are discussing tomorrow uh is is uh falls under the premium features. In order to use that you need to have premium in place. Then then we will discuss identities for

[2:05:49] service principles. And then we will discuss as your keyword. So for the first half tomorrow we will able to complete our Microsoft complete our Microsoft uh entra ID and then we will discuss the

[2:06:02] case study. Okay. So make sure you're re-watching second half of today uh before you are coming for the tomorrow's class so that you know the basics of

[2:06:14] identity and access management uh what is entra ID what is B2B. All right. All right. So what we have covered so far uh basics of cloud computing we have covered yesterday where we understood what cloud

[2:06:29] computing is why do we need it in simple cloud computing is just the delivery of compute services what are those compute services those compute services are services those compute services are servers like you can get CPU RAM storage

[2:06:42] all those stuff apart from that you can get network you can get databases you can get uh different managed services so all of the services you get as a service from cloud from cloud provider. So we see we saw that in the first half. In

[2:06:56] second half we jumped to Microsoft Enra ID where we understood ID where we understood what AM is. Why do we need AM? IM stands what AM is. Why do we need AM? IM stands for identity and access management where

[2:07:09] if you want to manage your objects your your ids your identities. Identities are nothing but the users or the groups who requires access to your resources. So if you want to manage them you have AM which stands for identity and access

[2:07:24] management. Before seeing identity and access management we covered the uh uh module the framework which defines how your identity and access management should be. ZTM stands for zero trust model. So it's just a framework which

[2:07:38] model. So it's just a framework which defines how you can secure your AM defines how you can secure your AM solutions. Then we saw if we want to do uh if we want to implement identity and access management on cloud on Azure

[2:07:50] specifically what service we have we have Microsoft entra ID so what is Microsoft enter ID is just a cloud-based identity and access management service you can call it as identity as a service you don't need to deploy your server you

[2:08:03] you don't need to deploy your server you don't need to deploy the uh adds on top of your server you don't need to deploy promote it to the domain controller everything is done for you everything is managed for you. Okay. So everything is

[2:08:15] managed and you're getting that as a service. Then Microsoft Endra ID comes with two different uh flavors B2B and B2C. We have covered what B2B is. B2B stands for businessto business. So if if I have a company, this is my Microsoft

[2:08:30] I have a company, this is my Microsoft Endra ID tenant and I want to invite or or provide access to a partner company or let's say I have company A, B, C and XYZ. So these are the two companies I have. XYZ is my company whereas I uh

[2:08:47] have. XYZ is my company whereas I uh bought or uh I I bought ABC's business. So ABC is also my company. Now I want to provide all the users access to my tenant. So I can use B2B here as well. This is another scenario where I can use

[2:09:02] B2B. All right. The next thing that we are going to discuss today is B2C. So let's go to the next topic which is Azure ADB B2C. B2C stands for business to consumer. All right. Before doing B2C, let's just uh

[2:09:17] see the invitation one that we covered yesterday. Like if I want to invite any uh user who's not from my tenant and I want to invite a user who belongs to another company. Doesn't matter if that company is using uh Microsoft Enra ID or

[2:09:34] any other identity platform. The required thing is they should have their users should have a valid email address. That's all. If they have the valid email address, we can invite them. All right. So, how to invite? If I go to Microsoft

[2:09:49] Enra ID from the start menu, from the portal menu, if I click on Microsoft Endra ID, I'll be landed to this page. This is the homepage of Microsoft Enra ID. From here under manage section, I can see users group. So if I want to

[2:10:02] manage users, create users, delete users, modify users, I have to go under the manage section. So within that manage manage section, we have users and groups. All right. So if I click on users here, I'll see I I'll get a list

[2:10:17] of all the users that are already part of my tenant. of my tenant. Okay. Now, this is the user Okay. Now, this is the user who is an external user. this one if you

[2:10:29] see this user root cloud easy this is an external user now you consider the same scenario which I which we discussed yesterday that we can invite any user who belongs to any company doesn't matter whether they

[2:10:44] are using entra ID or they are using Google workspace or they are using AWS uh IM services we can invite anyone as long as they have a valid email okay so

[2:10:56] to see that in action. What I'll do, I'll simply delete this user. whenever you delete a user from Microsoft Endra ID, the user is there

[2:11:09] for for 30 days. It's not getting deleted uh permanently. So, you have to delete that permanently if uh if you know that you don't need that user account. Okay. In our case, right now, this is just uh a a tenant, a test

[2:11:26] tenant. It's not a production tenant. So I deleted that user. Right now I go back to all users and in order to invite any user I click on new user. Here under the users section we have all users. There we have new user. So I click on new

[2:11:41] user. I click on create new user. If I want to create a user uh within my want to create a user uh within my tenant within my Microsoft tendra ID. If I want to any external user from any other organization I select this option.

[2:11:56] All right. So I click on invite external users. I just provide the email address.

[2:12:08] providing that email address. Doesn't matter whether it's your company uh whether they are using Microsoft enter ID, Google Workspace or it's a normal ID, Google Workspace or it's a normal email ID. We can invite them. All right.

[2:12:20] create. That's all. Your user will be invited. So you see here notification user invitation in progress. So a mail will be sent to user from your Microsoft Enterra ID. Now if you see here uh in some time if you refresh you should see

[2:12:36] some time if you refresh you should see that user. is here. Now how to verify whether this user is part of your tenant or uh

[2:12:52] external tenant? How to verify that? So if you see this user type here, you have different types of users. This is important to understand. Member user that means your own your tenants user. This fabric admin is a member user. This

[2:13:07] is my tenants user. You see this one this is a guest user that means uh this this is a guest user that means uh this is an outside user whom you have invited to your tenant. All right. Similarly root cloud easy. This is a guest user,

[2:13:23] outside user who you have invited to your tenant. All right. So remember there are three types of users. These questions often lands in the uh exam. questions often lands in the uh exam. You have member user, you have guest

[2:13:38] You have member user, you have guest user and you have uh ad sync user. of users you can see when you are user, your own user, your company's user, your tenants user, guest user,

[2:13:54] user, your tenants user, guest user, outside user, uh adsync user, if you and you are synchronizing that with Microsoft tendra ID, the users who have been synchronized will be the type of that user will be ad sync user.

[2:14:10] All right. Clear. Then uh inviting a user is one Clear. Then uh inviting a user is one step. The user who have you have whom you have invited should accept the invitation. If he or she is not

[2:14:25] accepting the invitation, he or she won't be able to use the temp. Right? So what I do right now, I go to Gmail. I log into my account.

[2:14:44] Microsoft invitation. So similarly that user will also receive the invitation and he or she needs to accept that. So if I click on it, I need to accept it. So in order to accept what I'll do, I'll go to the in private window. I'll copy

[2:14:58] go to the in private window. I'll copy the uh link and I'll open it in in private window. Now why I'm doing this in in private so Now why I'm doing this in in private so that uh in in the in this session I've

[2:15:11] already logged in with the simply learn user. Okay. So I don't want to use the same session. So that's why I have triggered or open the in private window. All right. So it it's saying it will send me a a code to my email in order to

[2:15:27] can click on send code and I'll receive the code in my Gmail account.

[2:15:39] multiffactor authentication. It's like a confirmation that the person who's trying to login is the same person. So 583 439. So I just go there and enter it 583 439. So I just go there and enter it 583

[2:16:02] Okay that's all. Now I will be logged in to uh

[2:16:21] azure.com from here and just to confirm I have logged into the same tenant uh from from where I was invited to confirm that how how you can

[2:16:33] confirm you can go to Microsoft Enra ID now one more thing you need to remember whenever um a new user account that's been created or new user who has been invited to your tenant has to complete the

[2:16:46] multiffactor authentication so before I I give some information. Let's understand what multiffactor authentication is. How many of you already know what multiffactor authentication is?

[2:17:05] What is multiffactor authentication? Multiffactor authentication is like an additional form of authentication. Okay, I hope you know uh what authentication is, right? You know what authentication is. Authentication is a process of

[2:17:19] verifying the identities, right? So how do you uh verify the identities? You that's what we provided here. Username and password already provided. But it's possible that username and password are compromised. So in order to avoid

[2:17:35] uh allowing access to an unauthorized user, what do we do? We add an additional form of authentication, two form authentication or multiffactor authentication. One extra form of authentication

[2:17:49] username and password you have to provide. Apart from that prove your provide. Apart from that prove your identity by entering the OTP or approving the authentication in the authenticator app

[2:18:04] or if you have a gate or something where you have the fingerprint reader you can ask them to provide the biometric authentication as well. All right. So multiffactor authentication MFA stands for

[2:18:17] multiffactor authentication. From October 2024, Microsoft has made this mandatory. So you don't have to do nothing. I mean you don't have to enable multiffactor authentication. It's by default enabled for all the users within

[2:18:30] your tenant. Before October 2024, we had to enable multiffactor authentication from each and for each and every user. after October 2024, it has been made mandatory for all the users. Okay. So,

[2:18:45] whenever user logs in, Microsoft's collects some extra information from collects some extra information from that user. Most probably it would be uh authenticator or any other authenticator

[2:18:58] app that you that you want to use. All right. So, whenever I create a new user, I need to do this setup every time whenever I'm uh logging in from a new user. So I click on next.

[2:19:35] information that I need to install Microsoft authenticator. It's not mandatory that you need to use Microsoft authenticator. You can use another authenticator app as well. There are lot of authenticator apps available in the

[2:19:47] of authenticator apps available in the market like Google authenticator um octa there but this is the simplest one since we are using Microsoft product. Let's go with Microsoft authenticator. Then I click on next here.

[2:20:03] click on next here. After clicking on next, I need to go on my phone. Now I am not I cannot share the phone screen here. But within in my phone, I should have the authenticator app and I should be adding the work or

[2:20:16] you read it's quite simple. It's saying if prompted allow notification then add if prompted allow notification then add an account work or school and then scan the QR. When I click on next it should give me a QR. So I'm scanning that QR in

[2:20:29] my authenticator app and once that is done I can click on next. It should send me a approval notification or a number that I have to enter within my phone. I don't know if you can see. Okay. So I need to enter that name here. Uh sorry

[2:20:44] need to enter that name here. Uh sorry number here.

[2:21:01] entered, it should uh refresh and it should allow me to login. Okay. Now, I'm inside portal. So, this MFA setup is something that uh

[2:21:15] every new user needs to do once when when they are logging in. All right. Now, if you see I'm logged into Azure portal. If I go to Microsoft Endra ID as root cloud to just confirm that this is the same

[2:21:29] to just confirm that this is the same tenant where uh now obviously I don't have access because I I am authenticated but I don't have the access to do anything with Microsoft enter ID as a root cloud a user. If you remember we

[2:21:42] only just we only invited this user. We did not provide any permissions to this user. All right. So now this user can login but in order to confirm obviously we cannot confirm over here. It doesn't uh give any detail which tenant this

[2:21:57] user belongs to. Okay. But if I go back to the browser where I've logged in with a user who has the access like simply learn user who has the access and if I see rootcloud a from here he uh is part of this email id is part of my tenant.

[2:22:12] All right. What is the type of user? It's a guest user. Clear? So that's MFA and that's how you you work with the external users who are you work with the external users who are not part of your tenant. Okay,

[2:22:26] not part of your tenant. Okay, clear guys B2B mentioned yesterday do not do the de uh the lend hands on uh alongside me. Okay,

[2:22:40] you you you can do it in your free time. All right, so B2B clear or no? Uh quick answers guys we have to cover a lot of topics.

[2:22:58] Har is asking in organization I assume you use org MF software it's not org software what is IM whatever IM service you are using that IM service now MFA is very basic topic which is included in all IM services. So if if you're using

[2:23:13] active directory domain services or you're using AWS IM service, they already have MFA. Okay, that totally depends on you which uh AM service you're using, your organization is using.

[2:23:28] All right, next topic that we have is B2C, business to consumer. Active directory Azure Active Directory or Microsoft Endra ID business to consumer. Now B2B works when you want to invite users to

[2:23:43] tenants and you want to invite your invite external users to your tenant. B2C works in a totally different uh manner. Okay. Uh what is that totally

[2:23:55] different manner? B2C is also an active directory tenant also a Microsoft entra directory tenant also a Microsoft entra ID tenant where you have an application

[2:24:08] like let's say Netflix or our LMS portal you have that application and you want you have that application and you want users to log that application so when you are authenticating a user within that application you need to have an

[2:24:21] you need to develop it yourself you need to ask your developer to come up with an access to the application they need to login they need to prove their authentication they need to prove their identity

[2:24:35] so in that case what you can do let me just give you the real world example just give you the real world example here if I go to lms simplylearn.com

[2:24:49] asking users to do we asking users to authenticate here I need to provide my email address and password right I have to enter my email address and password then only I can login now this simply learn this is an application

[2:25:02] lms.simplearn.com simply.com. This is an application where we are asking the end users to login. Now tell me that end user are I mean the end users are they user are I mean the end users are they our employee

[2:25:17] the end users like you guys who are accessing our LMS learning platform you are not not simply learn employee right so does it make sense for the non employees to create an account within our tenant

[2:25:33] does it make sense let's say we have like in one batch we have uh hundreds of uh students, hundreds of candidate. It doesn't make sense for me or my my AM administrator to go here and create users for each and every uh account. Uh

[2:25:49] we cannot do that, right? I mean we can do that but it it doesn't make sense to do that since in one batch we have hundreds of user. Imagine we deliver like parallelly we deliver like 10 batch a weekend.

[2:26:02] So 100 into 10 is thousand users. I cannot create thousand users every month. Right? So it doesn't make sense. So we should not be creating their user account, our end users user account

[2:26:16] within our B2B tenant within our Microsoft enter ID tenant or what Microsoft is doing Microsoft is providing another set of another tenant which is B2C business to consumer. So if you have an application and you want to

[2:26:31] handle identity that means authentication for that application then you can rely on Microsoft Android IDB2C where you can come up with signup flows what information you want to collect from users like if you see here we have

[2:26:44] given the option to sign up right we have the option to sign up so when you click on sign up you need to provide your email what options we have what collecting first name last name email address so this is known as signup flow.

[2:26:59] what information you want to collect. This information will be kept in Azure Active Directory B2C tenant. All right. So for your end users, for your

[2:27:11] customers, you can use B2C. For your own employees, you can use B2B. Clear where you'll be doing B2C and where you'll be doing B2B.

[2:27:23] Now how to create a B2C tenant? I'm not going to create B2C tenant. B2C talent are not free. Uh you'll have to pay right. But if you want to create in any point in time, you can click you can see within your Microsoft Enra ID page, you

[2:27:37] have this manage tenant. So I click on manage tenant and I can click on create a new tenant and from here I can select Azure AD B2C.

[2:27:49] Okay. So this is something that we can use to create a B2C tenant. use to create a B2C tenant. All right.

[2:28:02] uh as mentioned here from May 1, 2025. So already one year a uh B2C tenants are means if I go ahead and create a new B2C tenant, it won't let me uh create the

[2:28:15] B2C tenant. Why? Because it's it's not there. Okay. So what is the uh what is another method? If I want to use something similar to B2C, you can uh

[2:28:28] click uh you can rely on this uh app registration thing where it is this one. So this also works in the similar way as B2C. Okay. There you have the option to create uh signup flows and all. Okay.

[2:28:43] Kalashnat is asking who typically uses B2C? I just gave an example. If you have an application, you will be using B2C. Okay. So if I have this application like we have this application, we are not using B2C but we can use B2C since we

[2:28:58] have the application and we want authentication module for that Microsoft didn't disclose their customer who are using B2C. uh if you have an application and you

[2:29:10] want to you don't want to bother about creating another authentication module just for your end user to login. How does it work in real world? You have an application you want your user to authenticate.

[2:29:25] Obviously you want your user to authenticate, right? We do not have a a very simple website here. We have the LMS portal where we have our content. This recording goes to the LMS portal. So we don't want to provide access to

[2:29:39] anyone who can login. We want users who have enrolled for our courses only they should be able to uh watch the recordings. So what do we want? We want to authenticate them. Now in order to authenticate what I need to do I can ask

[2:29:53] my developer to create an identity module and then add the username and password of all users in one of the databases. So I can come up with a database. I can uh ask user to sign up from here. Whenever user is signing up

[2:30:07] all the information is uh collected in a database. Now when user is trying to logging in uh login this application will checks the username and password in the database. If username and passwords are correct we are allowing them to

[2:30:22] login. If username and password is not correct we are not allowing them to log. But why should I be using B2C? Let's say my company don't want to manage this database. Managing database, you need database

[2:30:35] administrator, right? You need an extra personnel who knows how to uh create a database with the application. You need a backend uh developer as well. All

[2:30:47] right. If I don't want to manage all this stuff, I can go with simply with B2C. So if you if your organization don't want to manage, you can go for the B2C. Who uses is Netflix can use it. Netflix also has the identity and access

[2:31:01] management. Right? If I try to go to netflix.com, I need to log in first. So Netflix is nothing but an application. So in order to watch any movie or any show, you need to sign in. So when I'm clicking on sign is possible, then that

[2:31:17] clicking on sign is possible, then that place might be using uh B2C. There are lot of applications who uses IM and if they don't want to manage their own database separate database only for identity and access management

[2:31:30] only for identity and access management they can simply use B2C. Okay. [snorts] All right.

[2:31:43] Yeah. Next topic we have any questions before I move to the next topic.

[2:31:57] need database for maintain paid subs. Obviously you need database. Okay. Uh you can rely on the authorization modules as well. Different application have different kind of authorization modules. Authoriz authorization is not

[2:32:10] something that you can uh use Microsoft enter ID for for your application. Okay. For Azure portal obviously you can use Microsoft enter ID for authorization but for your own application you cannot use Microsoft enter ID. For that you

[2:32:23] need to come up with your own uh within your uh application module you need to your uh application module you need to come up with the authorization. Okay. All right. Next thing is conditional access. So conditional access is

[2:32:38] a premium feature. You cannot use it with the free tier. Uh yesterday uh we discussed the different plans and pricing of Microsoft Android ID. So this conditional access is a premium feature. So if I want to use conditional access,

[2:32:52] I need to have the premium P2 premium P2 license. If I have premium P2 license, conditional access. So what is conditional access? As the name conditional access? As the name specifies depends on certain conditions

[2:33:07] the access will be defined depends on certain conditions uh the policy will define whether to grant the access or to block the access

[2:33:19] or to enable the multiffactor authent or to ask for the multiffactor All right. So on depends on certain conditions whatever you define in your policy you either grant the access ask the user to

[2:33:35] multiffactor or you block the access. Now what that condition can be that conditions can be anything like you just want to block a a particular user or a

[2:33:47] want to block a a particular user or a part a group of users or you want to uh block users from non-compliant device. Okay. Uh what is non-compliant device? Non-compliant device is a device which is let's say not joined to your domain

[2:34:01] or the device which is which does not belong to your company. then on on on depends on certain locations as well like uh my company let's say is based in like uh my company let's say is based in India and if someone is trying to

[2:34:16] connect uh my application or Microsoft Azure portal from any other location let's let's say Singapore I don't want them to uh login right so all all these are conditions so depends on you what you

[2:34:32] requirement You can take certain actions like allow the access or ask user to prove the authentication using multiffactor or authentication using multiffactor or simply block the access. All right. Now

[2:34:47] um if you're a working professional you might have noticed if you're using uh iPhone you might have noticed even in Android uh and if you're use if you have downloaded Outlook your your company's Outlook

[2:35:02] uh email within your phone uh teams within your phone you are not allowed to access it unless and until you are on the secured iOS platform I think this is the latest one so you might see that if you have encountered

[2:35:18] so how do they come up with this they use conditional access for that okay so conditional access is a way depending on certain conditions you will be defining whether to provide them the access or not now you're not going to monitor this

[2:35:31] you'll be doing in order to use conditional access you'll be coming up with policies you will create conditional access policies and that conditional access policies in that conditional access

[2:35:44] policies you will define If so and so user so and so group If so and so user so and so group logging in from so and so device uh from certain locations allow them or deny them. So that's what you'll be defining.

[2:35:57] conditional access comes with the premium feature uh is a premium feature and if in order to use that you need to have Microsoft Enra ID premium uh have Microsoft Enra ID premium uh license.

[2:36:27] pricing and if I want to see uh with which tier or which premium license Microsoft conditional access comes with, you can come over here and you can see that conditional access comes with P1. So in

[2:36:43] order to use conditional access, you need to have at least uh Microsoft enter ID P1. If I go back to the portal where I have logged in, what license do I have? I have a free license so I won't be able

[2:36:56] to use the conditional access. Now I have another tenant which is uh P2. So I can go to that tenant and in that tenant

[2:37:25] Okay. So now I've logged into this tenant where we have the P2 license. So for conditional access I can make use of this.

[2:37:57] have the P2 license. Now Har is asking why different tenants to be used. You don't have to use different tenant as I mentioned if uh one company should only have one tenant. In any case uh if you have multiple tenants then you need to

[2:38:10] switch between the tenants. Okay. Here you need to switch between the tenants if you are part of multiple tenants. All right. You don't need to have All right. You don't need to have multiple tenant but most of the uh

[2:38:23] companies who did not follow the best practices initially when Azio was new tenant. All right. But you should not be having more than one tenant unless and until you are uh

[2:38:38] you're taking over another another company. So in that case obviously you'll be having more than one tenant. So I can switch from here.

[2:38:55] So in order to use any premium uh topic I can make use of uh this tenant and premium P2 is not a free license. You have to pay. So that totally depends on your company whether they approve or not. But obviously since this is these

[2:39:10] are the security features uh your company should approve the budget and you should be able to use [snorts] uh the premium uh gear. Okay. All right. So in order to use conditional access I need to go to Microsoft entra ID and

[2:39:25] there if I go under manage section somewhere I should have the uh security option uh within security if I go to protect you should see the conditional

[2:39:37] access. How does it work? Conditional access is just a policy. You need to define your own policy. What are what are the conditions that you want to evaluate and what actions you want to take. The conditions are

[2:39:51] take. The conditions are users, groups, devices and locations. The actions are allow throw multiffactor authentication challenge or block the access. Okay. If I go back to the browser where I have logged in with uh

[2:40:05] P2 uh tenant you see here conditional access. from from last patches. So if you see here I have a policy which

[2:40:19] says block access to Azure portal from Malaysia. In order to create a new policy you can click on new policy here and you can click on new policy here and you can create a policy. All right. Now I I

[2:40:31] already have policy. I'm going to use this but let me just walk you through this but let me just walk you through the uh creation uh steps. So once I click on new under the conditional access policy I click on new policy.

[2:40:43] Here are few few things that I need to provide like what is the name of policy. whatever the name should be descriptive enough so that uh anyone visiting the conditional access policy should be able to understand what this policy is doing.

[2:40:57] to understand what this policy is doing. Then users whom which user you want to target. Do you want to target a specific user, all users or selected users. All right, you want you you can target all users. But remember if you are

[2:41:11] targeting your all users, this policy will impact you as well. Even if you are the administrator and you are targeting all users, this policy will lock you. If you're locking if you're defining a policy which is locking the access to a

[2:41:25] particular resource or a particular application you are locking yourself out application you are locking yourself out as well if you target all users. All right. So how to avoid that thing? If you click on all all user make sure you

[2:41:38] excluding one or two users like who who are admin. So in case if you want to change the policy at least you can login. Okay. So you can add your username. Whatever your username is, you can provide your username. I don't know

[2:41:52] if I have my same account here, right? So I can select my account. I can select. So this user won't be impacted with the policy. All other users will be impacted. All right? So I click on include uh and

[2:42:07] I'll just select a particular user. I might have user 01 here. Okay. Okay. So this user will be impacted whatever I'll be defining next. So what we are defining here block access

[2:42:22] this is the user user 01. So this policy will only impact user 01. Then target Target resource is something which is the application that you want to uh

[2:42:34] select. Okay. So what we are defining this is my policy. There is a user. This is the target user. So whenever this user is trying to log in or whenever this user is trying to do anything as of now we have only created policy and we

[2:42:48] have selected that user we have not defined what what condition what this doing that's that's something that we are defining here in target resource. So in target resource you are defining the condition this user is trying to login

[2:43:03] let's say a simple example for this user is trying to log into portal.azio.com azio.com. This user is trying to log into portal.azio.com. That's my condition. So this is portal.zo.com is my target resource. So that's what we

[2:43:15] are defining over here. Target resource. Okay. So what we can select in the target resource we can select the specific resources like I want to uh

[2:43:28] select all the admin portals in Microsoft m all the Microsoft admin the Microsoft admin portals. So if you want to evaluate for this portal that means user 01 is trying to loging into

[2:43:40] this portal. So these are the target portals right uh you just want to target portals right uh you just want to target uh Microsoft 365 you want to target Azure active directory reporting you want to target uh Azure perview or

[2:43:55] whatever you want to target. So you can select uh that from here. All right. Now in order to target the Azure portal we have something known as Windows API

[2:44:07] uh Windows Azure service management. So this is the application which is equivalent to portal.azure.com. So if I equivalent to portal.azure.com. So if I select that it says this policy impacts

[2:44:21] Azure portal. So they have changed the name into Windows Azure service portal.azure.com. So what we have defined so far we have defined user 01 target resource is portal.zo.com

[2:44:36] then you can define network as well. If this if this user is coming from so and so network so you can define that as well. Okay. So how to define the network? In order to define the network u you need to select any network or any

[2:44:51] u you need to select any network or any location all trusted networks. So if you have added certain IP address as trusted IP address that will fall under all trusted network. Okay. You can also select uh networks and locations like I

[2:45:06] just want to uh block from a certain location only from one country or uh two countries or three countries. So I can select that as well. But in order to define the networks and all we need to do that beforehand before defining the

[2:45:22] do that beforehand before defining the policy. So where we can do that within the conditional access policy you have one [snorts] uh option where you can define the trusted or untrusted location. So if I go over here uh go to

[2:45:36] the security go to the conditional access and here under manage you have named location. So here you can define the named locations like I define country's location depending on on exact country like I

[2:45:51] don't want to allow people or I want to allow people uh to log in from uh so and so location. So I can create country's location over here. I need to switch since I logged into uh different tenant. So I need to switch.

[2:46:23] you see named location. So here you see the option is available in in last tenant uh in my default tenant is not this option was not available because I had the free tier, right? So here you can define your uh name location here I

[2:46:37] can create on the basis of countries or on the basis of IP IP ranges. So if I let's say I have a VPN I can define click on IP ranges and provide certain IPs like if I click on IP ranges I can provide IP addresses here like only uh

[2:46:52] this IP address should be allowed only one IP address should be allowed. So I I can mark that as a trusted location. So if traffic is coming from this and this IP that's what we are defining in the conditional access policy. [snorts] Okay

[2:47:06] I already have the name location over here. So I'm not creating a new but in in case you want to create you can create on the basis of IP ranges or in the basis of countries. Let's say you want to block traffic or allow traffic

[2:47:18] only from Afghanistan uh Alan Island, Albania, Algeria. So you select all of your location which you feel trusted or untrusted. Okay. So I can select Barbados, Bellarus. So I can select all this which

[2:47:32] Bellarus. So I can select all this which I want to define as as a white list a blacklist countries from where I want to block the traffic. I can select that. you're only selecting location that's all. Okay. Once I select I can click on

[2:47:48] create. Obviously I need to provide a name. So once I provide the name I I'll get that option uh to create that particular location. that location will be created here. Similarly, I created uh a new a location in my last patch uh

[2:48:02] with the name Malaysia. Okay. So, this is named location Malaysia and here I have only selected Malaysia. So, if you see all other countries are not selected only Malaysia is selected, right? So, that [snorts] is selected.

[2:48:16] So, I can use that. So, if I go back to the to the page where we were defining the policy here I can select Malaysia. Okay. Click on save. So what we have conditions as of now. We have defined the user who is our target user the

[2:48:32] resource the target resource where user is uh user will be trying to login. Then we have defined the network. All right. Then you can define the conditions. So here I can go to the conditions and here I can

[2:48:45] go to the conditions and here I can define whether I want to uh allow or or deny or whatever. Right? Right. So I've selected the network here and then if you scroll down here you have the access control whether you want to grant the

[2:48:58] access. So you click on grant. So here you can define block access. That means you can define block access. That means if user one which we selected here is trying to log into Azure portal from Malaysia then you defining block access

[2:49:13] or grant access but ask for the multiffactor authentication right or grant access and ask user to change the password

[2:49:25] password or grant access and ask the user to login from from so and so network. You can you can select login from a compliant device that means a device which is connected to your or a device

[2:49:38] which is provided which your company has provided to the user. So that device will be marked as a compliant device. Right? So whatever you want to select you can select. Just to keep it simple I'll do a block access. Okay. Before

[2:49:50] applying the policy I want to show you that if we do not apply the policy the user 01 should be able to login. So before doing anything with the policy, let's go back to the users section

[2:50:05] and let's confirm that we have user 01. If you see here, we have user 01. Uh hopefully I know the password. So I copy the user 01's credential. I mean I copy the user 01's credential. I mean I copy the user 01's user ID. I open in private

[2:50:20] the user 01's user ID. I open in private window. Go to portal.azio.com. just want to show you uh what is the location from where this traffic is

[2:50:32] going. So if I type what is my IP address, I should know what is my location, [snorts] right? So if I if I click on what is my IP address? click on what is my IP address? Oh, it's this.

[2:50:55] address, you should see the location from where this traffic is generating. If you see this Kola Lampur, where is Kala Lampur? Colour Kola Lampur is in Malaysia, right? You know, you guys know or know [snorts] if you see this is the

[2:51:08] or know [snorts] if you see this is the Malaysia. If I if I just minimize uh or maximize, you see the name Malaysia, right? So when I'm trying to go into portal.io.com, my traffic is going from

[2:51:21] Malaysia. All right. So, I copied the username. I pasted it here. Uh, I need to provide the password. Hopefully, I remember it.

[2:51:36] okay, this doesn't have the MFA. Seems it has. So, [snorts] I need to provide it has. So, [snorts] I need to provide the code as well.

[2:51:53] policy if you see I am able to login. You see I was able to login and this is the same tenant where uh if you see the tenant name is the same tenant Azure training premium P2. If I switch to the

[2:52:08] uh if I switch you see the same tenant Azure premium P2. So without applying the policy user can login. Right now let's go back to the page where we are defining the policy. So we have defined user 01 target resource is Microsoft

[2:52:23] Azure portal network [snorts] is Malaysia condition is uh same uh same network selected right and the uh grant the access control is block I

[2:52:36] select block and then I enforce the policy and I click on create. So new policy is being created and I'm enabling that policy. Report only will only report when there is such traffic. it won't uh directly block of your

[2:52:52] turning of the policy. That means policy is not in effect. All right. There are three uh there are three options when you go to enable policy. Report only will only report when such trap such uh requests

[2:53:09] are coming in. On you are turning on the policy. Off is your policy is completely off. It's not doing anything. All right. So if I go here I should see my policy. If you remember we only provided the name as block access. So this is the

[2:53:24] policy that we just created. All right. That policy is on. The other policy which I created in last batch is is is off. All right. So [snorts] this policy is on. Now when that user is trying to log in that user should be blocked

[2:53:40] condition access policies. On the basis of certain conditions, user will be allowed or blocked depending on whatever you have selected. Now, obviously, one thing you need to keep in mind, the existing session will not be impacted.

[2:53:54] Only the next session when user is trying to log in that will be impacted. All right. So, in order to see that in action, I'll sign out. After signing out, I'll try to sign in again and conditional access should take

[2:54:08] again and conditional access should take effect and block this traffic. MFA. It's saying your sign-in was successful but does not meet the

[2:54:23] criteria to access this resource. What we applied in our conditional access we applied in our conditional access policy? We applied if user 01 is trying to logging into portal.io.com block the access from Malaysia. If

[2:54:37] azure.com from Malaysia block the access. That's what is defined in my policy. All right. But if this user tries to loging in from any other location, it should be allowed. Now I don't have uh

[2:54:51] any other location over here. Uh if I have that location, uh it should allow. All right. So now it's blocked. Now where [snorts] you can implement this in where [snorts] you can implement this in real world? Um tell me how many of you

[2:55:04] uses Hot Star and Indian Hot Star. Okay. In India we have Jio Hot Star right? It was Disney Hot Star but then Jio took over. So now it's Jio Hot Star. Have you ever traveled and tried to access the Hot

[2:55:18] Star from outside India? Have you ever tried that? Yeah. I I stay in Malaysia and if you know IPL is going on right and IPL is broadcasted in Hot Star. I cannot watch it. Why? Because Indian content on Jiohostra can only be

[2:55:34] accessible from within India. So if you are in India then only you can consume the Indian content. If you're outside India, you cannot uh consume that content. So this is like a conditional access. Now I'm not saying that hostar

[2:55:50] is using Microsoft enter ID conditional access but they might be using similar kind of policies. All right. So that's one. Same goes with any any OTT content. Even Prime Video, I cannot watch Indian content from here. Even uh Netflix,

[2:56:06] I I I cannot consume the Indian content. Obviously, Netflix is available here. Hot Star is available here. But the only thing is I cannot consume the Indian content. All right. Now, people are asking work with VPN and all. Obviously,

[2:56:19] it will work with VPN. What VPN does? VPN changes your location, right? So if I use NodeVPN or ExpressVPN and connect to any Indian server technically I'm in India right from Malaysia if I use NodeVPN or

[2:56:34] and if I change my location connect to Indian server what will be the traffic the source traffic from where it will be generated computer only understand the source IP address destination IP address all those

[2:56:48] stuff right so if I launch NodeVPN or ExpressVPN and connect to India and then ExpressVPN and connect to India and then try to access Hot Star or Prime Video. What will Hostar uh what will the application uh sees the source as the

[2:57:04] traffic the traffic source? Obviously the hot star will see my source is India. So India if your source is India you are allowed to watch right. So that should be allowed. VPN is a technology or a network which

[2:57:19] changes your location which hides your original location. So if you're original location. So if you're connecting any uh using NVPN to any part of the world your source traffic will change to that part. So if I use NodeVPN

[2:57:32] and connect to Australia my source will be Australia. So my whatever I'm trying to access the target will will will identify my source as Australia not as Malaysia.

[2:57:44] Okay. So obviously you can bypass this kind of thing using VPN and all but this is something that you can apply in your corporate corporate network. Now I just gave an example of hot star but that's not uh like a confidential resource and

[2:58:01] all right but for your corporate network let's say you work for a finance company so for corporate network keeping uh uh keeping in compliance

[2:58:13] keeping uh uh keeping in compliance makes matter it it matters right like I don't want my people to access my data from so and so location. For this kind of scenario, I can use

[2:58:27] conditional access. I don't want them to access from Australia. Why? Because my business in Australia and I don't want my people to travel to Australia and and my people to travel to Australia and and uh during the work time and access my uh

[2:58:41] my my my resources. I don't want them to do. So what I can do? I can simply block What I can do? I can create another policy and only allow from so and so allowed outside Malaysia you're not allowed so those kind of thing you can

[2:58:56] you can uh you can do using uh conditional access all right hopefully conditional access is is is cleared let's move on to the next topic now identity protection there's no demo for

[2:59:10] identity protection but it's another premium feature that we have with Microsoft next topic that we have is identity protection so what is identity protection it's another premium feature. If I go to the plans and pricing, uh

[2:59:25] If I go to the plans and pricing, uh identity protection again falls under premium feature. Okay. So, if you want to use identity protection, you need premium P2. If you do not have premium P2, you won't

[2:59:37] be able to use identity protection. So, what is [snorts] identity protection? Let's try to understand. As the name specifies, it has something to do with with your uh identity. It's something to do protecting your your

[2:59:52] identities. Okay. Identity protection is again a cloud-based uh premium service in Microsoft Entra ID uh which helps your identities to log in uh within your

[3:00:06] your identities to log in uh within your system uh securely. So what it does it system uh securely. So what it does it detects the risk risk detection it detects whether or it analyzes when when your user is trying to sign in uh uh

[3:00:21] your user is trying to sign in uh uh that sign in is risky or not. Right? You [snorts] can do the risk based conditional access. If the user or the sign in is risky, we can apply the conditional access

[3:00:33] policy over there. Right? You can see the risk reports and insight. You can do the automated remediations. You can integrate identity protection with different security solutions. Now what it does in real world, [snorts]

[3:00:48] it does in real world, [snorts] it only analyzes your users for their risk. What do I mean by risk? If you have used if you're using or accessing your banking application from any other

[3:01:02] location apart from your usual location, u either they will send or or block your uh access, right? Either [snorts] they will uh allow you the access by only

[3:01:14] approving or approving uh MFA. That means they will send a notification to your mobile app and they'll ask you to approve, right? uh if they detects that your traffic is

[3:01:29] coming from anonymous IP that means a IP which is already blacklisted and if your traffic is coming from that IP uh that is considered as a user at risk or the sign in that user is trying to do is risky. So identity protection is a tool

[3:01:45] is a security feature in Microsoft Entra ID which detects this uh risky behaviors involving with your identity and depending depending upon the risk uh

[3:01:58] criteria whether that risk is a low, medium or high depending on that whatever you have defined block or a law it will take that action. All right. Now, unfortunately, we do not have any demonstration for this since this this

[3:02:13] works automatically. Okay. So, what you can do, [snorts] you can simply uh set up the identity protection policies. Like if I go back to security over here, you have another tab or another blade here which says identity protection,

[3:02:29] right? So, when I click on it, you'll see you have three different policies. If I go under protect, you have three two different policies user risk policy, sign in risk policy. All right,

[3:02:43] you have you can integrate identity protection with with conditional access. You can also register MFA from here. Now obviously MFA Microsoft has made mandatory. So this MFA registration policy

[3:02:57] >> [snorts] >> uh is by default require for every user. Okay, we we don't have to do anything for this. The user risk policy if your user is at risk let's say the the the password that user is using is

[3:03:11] compromised the user become a risky user if user is trying to logging in from anonymous IP that means the sign in that user is trying is risky sign in right so all those stuff you can define over here now you don't have to do anything you

[3:03:26] just have to come over here and define what users are the targeted user if you if you want to apply to all users you can select all users And then the risk. And then the risk. What risk? High risk

[3:03:41] uh medium and above risk or low risk. Even if there is a low risk like [snorts] uh user logs in the the the regular login of user is from 9 to 5. user never logs in after 5:00 p.m. But sometimes

[3:03:56] logs in after 5:00 p.m. But sometimes let's say um so what this identity protection does it learns the pattern that user whatever the usual pattern of that user whatever the usual pattern of user is is recorded by Microsoft enter

[3:04:09] user is is recorded by Microsoft enter ID so every time user only logs in 9 to5 from this particular browser now let's say user changes the device when user is changing the device again logging into the same time 9:00 a.m. But device is C.

[3:04:23] The browser is C. So that is detected detected as risky. Okay. Why it is risky? Because Microsoft Enter ID never saw this user

[3:04:36] coming in from this browser from a new browser. So that can be an unusual browser. So that can be an unusual location that can be an unusual uh login location that can be an unusual uh login that can be detected as as a low risk or

[3:04:50] medium risk or high risk. Sorry. Okay. So you just have to come over here and define if you want to block or allow access even for low risk.

[3:05:05] Sorry for high risk or for medium and above risk. That's all you want to define. Okay, [snorts] that's all. Now, we cannot see the demo here since this totally works uh

[3:05:19] alongside with Microsoft threat intelligence. All right. So what they do they regularly see the threat um coming in from thread detection and

[3:05:31] depending on that they they consider whether the sign in is risky or whether the user is at risk and depends on that whatever access you have defined block access allow access. So that that thing will be considered and uh if you have

[3:05:45] blocked the access user will be blocked from logging in. If you have allowed the access, user will be allowed. All right. So that's will be allowed. All right. So that's what identity protection is. Clear. Now

[3:05:58] remember one thing uh as as the information is mentioned over here. Uh in order to work with identity protections from October 1, 2026, you access policies. So if I go back to the conditional access policy

[3:06:14] conditional access policy here, you have the conditions. Within that conditions you have the identity protection as well. User risk, signin risk, right? So all this stuff are already here.

[3:06:28] All right. Here

[3:06:47] real world we use identity protection. Every application is using identity protection. I log into Gmail from a new browser. Their identity protection is working and they're asking me to uh confirm that means they using

[3:07:00] multiffactor authentication. Right? So when when they are when they are uh when they're doing or they are configuring their identity protection

[3:07:12] they are not completely blocking you. So if I go to the security and identity protection here they're not completely blocking me. So here you have the control you have the option to allow the access or the block the access. But when

[3:07:24] you are allowing the access you're asking user to change the password or asking user to change the password or you are asking user to uh to rec to to prove their identity using multiffactor authentication. So when we work when we

[3:07:37] log into Gmail from a new location they are doing this thing. when I'm logging from a new location Gmail obviously tracking my login activity if I'm using my regular mobile application they

[3:07:52] I'm sorry they will not trigger for MFA but when I'm using a browser within the same mobile but browser is a new session they will detect that as a unusual login

[3:08:04] unusual IP address or unusual login and then they will trigger they will ask me to confirm my identity using the multiffactor authentication that's what they're using. Okay. All right. Similar your banking applications

[3:08:18] even your u if you're working professional you might know that you need to use the company provided laptop for all of your uh outlook your teams.

[3:08:31] If you're using shareepoint you need to use that right. If you're using your own laptop try try using your own laptop. you'll get an get a call from your cyber you'll get an get a call from your cyber security team, [snorts] right?

[3:08:44] Cuz they're tracking in. And if you don't want to track, you want everything automated. So you can use user risk policy or sign in risk policy want to entirely block access, just block the access. You want to allow the

[3:08:57] access and ask user to provide multiffactor authentication, you use that. All right. Now, just for simplicity, I I'll disable it. I don't want any of my user to get impacted with this. So, I'm I'm disabling it, but

[3:09:09] [snorts] if you enable it, it should uh work behind the scenes. All right.

[3:09:25] access review. What is access reviews? [snorts] So, next topic that we have is managed identities. So, what is managed identities? So far

[3:09:37] whatever we have discussed what were mostly related to the user or group mostly related to the user or group based identities. So you have user and he wants he or she wants access to the resources. So you create their user

[3:09:52] account and provide them the access. Okay. Now in case an application Okay. Now in case an application requires an access tell me how an application is going to access the resources.

[3:10:11] user how how do you authenticate yourself? You provide your username and yourself? You provide your username and password. Right? So your identities is created within any IM solution. Your identities get created

[3:10:25] and that IM solution authenticates you on the basis of your username and password or whatever identity uh mechanism you're using MFA and all. But in case any application requires an access how you going how that

[3:10:38] that means whatever IM service you are using that IM service should be providing the access. We are not going to provide access to our back-end to provide access to our back-end services like SQL or storage direct

[3:10:53] access to any of the application right we need to authenticate that application. So what could be the way? SSO is not the So what could be the way? SSO is not the way. MFA is not the way. Uh the way is

[3:11:05] one of the way that we have in Azure is managed identities. So what does manage identities do? It creates an object ID for your application and then you can use that object ID to provide access to the

[3:11:21] backend services like storage or or SQL or whatever. All right. Now if I go to or whatever. All right. Now if I go to the portal whatever user we have created if I go to Microsoft enter ID and if I go to the users

[3:11:36] if you see here let's say I I I I pick up any random user fabric admin. If you see this, this user is having an object ID. What is this object ID? This object

[3:11:48] ID is the reference or the identification for this particular user identification for this particular user within my tenant within my entra ID. Okay. So this object ID is the identification

[3:12:03] identifier for this particular user. So when this user is trying to logging in as a user what it will be providing? this user will be providing the username this user will be providing the username but the IM service will identify this

[3:12:15] user with this object ID. [snorts] Okay. So similarly when an application requires an access we need to register an object ID for that application. So

[3:12:27] remember from yesterday's class, yesterday's discussion, uh application is nothing but some files, right? People will develop the code, will write the code, that code is written in one of the file or or uh multiple files and that

[3:12:42] that files is stored somewhere in one of the server. So this is my server in in on top of this server I am hosting my application. Now this application requires access to the backend services like database like storage. But before

[3:12:59] providing the access I need to authenticate this application. So how to authenticate this application? So if this application is hosted on Azure virtual machine or Azure app service or Azure or any uh service any compute

[3:13:14] service Azure any compute service of Azure then you can create manage identity for that service and that manage identity registers an object ID

[3:13:27] for your application. That means in simple term a user gets a user ID gets created for your application and when you create the user ID then it becomes quite easy to provide access to

[3:13:42] becomes quite easy to provide access to the resources to the required resources. Okay guys is the screen visible? I see that Babata is saying screen is most visible. What do you mean by most visible

[3:13:56] What do you mean by most visible guys? Am I audible? Uh screen visible. Okay. Devatra, you have to check your connection. Please rejoin.

[3:14:12] It's visible for everyone, not visible to you only. an access for real world scenario you have this application. This

[3:14:24] lms.simplearn.com simply.com is an application right when I go to continue application right when I go to continue learning

[3:14:37] should see your live classes here but when I go to the past classes sorry it's not this one let me show you with a 104 if I go to a 104 when I go to the live

[3:14:56] Now this is my application. ls.simplearn.com is my application. Now tell me [snorts] do we keep the assets like videos and images within the same server where our application is

[3:15:11] the same server where our application is hosted. separate our front end with our back end. Front end is something that user

[3:15:23] see you lms.simplearn.com you can login and you can see you can interact with our application but if you want to access any backend service like the storage like we have files whenever I upload file that file

[3:15:37] will be visible here right if I click here I should I should be able to see the files that have been uploaded right so this application lms.simplearn.com simply.com is hosted on a compute service like virtual machine. So

[3:15:50] lms.simplearn.com will be hosted here. But the actual video, the recording of the live class is not stored on the same virtual machine. We don't store it here. Imagine we have running 10 classes parallelly

[3:16:05] every weekend. If we keep on saving all the videos in the same virtual machine, require. So we can't keep it in the same virtual machine. So what do we do? We separate this with our back end. So we might be

[3:16:18] using storage service, storage account. So here we will have our videos. This recording that you see over here that will be stored in the storage service.

[3:16:31] which is hosted on this virtual machine needs to access that video. When someone clicks on this video obviously the application will run that video will play that video. So when any user is clicking on this

[3:16:44] video the application will play that video. But in order to play application itself needs an access to the storage account. Storage is a separate service. The compute is a separate service. So when application is trying to access the

[3:16:58] storage. Now tell me whether storage will do the authentication and authorization or not. Storage is the service in Azure. So Microsoft enter will first authenticate this lms. com whether the

[3:17:13] whether the object ID is present or not the username password provided by this application is correct or not so all those thing will be checked and if it's correct then it will see whether this

[3:17:26] application is authorized to see or run or play this video or not. So for user it's quite easy we create the user user gets username and password but what about application? So application you can create credentials

[3:17:42] for your application in Azure by using manage identities. All right. So manage identity is the way to create an identity for your application. Okay. I just gave you an example of uh

[3:18:00] I I just give you an example of lms.simplearn.com. You can take any example. Every application works in the same way. most popular video streaming service YouTube. So YouTube what you see is the front end youtube.com you see all

[3:18:14] the videos and all everything. When you click on any video the YouTube backend service wherever they are storing the video and that backend service is responsible for storing the video. It could be a

[3:18:27] storage service any storage service that Google is using, YouTube is using. All right. So in order to provide the identity to your application within Azure you can use manage identities. Now there are two types of manage identity.

[3:18:40] System assigned and user assigned. In order to understand system assign manage identity and user assign manage identity you need to answer me a question where

[3:18:52] group. What is the difference between user and group? user and group? [snorts]

[3:19:06] connection please. You need to uh turn off and and rejoin. You should be able off and and rejoin. You should be able to see the screen. Okay.

[3:19:26] users. So if you have multiple users, you create a group and you put all the users within the group. So system assign and user assign is is the is is based on the similar concept. System assign is an individual identity for one application.

[3:19:41] So when you use system assign, one object ID will be created and that object ID will be created and that object ID will be assigned to only one uh application. Whereas when you create user assigned

[3:19:54] manage identity that user assigned manage identity is shared across multiple applications. So if you have let's say 10 applications and all these 10 applications require similar kind of access. So instead of creating 10

[3:20:10] different system assign identity, you create one user assigned manage identity and then you assign that user assign manage identity to all other VMs or app service or whatever. Okay. So it's similar to group and

[3:20:25] individual user. System assign consider it as an individual user. So you create when you create system assign manage identity a single object ID is created application. Whereas user assigned manage identity is

[3:20:40] like a shared manage identity which can be shared with multiple applications. So if I have five applications which require similar kind of access, I'll create one user assigned manage identity, I'll associate that one user

[3:20:55] assigned manage identity with five different applications and then all that similar access. Okay, that's the difference. Now where this manage identity we can see now we don't have any VMs or all but I have

[3:21:08] existing VMs. So if I search for the VMs it's not only for VMs it's can be for any compute service. So if I have app service we will have a separate topic uh module on compute service where you'll get an introduction to all compute

[3:21:24] services. So whichever compute service you are using every compute service has a manage identity feature. Okay. So let's say uh this is my uh Linux VM let's say uh this is my uh Linux VM OpenVPN 2 and this Linux VM needs access

[3:21:37] to the backend service. So what I can do I can create a manage identity for this. If I go to the security there I should see identity and within that identity we

[3:21:49] have system assigned or user assigned. So if I select system assigned then that would be an individual identity for this VM only. Okay. So I click on on and then I click on save. So it will create a manage identity for this particular

[3:22:04] manage identity for this particular virtual machine that manage identity is not shared across multiple virtual machines. Okay. So as soon as I click on on it should once it is done it should create the manage identity. So you see

[3:22:18] an object ID is created. Right. Now you can use this object ID to assign whatever role you want. Like this virtual machine needs an access to storage. So you can use this object ID and assigned access to the storage.

[3:22:31] Okay, I don't need it. So I click I I turn it off. Okay, let's wait.

[3:22:57] identity. Once this is done, I'll go to that tab. it on, it creates an object ID for that particular uh instance for this virtual

[3:23:12] machine. when you turn it off, it dregistered the same object ID from dregistered the same object ID from enterra ID. Okay, that's what's happening behind the scenes. Now, if you want to use user assign, uh I need to

[3:23:25] want to use user assign, uh I need to wait until uh it won't it won't disable. [snorts] [cough]

[3:23:55] It's taking a lot of time for dregistering. Hurry is asking where do we use that object ID? Okay, where do you use this object ID? Okay, where do you use this object ID? If I go to uh portal.asio.com

[3:24:09] object ID? If I go to uh portal.asio.com azio.com user every group all of them are having the user ID

[3:24:42] if If I go to Microsoft Entra ID, if I if I select any user, we use this object ID? As I mentioned when before starting the manage identity

[3:24:56] that every identity within your Microsoft Entra IM solution has this object ID. When this object ID is used when this user is trying to log into any azure.com the IM service is identifying this user

[3:25:13] the IM service is identifying this user as this object ID we are not directly using this object we as a user we are not directly using this object ID if I ask you to remember this object ID will you be able to remember

[3:25:25] the object ID let's say you are this user fabric admin obviously you won't be able to remember this right for you for us as a human being it's easy to remember the the names fabric admin at whatever my domain name is. So I can

[3:25:40] remember that. So for for me I will be providing fabric admin at whatever my domain name is. I'll be providing that and then I'll be logging in. But for IM service how that IM server will identify this user IM service will see this

[3:25:57] object ID. So behind the scenes when we are when the data is being sent or or received by the IM service they will be using this object object ids. Okay. So when I registered when I created an system assign object system assign

[3:26:12] manage identity an object ID got created it got registered in the Microsoft entra ID as mentioned here. Okay. So Microsoft entra ID will identify the openVPN2 virtual machine as that whatever object ID was created.

[3:26:27] So when you use system assign manage identity it's an individual identity for that particular virtual machine. When you use user assign you will have uh you you use user assign you will have uh you can use that user assign manage identity

[3:26:41] to share across multiple resources across multiple uh virtual machines. across multiple uh virtual machines. Okay.

[3:26:54] first create it. So if I search for manage identity on top I should see manage identities and there I can create the user assigned manage identity. Okay.

[3:27:34] Once this identity is created, multiple VMs can share it.

[3:27:53] identity. I can associate this identity to the resources. So I go back to the virtual machine. I [snorts] go back to the identity. Hopefully I can use it since I created it in central India and my VM is in

[3:28:07] it in central India and my VM is in different region.

[3:28:20] somewhere in US, South Central US and identity was created in central India. I am not able to see that identity. Okay. So in order to use the user assign

[3:28:32] that user assigned manage identity is created in the same region. All right. I cannot see it because it's in different region. If I go back to user uh if I go back to manage identities, I see this shared user

[3:28:48] manage identity created in central India. That's why I cannot use it. Okay. If I create it in another manage identity somewhere in

[3:29:14] So both the identities and the resource who wants to use the identity should be who wants to use the identity should be in the same region.

[3:29:33] back to identity. Click on user assign. Give it some time. I should be able to see. Just wait for some time. You should be able to see. [snorts] Okay. If you're not able to see, just give it some time.

[3:29:58] see that we should be able to see it. Okay, that's it's not showing. It takes some time. If we did not receive any error while creating the manage identity and and we are not seeing it, just give it some time.

[3:30:11] it some time. Okay. Or better we go to the uh identity Okay. Or better we go to the uh identity and check the type of identity this is.

[3:30:32] see. We should be able to see that user assign manage identity and we will be assign manage identity and we will be able to assign it to the uh OVM South central US identity is also in South Central US

[3:30:56] in the scene. It's not true.

[3:31:08] the identities now, right? So I can select this shared user 02 which we created in the same region. I click on add. And once I click on add, this add. And once I click on add, this openVPN will have that identity with

[3:31:21] that object ID. Similarly, I can go to another VM in the same region and I can add that as a user identity for that VM. Okay. [snorts] Okay. [snorts]

[3:31:44] this, let's me go back to very basic. Tell me what is authentication? Have you understood what authentication is? There are users who wants to login. Why? Why do you want users to login? I want user to login to make sure that the

[3:31:59] want user to login to make sure that the user who he is claiming to be is the same user. So I need to verify. So in order to verify I have an IM solution. I need some kind of IM solution in place.

[3:32:13] Right? Have you understood that basic? So in order to assign access to the users I need IM solution in place. Before assigning access I need to create an user ID for that user. Is that clear?

[3:32:35] explaining manage identity I went to the lms.simplearn.com. I showed you the uh where it is. Okay, I showed you this. Okay, so what is lms.simplearn.com? Hopefully you you you know this is an

[3:32:51] application. Okay, it's a web application since you're accessing it via web. It's a web application, not a desktop application, application. Now when it comes to application, you

[3:33:05] design application in different tiers. You have front end. Front end is something that your user, your end user sees. You have back end. Back end is something which is separated from the front end because we don't want our

[3:33:18] back end otherwise you'll be able to download the video and you'll be able to spread the video right imagine Netflix is giving you access to the back end what we can do we can download that

[3:33:30] movie and then we can share it on torrent and all that is known as piracy torrent and all that is known as piracy similarly we want to protect our assets right so what do we do we separate front end everyone every application has this

[3:33:42] concept back end and front end. So front end is something uh which is accessible to the user and user end user and user sees application in that form. Now when you are separating these layers front end and back end can your front end your

[3:33:57] LMS.simplearn.com directly access the back end without authentication or authorization. Is that safe? Obviously not safe. Why it's not safe? Front end is also ours. Back end is also

[3:34:11] ours. So when front end wants to access back end why can't we give the direct authorization. Why we are not doing this? Because when as a end user you click on this this video link a new uh a new uh browser

[3:34:30] will be open and your video will be played there. So if someone some hacker and if you do not have any authentication or or or anything that hacker can uh track or can can hack the session and can get into our back end

[3:34:47] can download all the videos that we have. So for that reason we want authentication and authorization between front end and back end as well. But this is an application. How do I authenticate this application? Application is not a

[3:34:59] user. So when it's not a user, it doesn't have the username and password. So how do I authenticate this guy? This application, this application is hosted somewhere, right? Might be hosted on virtual machine,

[3:35:13] might be hosted on app service or container wherever it is hosted somewhere. So if it is hosted somewhere that virtual machine I can provide access uh I can provide identity to that virtual machine.

[3:35:26] So in Azure we have this managed identity concept. You can create a manage identity for your virtual machine where your application is hosted. Once I create the manage identity that object ID gets registered to the

[3:35:43] entra id. Why it's registered to the entra ID? How entra ID is going to identify a particular object? So in Microsoft enter ID we uh they create the they create something known as object ID like in Windows you have uh SID in Linux

[3:36:00] you have some different identifier. So in every platform you have an identifier. Object ID is nothing but an identifier. How entry ID is going to recognize or verify or identify that particular identity. Identity is nothing

[3:36:13] but a an object which requires an an access. So in Azure we have something known as managed identity. So when I create the manage identity an object gets registered. So as soon as I created the

[3:36:28] manage identity shared user 02 an object gets registered within my uh entra ID. but when you are trying to assign the access since it's not an since it's not

[3:36:41] a user I won't be able to see it under users. You won't be able to see it here since we are under user section. Okay, there's no separate section for application where you can see the object ID. But

[3:36:53] where you can see the object ID. But object ID is a way how entra ID is recognizing or verifying or identifying that particular ID. When you create manage identity, there are two ways. So let's consider this

[3:37:06] open VP VPN 2 is a virtual machine where my lms.implearn.com simply.com is hosted my back end because application is hosted on this

[3:37:21] requires access to the back end. So how do I provide the access in order to provide the access one way that we have within Azure is manage identity. So when I create the manage identity an object ID gets created for that particular man

[3:37:37] for that particular virtual machine. when it's created. Let's say now I want to assign an access to the storage. This is my storage account. Now that application requires an access to the storage account. So I go here,

[3:37:54] assignment and I provide whatever role is required like reading. So if if it requires a reader role, I select reader role and then I select manage identity. I select that object ID that that got created. So this is the user assigned

[3:38:07] manage identity that we have. This is the one that we assigned to OpenVPN 2. Click on select. Now OpenVPN 2. Once I click on review and assign, OpenVPN 2 will have access to the storage. And when application request the access,

[3:38:20] this object ID, this manage identity will be used for authentication and authorization. Hopefully, it's cleared now. Clear for you. You just need to remember if you want the manage if you want the access

[3:38:35] for if your application wants the access to the back end and if your application is hosted on Azure you can use manage identity. Okay, is it clear hurry? Yeah, it's similar to service account but it's not service

[3:38:49] account. Service account is a windows based uh solution. Okay, to the similar thing, right? That's a similar similar concept.

[3:39:08] manage identity the limitation is you can only use when it's if if when your application is hosted on Azure. If your application is hosted outside Azure then you cannot use manage identity. If my application is hosted on AWS or onprem

[3:39:27] application is hosted on AWS or onprem or uh GCP not in Azure any anywhere not the solution for you. Why? Because managed identity as the name specifies managed identity as the name specifies it's managed within Azure for you. Okay.

[3:39:41] In that case if your application is hosted outside Azure you cannot use So we can use something known as service principle. Service principle similar principle. Service principle similar concept the only difference is your

[3:39:56] application is hosted outside Azure. So if your application is hosted outside Azure you cannot use manage identity. You need to use service principle. Okay concept is similar application requires an access to backend services

[3:40:11] like storage account and SQL. Your back end is still within Azure. You are using Azure storage service. you're using DB SQL DB in Azure but your application itself the front end is hosted somewhere else for any reason. So if that's the

[3:40:28] principle. Okay. In this case I'll be using service principle. Service principle will also create an object ID within that entra uh create an object ID within that entra uh ID and then you can use that object ID

[3:40:42] to assign whatever access is required. The only difference between manage identity and service principle is in case your application is hosted outside Azure you will be using service principle. Where do you see service

[3:40:55] principle. Where do you see service principle? Same. If you go to enterra ID there you have app registration. Okay. So you register your application Okay. So you register your application here. Uh this name can be anything.

[3:41:12] random name. All right. And then once I click on register, an object will be created. So you see object ID see an object got created for this as well. Now I can use the same object to assign whatever access I want. Okay. So I can

[3:41:27] go again go back to the storage. I can click on uh access control IM. I can click on add add role assignment. Now instead of manage identity I'll select here service principle. Okay. You see the first option it says user group or

[3:41:43] service principle. So I I I use the first option and then I search for the name that I use dubdubdub.simplylearn.com. So now this object ID will have access the reader access to whatever service

[3:41:56] the reader access to whatever service I'm providing. Okay. All right. I don't need it. So I'll I'll delete it or maybe later I'll delete it. Let's let's proceed. Okay. All right. The next thing then

[3:42:10] last topic that we have for today not for today I mean this topic is this for today I mean this topic is this module is Azure key wault. So Azure key module is Azure key wault. So Azure key wault is a is a service is a storage

[3:42:22] wault is a is a service is a storage service for storing your secrets keys and certificates. Okay what are the secrets keys and certificate? Secrets are like password. So if you want to store password or config uh

[3:42:38] want to store password or config uh connection strings or keys uh within as your key somewhere then you can make use of Azure key wault. So it helps you to store password secretly. It helps you to store keys secretly. It helps you to

[3:42:55] store certificates secretly. Now why do we need to keep secret keys and certificate within Azure keyword? Why? Why can't we keep it within the application itself? What could be the reason? Now, in order to explain that, I

[3:43:10] reason? Now, in order to explain that, I need to go to my uh GitHub. Okay,

[3:43:25] [snorts] If I go over here, first of all, answer me. Do you guys know what GitHub is? Since we have like 40 50% of people who are freshers, do you know what GitHub is? [snorts]

[3:43:44] GitHub as a central place where your developers will be pushing code. Code is nothing but your application code. Okay, it's a repository or a place where your developers will be pushing the

[3:44:00] code. So when you push the code, that code is your application code. All code is your application code. All right. So if you see here, this is my uh right. So if you see here, this is my uh GitHub and if I go to uh the application

[3:44:15] and if I go to the application app. py you see here in my code itself I have placed the connection string storage connection string now we are going to use this application uh letter when we are on on this particular topic okay but

[3:44:31] for for simplicity just to help you understand what keywalt is and where you understand what keywalt is and where you use keywalt storage uh uh uh GitHub is a so this is one of my application written in Python [snorts] now this application

[3:44:46] needs needs to interact with Azure storage account. How do I account? So, one way is to keep the storage connection string here. Connection string is a way uh is an is a is like a password for your application

[3:45:03] to access whatever you have within the storage. So, if I provide the connection string over here, then my application app. py can access storage account directly. Okay, you don't need manage identity.

[3:45:18] You don't need service principle. If you keep connection string directly here, you can access directly. Doesn't matter where your application is hosted. So, the storage account. Okay. Similarly, there are lot of

[3:45:33] services like service bus, event hub. Now, tell me is it safe to keep the connection string within the code and push it to the GitHub? Is it is it safe if I just give you this link? Try accessing this link. Can you

[3:45:49] see can you uh see the link? Let me just provide you the link. You don't need to login nothing. Just just launch that link. [snorts]

[3:46:05] this link, I'm not logging with any any credential or anything. But I can see whatever whatever we have here. So if I put connection string over here and if this link uh since this is public anyone can access like you guys are accessing.

[3:46:20] So if I keep my connection string over here you know my connection string then so if you know my connection string what you can do you can add anything to my storage account remove anything from my storage account

[3:46:34] delete my storage account. So is this safe? Keeping storage connection string here. Is this safe? Are you going to ask your developer to push the secrets directly within the GitHub? Obviously, it's not safe,

[3:46:50] right? So, what we do, we store or save this connection string in Azure keyword this connection string in Azure keyword as a secret. So, Azure key is a way to to keep your connection string your password as a secret within Azure key.

[3:47:07] password as a secret within Azure key. So now instead of accessing the storage account directly, I have another application over here.

[3:47:22] Who is the application? Oh, I didn't push the application I think. another application here. Program.json here. If you see this application is not

[3:47:38] C car C car C car C car C car C sharp. Okay. Now here if you see we are not adding the connection string. If you know how uh how C# works or hownet works

[3:47:52] it's very simple. Okay. What it is doing it is connecting to the key. It is Within storage account you might be having some container. So it's connecting to that container and then it is getting the secret

[3:48:07] is getting the secret from the Azure key vault. Okay, we are from the Azure key vault. Okay, we are not adding the the key directly here in the code itself. Do you see connection string here or or

[3:48:21] uh uh secret here or or or a key here? What we are doing? We are declaring a variable. that variable is reading the secret value from the Azure keyword.

[3:48:37] So instead of keeping everything within the uh code itself, we separate it, we secure it by putting all of our keys, secrets and certificates within as your keyword. All right. Any questions on keyword?

[3:49:01] not not today uh tomorrow during your free time just go to this uh repository go to day one authentication and authorization

[3:49:13] authorization and within day one I have readme file and within day one I have readme file inside the day one folder I have readme file just follow whatever is mentioned here everything is given to you step by

[3:49:25] step even application is created Okay, just follow this step by step and you'll understand where your your key how how key volt key wault works. Okay,

[3:49:38] demonstration that you can do on your own. You don't need me. Okay, but I I have created this uh I have developed this application. It's a very simple application which is demonstrating you how

[3:49:53] how uh you can interact how your application can interact with Azure keyword. Okay. Uh if you see we have the templates here parameter.json template.json. So how to deploy that is mentioned in the readme

[3:50:08] file. If you have done easy 104 you should know you should already know that. If you don't know the command is given over here deploy infrastructure. Okay. Then assign permission. So you you you can assign permission by going to

[3:50:22] this. All right. And then uh you can this. All right. And then uh you can also see the keys by by this command a storage account keys list. Now where to run this command? That's why it was

[3:50:34] important to give the tour of Microsoft as your portal. You can run all this command here. You don't need to install anything on your machine. Okay? You choose bash or powershell whatever you want. Select that bash or powershell and

[3:50:48] run your command. Now this here I don't have the subscript. Uh here I don't have the subscription that why it gave me that error. Okay. Select whatever you command. Do not run it on your local machine since it's possible you might

[3:51:02] machine since it's possible you might not have uh things installed in your local machine. So it's better to run directly within the cloud shell. All directly within the cloud shell. All right. And you might uh get some issues.

[3:51:15] You might uh get some issues like something is not installed. Right? If you if you go to the readme file, you should see none not this one. A lot of tabs are open. Let me close

[3:51:31] Let me close it up. If you go to this readme file, uh I have mentioned net run. So net run is something which helps to run the application locally. But you don't need to do this since net run might not run

[3:51:45] to do this since net run might not run directly on your cloud shell. So you can skip step number six. You can follow step number seven. Okay, this is for local. So if you have net installed locally in your machine, then only this

[3:51:57] this particular command will run. All right, so that's all about authentication and authorization. Keys are changed frequently. That's correct. You have to change keys every now and then. That's why you need to

[3:52:10] keys are changing, you need to go to the key wault and change the key manually. Okay? Or you can use PowerShell or Python scripts to change the key as soon as you are changing [snorts] it in your storage account or database or wherever.

[3:52:26] Okay. [snorts] All right. So there are no questions. All right. So there are no questions. Let's see the case study.

[3:52:42] authentication and authorization solution. So just go to this link read solution. So just go to this link read the case study. certificate expiry? What what do you mean by manage? If certificate is

[3:52:59] expired, you replace the certificate in the keyword. That's all. What what what's there to manage? I need to buy the certificate first. Right? If uh if my HTTPS SSL certificate is expiring, I need to get a new one from

[3:53:14] the provider and I need to add it to the keyword. That's all the new one. keyword. That's all the new one. [snorts]

[3:53:26] going to do? They're going to buy a new one and then they install on their web server the new one. That's all. Similarly, if you're keeping your certificates in key volt if certificates are expiring, you need to remove the old

[3:53:40] are expiring, you need to remove the old certificate, add new certificates. Key volt is not giving you some kind of automation where you can automatically

[3:53:56] the certificates. For that, you still need to rely on your your script. So your PowerShell scripts or Python scripts or whatever scripting language using it's just a place it's just a storage

[3:54:10] service to keep your things secretly instead of keeping everything on on the code itself you're keeping it in in in keyword that's all. Okay. [snorts] All

[3:54:23] keyword that's all. Okay. [snorts] All right guys, so uh data. It does not have any additional way to remind you or send you an email

[3:54:40] about the expiry. No, it won't do that. For that you still need to rely on monitoring system or your scripts. Okay. So if you have a PowerShell knowledge you can create a PowerShell script which will which will check the expiry date of

[3:54:54] all the assets of all the secrets or all all the keys that you have here. You can run that PowerShell script and that PowerShell script will send an email or however you want to notify uh will notify the stakeholders that

[3:55:10] this certificate is going to expire or or or things like that. For that you still need to rely on something. Okay, it's just the storage service that's all. [snorts]

[3:55:26] All right guys, case study. Let's come back to the case study. So I have shared the link of case study. So let's uh get through it. Design authentication and authorization solution. So this is the requirement. So we have a fictitious uh

[3:55:40] company Tailwind traders who wants to expand their workforce. They have successfully acquired an online retailer in sports apparel space. The company has also located a partner to outsource marketing literature. Tailwind traders

[3:55:55] is using Enra ID for user and groups accounts. Here are two specific initiatives the IT department would like to would like your help uh with. So you they are having new user accounts. The [snorts] online retailer acquisition

[3:56:11] will add 75 employees to the Tailwind traders. All the new users have on-prem account in the retailer's existing domain. Okay. So, what do you understand by this? What service are you going to use? The online retailer acquisition.

[3:56:26] That means Tailwind Traders uh is acquiring online retailer and they already have active directory domain services. The online retailer already have active directory domain services and 75 user accounts there.

[3:56:41] So how are you going to bring that 75 users to Microsoft entry ID? What service you can use? Entra ID connect. That's correct. So here I'll be using That's correct. So here I'll be using entry ID connect and I'll be bringing

[3:56:53] those or synchronizing those 75 users with my entra ID. All right. The new marketing partners. So they're all they're also uh

[3:57:06] acquiring the marketing partner. So the new marketing partner will initially have 15 employees who will need corporate access. So these employees already have Microsoft Entra identities in the partner Microsoft Entra tenant.

[3:57:21] So what service or feature we can use? So it's like you have two tenants marketing partner and your own tenant Tailwind traders. So here we can use B2B

[3:57:33] since these are our partner and we want to uh collaborate with them right so we just use B2B here then the new employees are located at various geographic location and we'll need account privileges for their new

[3:57:47] job roles some changes to the existing employees roles are expected geographic locations [snorts] what what do you think over here what

[3:57:59] services you can use conditional access and identity protection. Right? These two services we can use here to make sure that whatever identities are are logging in [snorts] uh are protected. Right? So conditional

[3:58:15] access we can define only those geographic locations from where the access is required. Okay. The IT department wants to take this opportunity to include new identity security features. So whatever features

[3:58:28] we have learned conditional access, identity protection, access reviews, you can implement all those stuff. They haven't mentioned which one to use or haven't defined which one to use. They have mentioned all the new features. So

[3:58:43] have mentioned all the new features. So you can implement all. Okay. Then the next thing is new application access. So application also requires some kind of access. So the business development team has an application running on Azure

[3:58:55] virtual machine and [snorts] data stored in Azure SQL database. They need to securely allow the VM to query the Azure SQL database. How how you can achieve SQL database. How how you can achieve that? [snorts]

[3:59:13] hosted on Azure VM database is stored in Azure SQL database. Now this VM should be securely able to query the SQL database. So what we can use we can assign manage identity to this Azure VM and provide access to the Azure SQL

[3:59:27] database. Then whenever query is running the Azure SQL database will identify the you using the manage identity and if access is granted or not. Okay. So here we can use manage identity. They also need an on-prem server to be able to

[3:59:44] securely access SQL database without storing credentials in the application code or configuration file. It's an on-prem server. Here you can use service on-prem server. Here you can use service principle and you can use Azure keyword

[3:59:59] principle and you can use Azure keyword to store the SQL database uh connection string within Azure keyword and then on-prem server can access SQL database by reading the credentials from Azure keyword. So here we need to use service

[4:00:12] keyword. So here we need to use service principle plus Azure keyword. All right. the server where application is hosted is on prem. It's not on Azure. If the server would have been on would have

[4:00:24] been on in Azure, it would have been easy. Just simply use Azure. All right. Then these are the tasks. So we have already covered whatever uh we need to discuss. But these are the task

[4:00:37] for you guys. So you need to diagram the process. Okay. Like what you need to process. Okay. Like what you need to diagram use the same tool that I'm using draw io. If you just search for draw io, it

[4:00:51] should uh take you to the draw io website. So this is the tool that I'm website. So this is the tool that I'm using. All right. Now here uh we have using. All right. Now here uh we have the shapes. So

[4:01:04] if you add more shapes, we have azure here somewhere. We should see azure. All right. Now you need to diagram the diagram whatever you want to diagram the process of bringing in the acquired user accounts. 75 user accounts were

[4:01:20] acquired. Okay. So what I do here then I go to Azure identity. So this is Azure identity. Here you should see active directory. Now uh Microsoft enter ID directory. Now uh Microsoft enter ID icon is still not there. So you can use

[4:01:35] active directory. This one this is like a Microsoft enter. previous name was Azure Active Directory, right? We can add a text here if I want to add a text. I can add text like this is the Tailwind traders

[4:01:55] font and all from here. So just so that uh you can read it

[4:02:08] Telvin traders tenant. They're acquiring 75 uh users. So they are running on ads. So you can search for ads here or domain you can search for ads here or domain services. So it would give you uh

[4:02:23] services. So it would give you uh some server image. the on-prem active directory domain services for the online retailer. Right?

[4:02:37] services for the online retailer. Right? So you can just label it.

[4:02:53] what you what you can do here? You can simply use arrows and all. So I just use uh arrows here. I uh pull the arrow and then I search for

[4:03:06] entra connect. So somewhere you should see the entra ID connect. Again within the identity you should see the entra ID connect. Okay. So this is entra ID connect. So I keep it over here. And then again I label it

[4:03:20] it over here. And then again I label it 75 users by keeping text a little low. are synchronized something like that. Okay. So you need to come up with this

[4:03:35] this kind of uh uh design and this is what Microsoft expects you guys to to do to design things. Okay. We can't do that uh within class. Okay. Since I need to

[4:03:47] cover the theory and then uh certain demos. So case study is something I leave. We will discuss the case study but this design thing is on you. All app.dagramgrams.net

[4:04:02] add Azure as a shape and you'll get all the Azure shapes. Okay. Then you have marketing retailer. So you can uh what is mentioned about that marketing retail marketing partner. So they're

[4:04:16] also using Azure active directory or Microsoft enter ID. So you can copy the same and you can label is at marketing partner and between the partner and partner and between the partner and Tailwind traders. What you can do is

[4:04:33] Tailwind traders you can create like an arrow and you can use as your active directory B2B. If you search for B2B if we have any B2B uh icon you can directly use that but I don't think so we have B2B icon.

[4:04:50] Okay, B2C is there. B2B is not there. So, you cannot use any uh item. But you can simply add a label there. B2B 15 members. Okay. So, I want something like this. Once you are done, you can share it with me

[4:05:06] over my email. So, I'm sharing my email ID here. Okay? And then I'll review and give you the reply over the email. [snorts] Clear guys? Is it uh are you clear how to do the case study? We have only

[4:05:23] authorization. I was planning to complete the governance as well but uh doesn't matter since since this is the first weekend.

[4:05:39] uh we need to buckle up and and speed up the the things here. >> So this is the link surach.

[4:06:01] identity >> and you go to the VM option. Okay. where >> and you go to the VM option. Okay. where you created the object ID first first option and after that you go to the manage identity where you created the

[4:06:17] another object ID. >> Okay. >> Yeah. I'm unable to correlate that because in the when you open VM uh open VM uh BPN02 you created an object ID and after that

[4:06:33] you go to the MA identity and also you created the an object ID and go to you created the an object ID and go to you go to the storage and you manage the uh attach the object ID >> from the manage identity. I'm unable to

[4:06:47] understand that. Have you understood the concept of manage identity? identity. >> Okay. Can can you answer what manage identity is? >> Manage identity is the ID which is

[4:07:01] generated to authenticate between the two resources to talk and exchange the >> Okay. Right. How many types of manage identity we have? System assigned and user assigned. >> Correct. Okay. What is the difference?

[4:07:17] System assign is based on the single single type user and user assign is based on the multiple type users. Correct. Suppose we have some >> Okay. Uh system assigned is like for

[4:07:32] single resource. Okay. >> Yes. Yes. It's an individual identity. >> Yes. Yes. It's an individual identity. So if I create system assign uh this VM will get an object ID and that object ID will belong to this VM only single

[4:07:47] individual. Okay. When I create user aside manage identity I can share that manage identity across multiple VMs. So I have 10 VMs. All those 10 VMs requires the same access. So what I can do instead of creating individual identity

[4:08:04] I create one user assigned manage identity and assign them to all. >> Okay. For individual system assigned manage identity. You can create it from the v uh from the resource itself. That mean I can go to virtual machine. I can

[4:08:19] go to identity and then I can create the system assign manage identity. If I click on on here and see if system assign manage identity will be created which is which will be associated with openVPN02 only.

[4:08:35] >> Okay. If I want to create the user assigned manage identity I cannot create it from within the resource itself. I cannot create user assigned from here. So what I need to do I need to search for manage identities.

[4:08:50] I need to go there. I need to create a new one. Here I'm creating user assigned manage identity and then I can use that user assigned manage identity to user assigned manage identity to associate to as many VMs as I want.

[4:09:05] >> So when I when I switched when I >> yeah that's the difference. So you in identity you need to create it like this. In order to create system assign resource itself. >> Okay. Now it's clear sir. Okay. All

[4:09:22] right. >> Thank you. are no uh questions, let's proceed with the next uh topic. We'll just cover the

[4:09:39] basics since it's already 10:34. All right. Those who are leaving, I see people are leaving. Uh I see participants only 50. Before leaving, please make sure you're providing the feedback. All right. Now we are moving

[4:09:51] feedback. All right. Now we are moving on to the second part of authentication and authorization. Moving to the second part of AM. All right, identity and access management. So far whatever we have discussed was related to identity.

[4:10:06] That means we were creating users, we were managing users, we were modifying users, we were creating identity for applications like manage identity or service principle. So we were just creating identity. we were not assigning

[4:10:20] any role or we don't know which role to assign right we don't know how to manage or how to assign access to the users or resources so that's something which we resources so that's something which we will cover in the governance topic

[4:10:35] what res what role we can assign which role is powerful which role is not powerful what is reader role what is owner role so all those stuff we will be covering in this topic okay so far whatever we have discussed is related to

[4:10:49] related with the identities creation or management only. [snorts] We haven't management only. [snorts] We haven't assigned any access to any user yet. We created one user, right? We invited one user in our identity in our Microsoft

[4:11:03] Enra ID. We ass we we invited this rootcloud a user. Remember at the start of the uh session today, we invited this user. But we haven't assigned any role to this user. So when I log in with this user, this user cannot do anything.

[4:11:19] So in order for this user to do something we need to assign a role. So which role we can assign that's what we will be discussing in this topic of governance. Okay. [snorts] So what is governance?

[4:11:33] Governance is a way to come up with with certain control over your your system or over over your uh uh uh infra you can say or platform you can say in general term what is governance

[4:11:49] you we live in India let's say and in India we have certain policies certain rules right certain laws that we have to abide so every country uh will have

[4:12:01] their own governance policies, their own own laws, right? So similarly, every companies or organization will have their own governance mechanism or own own policies. So governance is just a way

[4:12:17] which provides a mechanism and process to maintain the access control over your resources, over your applications, over your users in Azure.

[4:12:29] So how to maintain the control that's what this topic is about. Okay. All right. So you have a user that user requires an access. So for

[4:12:41] authentication we are using IM. Now after authentication what this user can do can this user access the virtual machines? Can this user access the SQL machines? Can this user access the SQL database? Can this user delete the uh

[4:12:55] delete the SQL database? So what he or she can do that's what we are defining she can do that's what we are defining using governance. All right. So what is governance in general? Is that clear?

[4:13:23] correct like is manage identity just to secure authentication of resources or to provide connectivity manage identity does not provide the connectivity that is something network used uh network should be doing okay manage identity

[4:13:38] does not provide the connectivity it does not connect your virtual machine to the storage account. The connectivity is a network part. So have fourth chapter where we'll be

[4:13:50] discussing network. [snorts] Okay. So manage identity is just for discussed so far is related to authentication. All right. So what is governance? Governance is just uh a mechanism where

[4:14:04] you can define certain policies. You can define access control which user or which application can access what right now how to achieve that in Azure that's what we are we are going to discuss in this chapter now this thing hierarchy is

[4:14:19] important to understand when it comes to Azure okay so Azure has this hierarchy now what is this hierarchy this hierarchy is nothing but a scope where you can

[4:14:34] where you can define the Access control. All right. Hierarchy is nothing but the scope, the level where you can define the access control or you can define the policy or you can define the uh tagging.

[4:14:50] hierarchy. What is this hierarchy? At the top of the hierarchy you have a management group, tenant root management group. Then within that tenant root management group you have you can keep different

[4:15:04] management group. Then management group is like a container logical container where you can keep your subscriptions. Subscription again is a is a billing

[4:15:17] boundary. Okay. So using the subscription Azure will will charge you subscription within subscription after the subscription the scope that we have the level that we have is resource groups. So resource group is again a

[4:15:32] logical container where you can keep your actual resources. Okay. So this is the hierarchy. Now I'm not explaining each in detail because if you see we have a separate slide for that. All right. For now for this slide

[4:15:46] is the hierarchy? At top of the hierarchy, we have the first group which is the default group. So even if you're not creating the management group, Azure will create one for you by default and that group is

[4:16:01] known as tenant root group. Now what is a management group? Management group is a management group? Management group is a way to manage your subscriptions. So within your management group, you can keep your as many subscriptions as you

[4:16:13] want. What is a subscription? It's a billing boundary. For now you just remember it's a billing boundary. Then within the subscription you will be creating resource groups. So resource group is a way to keep uh in Azure it's

[4:16:27] mandatory to create resource group. Without creating resource group you cannot keep your resources. So resource group is a way to organize your resources. Now tell me when you buy a laptop

[4:16:39] [snorts] within the laptop we have certain components right? We have uh LAN You know what LAN card is? The network interface card where you connect your interface card where you connect your LAN cable, right? Then we have hard

[4:16:53] disk. Nowadays we have solid state drive. We have processor. Right? So a lot of things you when you buy a laptop lot of components you get obviously you you don't see it but uh

[4:17:07] those components are there within the laptop. Similarly [snorts] when I create a virtual machine so it's not a physical machine it's a virtual machine. you can't touch it. So in Azure when you want to create a server you

[4:17:19] create a virtual machine with the virtual machine you get the virtual disk a disk get created [snorts] a virtual nick gets created network interface card nick gets created network interface card the LAN card okay if you have assigned

[4:17:34] IP address so public IP gets created so all these stuff get created with the virtual machine itself. So where if if you scattered this in different different groups it will be very hard for you to come up with an inventory and

[4:17:48] whenever Azure is creating whenever we all these resources in one resource group. So that within that resource group you can see all of your resources. If I show

[4:18:01] you the resource group in action if I go to the resource group any resource group where I have my VM. This is one of the resource group that I This is one of the resource group that I have. And if you see my Windows 11 VM

[4:18:15] has the disk, has the public IP, has the virtual link. So whenever I create a VM, all this gets created with the VM So if you see the resource type over here on on on second row, if you see the

[4:18:30] resource type, it's a virtual machine, it's a disk, it's a public IP, it's a network interface. So when we create a virtual machine everything gets created. So you can keep them in same resource group. So we'll keep them in the same

[4:18:44] them in the same resource group? Because these resource are related resources. So [snorts] what I can do I can create multiple resource groups like prod resource group, dev resource group, UAT resource group and keep all the

[4:18:59] resources belonging to that particular environment in each resource group. So it will be easier for me to manage. Okay. So resource group is one of the uh

[4:19:12] Okay. So resource group is one of the uh uh level in the hierarchy in Azure. The act the main way is it's it's it's a logical container where you contain which contains your resources. That's all. Subscription is a billing boundary.

[4:19:26] Without subscription, you cannot create or or deploy resources in Azure. Okay. And then the root the management group is a way to organize your subscriptions. So it's it's [snorts] bound to happen that you will be having

[4:19:41] more than one subscription within your tenant. Why? because every subscription tenant. Why? because every subscription comes up with certain limits. might be limit that I can deploy only 25,000 VMs. So if I need more than

[4:19:56] 25,000 VMs, what do I do? So I I buy is a subscription? It's a billing boundary in Netflix. When you sign up for Netflix, you need to subscribe to their plan, right? without subscribing

[4:20:11] to their plan. Will you be able to watch any movie or any any web series? No. Right? We need to subscribe. So similarly in Azure we have subscription. If you do not have subscription, you cannot deploy the

[4:20:25] resource. Okay. Let me give you the demonstration Okay. Let me give you the demonstration very quickly here. So if I go here and I have logged in with this user. If you see the uh name simply learn at whatever

[4:20:38] the domain name is. If I search for virtual machine I am landed to this page and I have the option to create and I can click on create virtual machine and I'm landed to the create virtual machine page. Once I

[4:20:51] provide all these detail virtual machine will be created. will be created. Okay. But if I log in with another user

[4:21:05] I the user that we invited, if I log in with that user,

[4:21:27] I login with this user which we invited at the start of the uh

[4:21:55] Okay. So, I've logged in with root cloud a guest user that we invited.

[4:22:19] in [snorts] if I search for virtual machine

[4:22:35] let's see what it is saying can I create a virtual machine when I when I search virtual machine from another user from this user I'm landed to this page where I have the option to create. I can click on create and I can click on

[4:22:49] going to the create virtual machine page. But when I log in with root cloud a I don't even have that create option here. Why I don't have because this user root cloud a doesn't have any subscription.

[4:23:04] So in Azure when you want to deploy resources you need subscription. Without subscription you cannot deploy resources. So this user doesn't have any subscription that's why he cannot deploy the resources.

[4:23:17] The other user has the subscriptions. If I switch back to the browser to a different browser and search for subscription here I have the subscription here I have the subscription.

[4:23:31] have the access to the subscription I can deploy resources. If I don't have the subscription I cannot deploy the resources. Okay. So in Azure subscription is a way for Azure to bill you. It's like a billing boundary.

[4:23:46] Clear? Any question guys? Resources are the actual resources where your where your workload will be running. Resource group is like a container where your resources will be.

[4:24:00] Subscription is like a billing boundary. So if you do not have subscription, you cannot create or deploy resources in Azure. Management group is a way to can keep the subscriptions within the management group. All right. So, let me

[4:24:15] another account since that account doesn't have access. Let me switch to doesn't have access. Let me switch to the

[4:24:29] management group, I should be seeing all the management group that I have within the management group that I have within my tenant. management group that I have. So if you see the first management group that we

[4:24:45] have is tenant root group. This is by default. This is created by Azure Microsoft Microsoft Azure. As soon as you sign up for Microsoft Azure, you'll see tenant root group. Okay.

[4:25:06] you can create as many management group as you want like I have created MG01 MG00003 and within this management group you can keep your subscription right now both of my subscriptions are within tenant root

[4:25:19] group if you see the hierarchy hierarchy is like this you have top management is like this you have top management group then you can create MG00003 group then you can create MG00003 MG00002 MG00001 whatever Right. And

[4:25:33] MG00002 MG00001 whatever Right. And between the management group, you can uh want to move pay as you go to another management group, I can move it. I can select which management group I want to move. MG00001, MG00002, MG00003.

[4:25:50] Okay. I can select that and click on save. Once I click on save, pay as you go dev test will go to whichever management group I selected. Okay. [snorts] So if you see now if you refresh everything is okay. You don't

[4:26:03] receive any error. You should see your subscription within MG00003. All right. [snorts] So if I expand MG00003 now pay as you go

[4:26:15] is within MG00003. Okay. So you have tenant root group then you will be having as many management group as you want and then you'll be having your subscriptions. Okay. A question may arise like I see

[4:26:29] need so many management group? What is a management group? Management group is as the name specified is used to manage something. Right? As when I started the

[4:26:42] governance topic why do we need governance to put certain policies to put certain control right now in Azure we have this hierarchy. So in the at the top of the hierarchy you have tenant root group. So if I assign any access

[4:26:56] here to any user, let's say this is the user, I assign a full access to this user at tenant root group, this user will have full access over the entire hierarchy. If I assign this user full access at

[4:27:14] subscription number one, [clears throat] then this user will have full access only at the resources which is within subscription one. He won't be able to

[4:27:26] access the resources at subscription two. But if I assign full access at the tenant root group, he will have full access over whatever subscription you have within the tenant root group. Let me explain it from here from the portal

[4:27:39] itself. If anyone is having whatever access at tenant root group that access will be inherited downwards. So if I have let's

[4:27:51] say this user Imran [email protected] has complete access over tenant root group then that user will have complete access over azure training subscription complete access over mg003 complete access over pay as you go complete

[4:28:06] access over mg01 but if I change my access from tenant but if I change my access from tenant root group to only MG01 root group to only MG01 so whatever I have inside MG01 I can I

[4:28:18] will only be able to manage those resources which I have within MG01. So in this particular scenario, there's no subscription within MG01. So if there's no subscription, I won't be able to deploy resources. Why? Because I

[4:28:32] don't have access here on on the top hierarchy. I only have access here at MG01. So why do we need so many management group is to control the access. You have dev, you have test, you have UAT

[4:28:46] environment, you have QA, you have staging environment. You'll be having multiple environments. So to divide the access, you can create as many management group as you want and you keep your resources there.

[4:29:00] management group, that is also fine. Totally up to you. How do you want to come up with your own hierarchy? It's not mandatory to have multiple not mandatory to have multiple management group. only if you have uh

[4:29:13] number of subscription then management group makes sense. If you have only one subscription then having multiple management group does not make sense. All right. So and if you are working from enterprise a large scale

[4:29:27] organization you are going to have lots of subscription. In my previous company we used to have one subscription per client. So imagine we had thousand subscriptions. So how to divide how to manage the access control within the

[4:29:41] thousand subscriptions? Are you going to provide access to all of your users at each subscription? If I create a new subscription uh and my team is is having access over this subscription. And if I create a new

[4:29:56] subscription, assign the access. Then if I create another subscription, I need to subscription, I need to assign an access. Imagine how much time you'll be wasting just for assigning the access. So what is the better way? Create a

[4:30:11] management group, put your subscriptions there and assign access at the management group level. So whatever access you have at the management group subscriptions within that management group level, that access will be

[4:30:24] inherited. Okay, clear. Let's proceed with our topic governance. Before that I'll just give do a 5 minutes or 10 minutes of quick recap what we have covered so far. Okay. Uh

[4:30:41] so what we have covered so far we started with basics of cloud computing is. Why do we need cloud computing in today's world and then we moved on to today's world and then we moved on to our first topic of a305 which was AM. IM

[4:30:55] stands for identity and access management where we discussed about if we need a service if we want to implement AM in our organization or our projects then if do we have any service in Azure. So we have Microsoft Entra ID

[4:31:10] as the service in Azure which helps you to manage or implement AM in your own organization. Now Microsoft Enra ID comes with two different flavors B2B and B2C. B2B stands for businessto

[4:31:25] business. So if you have a partner company or any other collaborators who want to collaborate with your company and they want to build something for your company or you have hired someone to build but it's it's a it's generally

[4:31:38] a contractor let's say not a permanent employee of your company and you you don't want to create account for them. So B2B is something that you can make use of as long as the collaborator has a valid email address. You can invite them

[4:31:51] directly to your tenant to your directory to your Microsoft tender ID and then you can give them whatever access is required to accomplish their role or their job. Then another flavor of Microsoft enter ID is B2C. B2C stands

[4:32:08] for business to consumer. So when you have an application let's say this is your company's application and this application is open for your let's say application is open for your let's say end users or maybe your employees and

[4:32:21] you want to manage a separate authentication module for this application. So in this scenario you can make use of B2C business to customers business to client. Okay. Then we saw a few premium features in Microsoft Entra

[4:32:36] ID like uh uh conditional access on the basis of certain conditions you'll provide access or you'll throw a multiffactor authentication challenge. Uh conditions can be anything like uh uh traffic is coming from a certain IP

[4:32:50] deny that traffic you'll define everything in that conditional access policy. If you allow the access will be granted if you deny the access will be denied. If you ask for multiffactor authentication, a pop-up will be sent to

[4:33:04] their authenticator. After conditional access policies, we went to identity protection. So in identity protection, you have like three different policies that you can set up. Uh you have user risk policy, you have

[4:33:17] signin risk policy and you have multiffactor authentication registration policy. User risk policy if user is at risk, signin risk policy. If the if the sign in method that that have been opted is

[4:33:31] detected as anonymous or risky. So all those things Microsoft threat intelligence works behind the scenes and uh learns the pattern of user behavior like when what that what what time user logs in which device user uses. If any

[4:33:47] of this pattern changes then uh it could be uh assumed by my by identity protection that it's a risk and whenever that risk is detected depending on your policy whether you have blocked it whether you

[4:34:02] have th whether you have asked for user to uh to prove the identity prove the authentication using multiffactor. So that will be triggered. So depend on how

[4:34:14] you have what you have configured in your policy that action will be taken by identity protection. When it comes to identity protection you don't do much as a user as a administrator I don't do much I just define whether I want to

[4:34:27] allow I want to throw a multiffactor authentication or I want to deny the access that's all. So those are the three uh radio buttons that one of the radio buttons I have to select. After IDP we went on to access reviews before

[4:34:41] IDP we went on to access reviews before starting of this uh demo. U pankage asked for that and and I have explained it right. So what is access review in simple access review is just a way to review as the name specifies to review

[4:34:55] the accesses that you have given to your your users. Right? So whenever user and then that group will be having access to certain resources and then after every 3 months 6 month depending on whatever policy you have with your uh

[4:35:12] security team you will be running that access reviews and then the manager of that group or whoever is the reviewer of that group will decide whether the user will have a continued access or uh the access will be revoked for that user for

[4:35:25] those particular resources. Then after access review review we moved on to two types of identities that is required for that we can use for application like manage identity and service principle. When an application

[4:35:41] requires an access to the backend resources like storage, SQL whatever. So you create a manage identity for that application. Manage identity is something that you can use and assign it. It creates an object ID. Object ID

[4:35:55] is nothing but the way how Microsoft Endra ID recognizes or verifies a particular object or particular identity. So that object ID is it uh gets assigned to that resource where your application is hosted and then you

[4:36:10] can use that object ID to assign access to whatever resources you want. But manage identity the limitation of manage identity is if your application is hosted on Azure then only you'll be able to use manage identity. If application

[4:36:24] is hosted outside Azure then obviously manage identity is not the option for you. So what you can do then you can make use of service principle. Concept is same the only difference is in service principle the application is

[4:36:36] hosted outside Azure. It might be hosted on prem might be hosted in some other cloud provider but they need access to Azure resources. So in that case we can make use of service principle. Then

[4:36:50] we saw one uh resource in Azure which is Azure keyword. So Azure keyword is a storage service uh which we use to store a secret. Secrets can be passwords or can be connection strings. We can generate

[4:37:05] or or import the keys the cryptographic keys in Azure keyword and we can also make use of certificates. So we can keep key certificates and secret in Azure keyword so that our application can securely access the secrets or the

[4:37:20] passwords or the connection strings directly from your keyword. It's not a directly from your keyword. It's not a good idea to store the password secrets good idea to store the password secrets uh connection strings or uh access keys

[4:37:32] directly on the application code. It's not a good idea. That's why you can move that to a separate uh vault and from there your application can read it. All right. So that's what we have seen so far. After that we moved on to the next

[4:37:46] topic which is governance. So what is the governance? Governance is nothing but a set of processes, policies, access control that you can policies, access control that you can apply on within your organization,

[4:37:58] right? And within that governance topic we saw the hierarchy. So this is important to understand from Azure point of view. We have a hierarchy. Azure hierarchy. Why this hierarchy is created? So that you can manage access

[4:38:13] created? So that you can manage access policies, access control policies at any of the scope that is visible for your company, for your organization depending on the requirement of your organization. Now what is this hierarchy? In this

[4:38:27] hierarchy, you have five different scopes, five different levels. Okay. Now if you see, I've only mentioned four. 1 2 3 four. But in actual you have five, right? So what is that fifth level? The first uh the first scope in the

[4:38:41] hierarchy is the tenant root group which is present by default. When you sign up root group even when you don't create it. So tenant root group is the top is the stop in the hierarchy. Within that tenant root group, you can

[4:38:57] want. Okay. So tenant root group is also a management group. Then within that tenant root group, you can create as what is this management group? Let's see that. So management group is is is a

[4:39:12] scope is a level in hierarchy where where you can organize your subscriptions. So here I can organize if I have multi it's bound to happen. You'll be working with multiple subscriptions within your organization.

[4:39:26] Why? So if you have done easy 104 you might know that every subscription has its own limit. I cannot use Azure subscription limitless. That means I cannot go and use one subscription and deploy like the like millions of virtual

[4:39:39] machines. There will be limit. Okay. So, Azure has limit to two uh subscriptions. subscription you are using. Every subscription will have limit.

[4:39:51] So, it's bound to happen if subscription is having limit and if I'm uh if I have utilized all of that limit, obviously I need to buy another subscription. So when I'm buying another subscription, the access control and the organization

[4:40:06] is very important when I'm when I'm having multiple subscription. Why? Let's say I have this subscription where few of my users are having access and they can deploy resources. So this user is having access and this user can deploy

[4:40:19] resources whatever resources is required. Similar to this user, you have thousands of group you have thousands of users. They have some kind of access to this. Some some of them are having read access. Some of them are having right

[4:40:32] access. Some of them are having right access right so all the access control have been managed over here now let's say once I have utilized my limit I'm buying another subscription so what I'll have to do now again I need

[4:40:45] to see who is having what access here and I need to replicate the same thing in another subscription so that I'm not blocking my user from deploying resources right now after few years let's say I've utilized another limit

[4:40:58] for this subscription as well and now I'm going on another subscription. So I control, all the policies, everything on this subscription as well. So to avoid that situation, what Microsoft has done? Microsoft has created this management

[4:41:11] group. So instead of assigning access directly do, you can organize all of your subscription within the management group and you can control the access at the management group level. So once you

[4:41:25] control the access at the management group level in future it doesn't matter how many subscriptions you add within that management group all the subscription will inherit the same access control that you have um you have

[4:41:40] provided or you have added or you have assigned to your users at the management group level. So those access those policies will be inherit downwards. All right. So management group is the top level obviously tenant

[4:41:54] root group is the top level within the tenant root group you have your management group you can create a management group like uh here it's it's created as tailwinds that is nothing but the company name and within the tailwind

[4:42:07] you have like sales corporate IT within the IT you might be having production dev QA UAT right so all you can create as per your requirement whatever you want to create it it because um Azure doesn't

[4:42:23] want you to follow this. If you want to follow this, you can. Different company have different use cases. So they follow according to their requirement. Like I'll give you a real world example of my own company. So my own company we have

[4:42:37] like we create a subscription for our client. So if we have thousands of clients, all thousands of uh client all thousands of customer will have their own subscription. so that it's easier for us for us to invoice them at the end

[4:42:51] of the billing cycle. So what we have done we have obviously we have this tenant root group so I'll write it as TRG then we have uh two management group one for our company okay one for the

[4:43:05] customers every customer subscription will goes under this customer in our management group we have rod we have uh UAT

[4:43:19] and then we have U staging Okay. Test. So these are I mean non-pro not staging non-pro. So we have this very simple and uh effective way so that

[4:43:32] whenever new customer we want to onboard a new customer we just add our a new customer management group. So that's quite simple management group layers we have created. Okay. So what management group is in order to

[4:43:49] organize your subscription you can keep your uh subscriptions under this management group you can manage for access control as well. So whatever access I'll be applying at this level that access will be inherited. Okay. So

[4:44:02] doesn't matter how many management group I have in my hierarchy whatever access I'm assigning here that will be inherited. You can also enforce policies at different levels of management group. So if I have any policy here at tenant

[4:44:17] root group that will be inherited. If I have any policy at it since it will be having different kind of policy. So if I have any policy assigned at IT that will only be inherited by the management group and the subscriptions within the

[4:44:31] IT management group. Okay. Any policy at IT will not impact the root group, Telwinds, corporate and sales. Okay. So management group is very important when subscription. If you have single subscription, you don't need to bother

[4:44:47] about management groups and all. All right. You'll be having one tenant root group. Create one management group with your company name and within that subscriptions. All right. And obviously if you have

[4:44:59] management group it is easier to uh attain the compliance compliance requirement for your company since I can assign the all company level policy at tenant root group which should be uh which should be equivalent for every

[4:45:13] subscription every management group every resource. All right. So I think I group but in order to work with management I just need to search for management group. So in in the search bar if I types type type management I

[4:45:29] should get this option management groups. I click on it and I'll I can see how many management group I have. Right? So this is the tenant root group. So within tenant root group you'll be having everything all of your management

[4:45:41] group will be inside your tenant root group. All of your subscriptions will be within tenant root group. Right? So whatever I'll be assigning here at tenant root group will be inherited by by by all the management group within

[4:45:54] that tenant root group. So what do we have? What is our hierarchy here? We have Azure training. This is my subscription. Right? You can see the type here. So this is the management group. The first one the second one is

[4:46:06] subscription. Rest two are the management group. So anything assigned here any policy or any arbback role assigned here at tenant root group will be inherited by Azure training subscription will be inherited by

[4:46:20] subscription will be inherited by MG00003 will be inherited by MG00001. All right. If I expand MG00003 now we have tenant root group at top. We have subscription that is within tenant

[4:46:33] root group. We have MG00003 which is within tenant root group. And then we have another subscription pay as you go within MG00003. Now if I assign someone any access at MG00003.

[4:46:47] If I assign someone, let's say this is a user user 01 and I assign access to this user at MG00003. Whatever the access is, let's say read access. Now tell me can this user user 001 read anything we have at Azure

[4:47:02] training? Azure training is nothing but the subscription name. So if I assign a the subscription name. So if I assign a user 01 access read access at management user 01 access read access at management group 003 can this user read or or

[4:47:16] deploy any resource at subscription which is name as Azure training so I'm getting the answer as no that's correct why because MG00003 is at different scope is at the within the tenant root group and this subscription as your

[4:47:33] training is within tenant root group so anyone in my company wants to work with Azure training, I need to assign access at the subscription level, Azure training level or at the tenant root group level.

[4:47:47] All right. But let's say another question to you. If I move this subscription from tenant root group to MG003, now what is going to happen? that user who was having the reader role at MG00003

[4:48:04] should have access the read access to Azure training or no. If I move Azure training to MG00003 then obviously yes. So whatever access you have at MG0003 will be inherited to all the subscription that you have

[4:48:19] within that MG00003. All right. So this is very easy uh to manage. In order to move, in order to create, you just click on create and create another management group. So let's say MC00004

[4:48:35] uh management group display name and ID whatever display name you want. Display name is for you. ID is for Azure. So that when you work with management group using commands like CLI or PowerShell, you can call this ID. You can keep

[4:48:50] whatever ID you want. Okay. So I click on submit here. on submit here. It will create another group MG00003.

[4:49:07] here? Do you need to keep MG under subscriptions or subscriptions under NG? Okay. So you need to focus on hierarchy here. Hurry. You never put management group under subscription. That is not possible. Okay, management group is a

[4:49:23] possible. Okay, management group is a logical container which is created to manage your subscriptions. So always subscriptions will go under management subscriptions will go under management group not vice versa. I cannot put man I

[4:49:36] group not vice versa. I cannot put man I I cannot put subscriptions under subscriptions that's not possible. Okay. So always your subscriptions will

[4:49:48] go under management group. So if you see the uh the portal here the uh the portal here this subscription Azure training MG00003 this subscription Azure training MG00003 MG00004 MG01 are all in the same line

[4:50:02] are all in the same hierarchy that means they are within tenant root group. Okay now we just created MG00004. Now if I want to move this pay as you

[4:50:14] go, I can simply click on these three dots move and I can move it under wherever I want. Do I want to move it under MG00004, MG00001, MG0000? Wherever management group and move it. That's all. It will take some time and that

[4:50:30] will be moved. But whenever you are moving something at this level, you need to understand that the permissions, the policies all will be affected. Okay. So, whatever policies and permissions you have under MG00004,

[4:50:47] have under MG00004, those policies will be applied to now uh moved. So before moving this subscription was under MG00003. So whatever role policies were assigned to MG00003

[4:51:01] will be would would have been inherited by pay as you go. But now since we have by pay as you go. But now since we have moved whatever policy and roles access whatever you have at MG00004 will be inherited by pay as you go. All right.

[4:51:16] So that's how you manage these things and that's how you create management group and move subscriptions within the management group. You can also move management group to management group. So as you can see here M01

[4:51:32] consist or contains M02 now. All right. So hierarchy within the hierarchy you management group. So that is also possible. All right.

[4:51:45] possible. All right. [snorts] subscription. I'll answer punk. Just wait. Okay. So I'll read your question.

[4:51:57] uh answer. So what is a subscription? Subscription gives you access to Azure services. What do I mean by what does that mean? If I want to deploy anything in Azure, I need to have subscription. Without subscription, I cannot deploy

[4:52:12] resources. I want to deploy virtual machine or or uh disk or storage account. Whatever I want to deploy, I need to have access. I need to have subscription in place. without subscription I I cannot deploy

[4:52:27] subscription I I cannot deploy resources. Consider it like something uh Netflix. Okay. So in Netflix I can Netflix. Okay. So in Netflix I can create the account without providing uh

[4:52:39] details and all but I can keep my account. I can sign up. I can provide credit card. I'll still have my account there. my account will still be there but I won't be able to enjoy the the movies or the web series or or whatever

[4:52:56] Netflix has to provide right so in order to watch movies web series what I need to do I need to subscribe to a certain plan uh in Netflix whatever plan they have to provide I have to subscribe to that plan similarly you can create Azure

[4:53:09] account without subscription you can have account without subscription but it does not make sense that means you won't have the option to deploy the services that means deploy the resources I won't be able to deploy the resources in Azure

[4:53:24] if I don't have the subscription I won't be able to deploy the resources so what is subscription again subscription is a logical container for management and logical container for management and billing so Azure will charge you by

[4:53:37] looking at your subscription by looking at your usage so if I want to deploy resources I need to have subscription in place I need to buy a subscription I somewhere all Right. So subscription is a billing boundary. It's your isolation

[4:53:51] with other customers. So whatever resources you're deploying will be build or charged to your subscription. All right. Again this is this is a level at hierarchy. So you can manage your resources and your access control at

[4:54:06] this level as well at subscription level as well. So if you if we go back to the hierarchy here subscription is at the third level. First you have tenant root having management groups and then you'll be having subscription. So most list

[4:54:21] will be sitting at the third level. So this at this level as well you can manage the access control or the policies that you want to implement. In simple subscription is a billing boundary. If I want to deploy resources

[4:54:35] there's no subscription I won't be able to deploy resources. All right. last time. User 01. So let me just go to the user section. I

[4:54:52] So let me just go to the user section. I I'm just demonstrating you uh what what I explained just now that subscription is a billing boundary. So if you see is a billing boundary. So if you see this user user 02

[4:55:04] okay user 02. Let's log in with that user. So I'll just copy the username and hopefully I remember the password. I'll open the in private window. I go to portal.azio.com and login with this user.

[4:55:43] This user doesn't have the LFA. Yeah, let me clean.

[4:56:27] 02. What do you see at the at the homepage? So this is the homepage. Can I deploy resource from using user 02? So I'm logged in using the user account user 02. And if I search for virtual machine here we at the homepage we have

[4:56:42] the virtual machine. If I click on that virtual machine you see where I'm landed it's it's complaining that I might not have access or I I might not have the subscription. Okay. If you see the first page it says welcome to Azure.

[4:56:58] Don't have subscription. That means this user doesn't have access to any subscription or doesn't have uh any subscription within its with within its subscription within its with within its account. Okay. So you see none of the

[4:57:12] entries matched. That means there's no subscription no access to the subscriptions for user 02. So in order to deploy resource I need to have subscription. Now if I do with another user so if you see this is another user

[4:57:24] simply learn something something right simply learn at the rate domain name. So this user if I search for virtual machine see where I'm landed on which page I'm landed at least I can see the virtual machine here I have the create

[4:57:38] option that means I have some access to the subscription obviously a right access with this user account so that this user simply learn at the rate whatever it is can create the virtual machines apart from virtual machines can

[4:57:52] create other resources as well. So in order to deploy resources you need to have subscription. Azure will bill you according to your usage whatever whatever you have deployed within your subscription. All right. Once again if I

[4:58:05] go to the in private window where I have logged in with user 02 just focus on the screen user 02 and you see when I search for virtual machine I'm landed to this page where I cannot see any virtual machine and I I'm getting this screen

[4:58:20] which says welcome to Azure. Why this screen I'm seeing because I don't have access to the subscription. The next topic that we have is policy. Now we have done the hierarchy and uh while explaining the hierarchy sorry.

[4:58:45] So we have seen the hierarchy and while explaining the hierarchy u I have been mentioning about policies and arback and all. Now we are coming to that policies and arbback. Okay. So what is a policy? Policy in Azure is a way to enforce

[4:59:00] something. Enforce as in to mandate something to do something mandatory. For example, [snorts] um there is a user like for example I'll take you guys okay. You're now learning

[4:59:14] a 305 and you might have done a 104 as well. Some of you might have done a 104. Some of you are directly here for a 305. So doesn't matter which certificate you're doing, you're learning Azure. When you're learning Azure, you are

[4:59:29] getting uh introduced to lot of services which you can use for your own use, for your own uh own work. Okay, not for company work, let's say for your own work. So you're learning Azure. Now you have learned how to deploy virtual

[4:59:43] machine let's say or how to deploy certain resources. So when you have learned that you have you're working professional let's say and you have access to your company's

[4:59:57] and you have access to your company's Azure subscription. access to your company's Azure subscription. So in order to just to understand Azure what you will be doing you have the access to your company's

[5:00:13] deploy resources right what you'll be doing let's say just for just for understanding or just for learning you deploy a virtual machine which is having 64 GB of RAM [snorts]

[5:00:27] which is having 64 GB of RAM [snorts] uh eight virtual CPUs and so and so storage so you deployed this virtual machine now tell me this virtual machine the configuration is hefty or not? Is it a

[5:00:39] minimal configuration or it's a hefty configuration? 64GB of RAM.

[5:00:51] configuration. So, I'm learning Azure. I have access to this virtual machine. Who's going to bear the cost? Is it me as a individual user? Is it my company since I'm using my company subscription? So obviously

[5:01:06] the cost will be for my company uh my company will have to bear the cost since company will have to bear the cost since I'm using their subscription right. So as a company or as an Azure administrator

[5:01:21] I know while I'm I'm coming up with governance I know that I will never require 64 GB of virtual machine for my projects or for my products. I I never those kind of project. So I never need the hefty machines. So if I simply ask

[5:01:37] the hefty machines. So if I simply ask my user, my employees that please do not deploy this kind of heavy virtual machines, I'll have to pay for that. Now tell me just telling them just asking them not to do uh is it 100% sure

[5:01:52] asking them not to do uh is it 100% sure that they are not going to do it? or as a as your architect that please do not deploy hefty virtual machines.

[5:02:05] Are they going to uh I mean are they going to listen and and they I'm I'm I'll I'll be 100% sure that they're not going to do this going to do this just asking them

[5:02:18] obviously some of them will agree some of them will not touch some of them just for sake of of deploying and and learning things they'll go ahead and deploy and deploying is not not a problem the problem is they deploy and

[5:02:31] problem the problem is they deploy and then let's say they forget to delete it. So they deploy this and they forget to delete it. I'll still have to I I mean as a company I'll have to pay that charge. So how to restrict our employees

[5:02:45] from doing such things. So what Azure or Microsoft uh did they came up with Azure Microsoft uh did they came up with Azure policies. So what Azure policy does they enforces certain things. Okay. What they what you can do with Azure policy. one

[5:03:01] one example I have given you like this you can restrict deployment of certain uh sizes of virtual machines like mentioned here so I can limit to certain SKUs I can restrict users from deploying this kind of heavy hefty virtual

[5:03:17] because I don't need it if I need it obviously I'll make amendments to the policies but if I don't need it I can limit that kind of uh things using limit that kind of uh things using policies okay now we just understood the

[5:03:31] tag. So we can enforce that as well. By default it's not mandatory to have tag to each on each and every resource. But with policies you can enforce that. You can ask user to uh when they are deploying the resources you can ask them

[5:03:46] using policies to to provide the tag. Without tag they won't be able to deploy the resources. You can also restrict deployment in You can also restrict deployment in certain locations like uh Azure has its

[5:03:58] presence all over the world. Okay, we have presence in India, Australia, US, UK. Uh but let's say for my organization, for my product, we are not dealing in US. So we can restrict deployment of certain resources in

[5:04:13] certain locations. So that is also possible. Okay. You can enable auditing, possible. Okay. You can enable auditing, you can using policy, you can uh deploy the the AAS antimmalware on on all of your virtual machines, Windows virtual

[5:04:28] lot of thing that you can do with policies. So policy is a way to enforce uh certain standards that you want to achieve. All right. Now where you can apply the policy at any level in the hierarchy at any level in the hierarchy

[5:04:44] you can apply the policies. Now where which policy should be applied? Let's say the 64GB one that I that I told that I that I mentioned is a policy that can group level. Why? because I want it to be applied for each and every

[5:05:00] subscription. So I can keep that policy at the tenant root group level. Certain policies like do not deploy in a certain location, I can keep the keep them at the management group level. MG01 or MG02. Now let's say MG01 deals with

[5:05:16] every project that we have in India. So I'll keep the location deployment uh policy at MG01 so that it won't impact other resource uh other management group

[5:05:29] right enforce tag again I can keep it at the tenant root group level since I want tags to be enforced at each and every level each and every resource. All right level each and every resource. All right so policies is that that a policy is

[5:05:43] something that you can uh use to enforce whatever standards you want to want to whatever standards you want to want to have. All right. Now, when you work with policy, well, I'll show you two demonstration in

[5:05:56] in this hands-on is uh applying tags and and policy. So, is uh applying tags and and policy. So, what I'll do, I'll first go and create a resource group. Okay. So, you see in order to create a resource group, you

[5:06:11] should you can search for resource group over here. And you can see a resource group, right? So in order to create a resource group I click on resource groups here and then I click on create. Okay when I click on create I have like

[5:06:25] two things that I need to provide subscriptions doesn't matter whether you're creating a resource group um a virtual machine or disk whatever a subscription should all always be provided. So you have to provide the

[5:06:38] subscription and the resource group name. Okay. So what would be the resource group name for this? So I'll go for a Z305 RG02. All right. And then the region. So what

[5:06:51] is the region? Region is the physical location where your resource will be deployed. So if you see the drop-down, Azure has its presence Azure has its presence uh in all of these uh uh regions like

[5:07:04] uh in all of these uh uh regions like South Africa, Australia, India, uh East Asia, Indonesia, Japan, East, West, Korea, Malaysia. So we have all these location all these Azure has its

[5:07:17] location all these Azure has its presence in all of these uh regions the physical location the physical data center is present in all of these locations. So you can select whatever you want okay unless you have a policy

[5:07:29] which is restricting you to deploy resources from so and so location. Now I select central India over here. Mostly I'll be using central India to deploy uh resources. Okay. So I select central India over here. Now what we

[5:07:44] subscription, we have provided resource group, we have provided region. Remember the region is central India. Okay. Then the next tab that you see is tags. So here you can provide the tags. So what is

[5:07:59] tag? Tag is just an extra metadata. Okay. You can provide anything like Okay. You can provide anything like uh environment

[5:08:11] broad. Okay. owner whoever is deploying Imran right so you can provide whatever you want it it's totally up to you one resource can have like uh 50 tags so this one resource can

[5:08:25] have like 50 tags so you can provide around 50 tags to one resource okay but for now let's not provide the tag so even if I don't provide the tag I can click on review create and I can click on create remember I created resource

[5:08:40] group with the AZ305 RG01. So you should see the AZ305 RG01. So you should see the resource group in some time here.

[5:08:53] without tag. Remember we created it in central India. All right. Now let's create a policy. Let's create a policy. Right? Now there's no policy. So let's create a policy. This policy will restrict

[5:09:06] deploying resource group in central India. So if now people try to deploy resource in central India, the policy should in central India, the policy should restrict it and this policy will uh will

[5:09:20] be applied at at at subscription level. Okay. So let's see how we can use policy. Now I I just demonstrated that I was able to create the resource group and that resource group was created in central India. Okay. Now using policy

[5:09:34] will restrict that. So let's quickly do that. So in order to work with policy I can search for policy and I can go and select policy here.

[5:09:47] Okay. Now if I have any policy or if I don't have any policy I can see over here. If you see on left hand side you have all the required options. All right. So you see here under assignments you can see all

[5:10:00] the policy which are currently assigned to your uh to at any any at any scope if So right now it's zero that means no policy is assigned. Okay. Now in order to assign you can click on assign

[5:10:14] policy. So if you see here you have two different options assign policy and assign initiative. So what is the difference between policy and initiative? Quite important from uh interview point of view. policy is like

[5:10:27] a single policy. Okay. If I want to create a group of policy and assign those policy at once, then I have to click on assign then I have to click on assign initiative. I can create like multiple

[5:10:41] initiative. I can create like multiple policies as a group at once and uh at one polic as one policy and I can assign that as an initiative. So if I click on initiatives. If I go back over here and if I go to

[5:10:55] the definitions uh and if I click on uh if you see here these are all the policies that we have available as of now. Okay, these are all the inbuilt policy that that Microsoft has created and kept that. But if you see here the

[5:11:09] and kept that. But if you see here the type the type mentioned here definition type if you see the type which is mentioned here will will will uh confirm whether it's a single policy or whether it's an initiative right now whatever

[5:11:25] you see is a single policy but if you scroll down you see there are uh multiple uh pages that you can go and if if we go to the last page if you go through each page one of one of the type should be initiative. You can see that

[5:11:40] initiative as well. Okay, there are a lot of lot of pages. These are all the inbuilt policy or initiative that Microsoft has already created for you. You can come up with your own policy as well. Sometimes it happens that even

[5:11:52] though we have so many policies inbuilt policy that Microsoft has created, we do not find a specific policy for our use case. So what you can do, you can come up with your own policy. You can create your own policy. All right? So in order

[5:12:06] to create your own policy uh somewhere you should have policy definition create a policy you click on policy definition. If you want to create an definition. Initiative is like multiple policies at once. Okay. In order to

[5:12:22] assign policy you need to go to assignments. In order to define policy or create policy you need to go into the definitions. Now in order to create policies obviously you need to be well versed

[5:12:35] with JSON and you need to understand the different uh services that Azure has to provide Azure provides right for example this is the virtual machine related thing. So this policy can audit all the virtual machines which does not have the

[5:12:49] disaster recovery configured. So you can use that policy and you can see how this policy is defined. So this policy is defined like this as I mentioned that in order to work with policy or anything in cloud specifically any cloud you need to

[5:13:03] be well versed with JSON. Okay. So whatever Azure or any any other cloud provider will be mentioning is mentioning is will be mentioned as a JSON format. Okay. So what we are going to do let's go back

[5:13:17] So what we are going to do let's go back to our topic where we have to deploy a policy which will restrict the deployment is of resource group in central India that means u nobody will should be able to deploy a resource or a

[5:13:32] should be able to deploy a resource or a resource group in central India okay so let's go to the assignment let's click on assign policy and here the first thing that you need to define is scope the scope is the

[5:13:45] hierarchy that we we discussed. So any scope at any scope you can apply the policy provided you have the access. Okay. So if you see here at the scope on this three dots if I click on this three dots I can select the subscription I can

[5:14:01] select the resource group. Now you might ask the question why I can't see the management group here. So remember I have logged in as simply learn user. user doesn't have access to the management group. So I don't see the

[5:14:15] management group here, you can assign policy at the management group. If you have access to the management group. Okay. So if I switch the browser and go to the user which has access to management group uh like my personal

[5:14:30] management group uh like my personal user Iran Ketani. So if I search for policies here, if I click on assign assignments and if I click on assign policy just to see the scope, if I click on

[5:14:45] scope here, you see I can see the management group. So if you have access, you'll be seeing the scope as management group. If you do not have access, you group. If you do not have access, you won't be seeing it. All right.

[5:14:57] Now how to assign the access and how to see this is something we will discuss in in the next topic which is arbback. So right now we are on on policy. So let's complete the policy first. Now I'm switching back to the browser where I

[5:15:10] have logged in with simply learn user who does not have access to uh management group. Okay. So here we'll keep the scope as subscription and I'm

[5:15:22] not selecting any resource group. I'm just selecting subscription that's all. All right. And I click on select. So whatever now we are going to define whatever now we are going to define within this policy will be

[5:15:35] uh will be impacting this subscription only and within this subscription creating whatever resources you'll be deploying only those uh resource or

[5:15:48] resource group will be impacted. So let me just explain this again. So if you see this hierarchy this is let's consider this is the this is let's consider this is the subscription Azure training and we are

[5:16:01] applying policy at this level now okay so if you go ahead and create a resource group within this policy then only the policy that within this subscription then only that policy which you are applying will be evaluated. If

[5:16:17] you're creating resource group within another subscription then that policy will have no impact. Okay, that's why understanding hierarchy is important in understanding hierarchy is important in Azure. Okay,

[5:16:29] let's go back to the browser. Uh within this subscription, if you want to this subscription, if you want to exclude anything, you can exclude that. or more resource group which is for R&D purposes. So if I want to exclude, I can

[5:16:43] exclude. Okay, that option is given. Then here you can select the policy definition. So I click on this three dots and there are a lot of policies. So if you see there are like thousands of policies

[5:16:57] that Microsoft has already created. You need to select your own your policies according to your categories like I only want to work with virtual machine. So I select let's say compute. So I select compute and all the compute

[5:17:12] So I select compute and all the compute related policies will be filtered out. So I'll see only the compute related policies. Okay. You see the VM, VMs, all the VM related policies will be will be uh shown. Okay.

[5:17:28] policies will be will be uh shown. Okay. Now what we are interested is restriction of location. So I search I I randomly search for location randomly search for location or maybe allowed location. Okay.

[5:17:47] this term allowed location. So you see there are three policies with that name. there are three policies with that name. The first policy is specific to Cosmos DB. So Cosmos DB is a resource in Azure or database in in in Azure. So if you

[5:18:00] or database in in in Azure. So if you want to impact or or restrict deployment of Cosmos DB from certain location, you can select that. Okay. What we are can select that. Okay. What we are interested here is in resource group. So

[5:18:12] resource group right in central India and that was allowed but right now let's restrict that using uh using this policy. Okay allowed location for resource group. So I select that policy

[5:18:25] and after selecting that policy we need to go to the next uh tab which is parameter. So in parameters you have to define which location you want to allow.

[5:18:37] Okay. So there are all the locations that is mentioned. What I don't want to that is mentioned. What I don't want to allow is deployment in central India uh west India and south India. So I untick south India, west India and

[5:18:50] central India from here. Apart from that every other location is allowed. So let's say that's my scenario that's my that's my uh requirement. So only central India, West India and South India is unticked. Apart from that all

[5:19:05] other locations are allowed. Now next remediation is something which doesn't require we don't require for this policy but let let me explain what the remediation is. What is a remediation? Remediation is a way to uh

[5:19:21] to make sure or to make that that resource compliant. Okay. For example, resource compliant. Okay. For example, your policy is evaluating

[5:19:33] u and evaluating whether the anti-malware and evaluating whether the anti-malware is installed or not in Windows virtual machine. So you have let's say thousands of virtual machine and your VAPD team

[5:19:46] of virtual machine and your VAPD team vulnerability assessment team wants to make sure that antimalware is installed on all of the Windows virtual machine. So what we can do we can use a policy. So that policy will evaluate whether the

[5:19:59] antimalware is present or not. If antimalware is not present, install it, download it and install it. So that download and install it is nothing but remediation. Something is not present, you're asking

[5:20:13] Something is not present, you're asking policy to deploy it. So when your policy deploying things is known as remediation. we are remediating which is which is not present there. All right. So obviously this policy doesn't require

[5:20:28] remediation but there are some policies which might which might have this option of remediation. So you can enable it. Okay. need now uh I have a question

[5:20:43] now uh I have a question what is the meaning of remediation? The remediation is something which will make sure deploy if not exist. You see this word deploy if not exist. So if something is not deployed like for

[5:20:58] example antimmalware or any other software that you are evaluating if that is not deployed deploy it. If it's not exist deploy it now tell me we are asking a policy to deploy things on a virtual machine.

[5:21:13] So this is a virtual machine Windows virtual machine and policy is going to deploy that thing in the virt on the uh I mean within the virtual machine. So what process is required here? Uh is the virtual machine automatically will

[5:21:28] the virtual machine automatically will allow the policy to deploy the things? machine will allow the policy to deploy the thing. Policy is a separate application. Virtual machine is a separate resource. Both of these are

[5:21:43] separate resource. Now policy is trying to make some changes within the virtual machine install a software. Tell me is the virtual machine going to allow the policy to install the software

[5:21:57] or what as a engineer or administrator what we need to do? the next step. What is manage identity? policy is an application which trying to

[5:22:11] make some changes to the virtual machine. It's an application which is trying to make some changes to the application. Think from the security point of view is the virtual machine going to allow the

[5:22:23] application as is without asking anything without doing anything. anything without doing anything. Is it going to allowed or not?

[5:22:36] firewall not on then not deployed the VM. Firewall has has nothing to do with VM. Firewall has has nothing to do with it. Okay. The app the request is not coming from outside your network. We are within the same tenant.

[5:22:50] Okay. Policy that we are applying is in the same subscription whereas the virtual machine that will be evaluated will also be in the same subscription. So firewall u doesn't come in this picture at least for this example.

[5:23:05] Okay. So Chaitan is saying we need to register the app. Hurry is saying the policy is and post. Yes. Okay. You you guys are forgetting one simple

[5:23:18] uh mechanism you can say is authentication. mechanism you can say is authentication. I uh is this policy how the VM is going to authenticate this policy and how the VM is going to

[5:23:31] policy and how the VM is going to authorize that policy. have to define the location where to download and install.

[5:23:43] download and install. Uh that's secondary. Yes. Okay guys back to IM go back to identity and access management. What is identity and access management? It allows you to

[5:23:55] authenticate your user and authorize your user. It's not only for user, it's also for application. If you remember, we understood two different terms. Manage identity and service principle. Now tell me what is manage identity.

[5:24:12] Suresh is saying user account should own admin right. Okay. U policy is deploying things on a virtual machine. User account where where is the user coming in here? Policy is kind of an application.

[5:24:28] Virtual machine is kind of a resource. This application needs access to the resource to make some changes. User account is not required here. Consider it like this. You have an application which requires access to the database.

[5:24:41] So here we we we do not include the user account when application is accessing the database. What what is manage identity? Come back. What what is manage identity? Come back. I'm I'm giving you the answer as well.

[5:24:59] statement or words. What is manage identity?

[5:25:18] you to please rewatch the AM section. All right. Now let's come back to the All right. Now let's come back to the policy here. Now just answer yes or no. Is the basic step clear? In basic step, you're just defining your your scope

[5:25:30] where you want to apply the policy and then you are selecting the policy apply. In our example, we selected allowed location for resource group. And then in the parameters section, we selected which location to allow, which

[5:25:43] location not to allow. So we allowed free location we allowed we we unticked few location where uh which will be denied. All right. Now for our policy we don't require remediation but I explain what remediation is now. Answer do you

[5:25:58] what remediation is now. Answer do you understand what remediation is? Okay. So remediation is something where if uh if something is not present it will deploy. So in our policy it doesn't make sense to uh to enable remediation.

[5:26:14] All right. Now my question is if we are using any policy where remediation is required. One policy that I provided is uh example I provided is antimmalware uh example I provided is antimmalware which is not installed in a policy will

[5:26:28] all the virtual machines. You have thousands of virtual machines. Okay. You have thousands of virtual machines. policy will evaluate all the Windows virtual machine and see whether the anti-malware is installed or not. If it

[5:26:42] is not installed then using the remediation option we will install it. We'll ask policy to install it. We as a user are not going to install it. That's why this policy is in place. Policy will automate things for you. Okay? So it

[5:26:55] will install on your behalf. So you don't require a user account here. It will not ask me for the user account or or anything. So with remediation what I can do? I can install this software. Antimalware is what? It's nothing but a

[5:27:08] software. I can ask my policy to install the software if it is not present. Right? Now policy is behaving as as a authoritative application which will deploy something which will install a

[5:27:24] deploy something which will install a software inside a virtual machine. So in order to install that software virtual machine right?

[5:27:36] It's possible that someone outside of my network triggered a script targeting this virtual machine, triggered a script installing a a software. So this virtual machine will allow that that person that script to to install the software.

[5:27:52] Obviously that virtual machine will have to authenticate this traffic where it is to authenticate this traffic where it is coming from. whether this traffic is authenticate to install whether this traffic is authorized to install certain

[5:28:05] software or not. Obviously this virtual machine will authenticate and authorized right. So same goes for policy as well. Although this is coming from the same cloud, same account but virtual machine have to authenticate and authorize to

[5:28:20] check whether this policy is authorized to deploy antimalware or not. Understood or not? So in order to authorize what we are going to do in the next step is create a manage identity for the policy.

[5:28:38] were discussing about manage identity? Manage identity is an object ID is an identity for your application. When that application requires an access, we create manage identity for that application. And then when that

[5:28:52] application requires access to the database or the storage, the database or storage will authenticate that application using that manage identity. If it's authenticated, yes. If it's authorized, yes, allowed. If it's not

[5:29:04] authenticated, do not provide the access. Similarly, for this policy, the policy that requires the remediation, you need to create the manage identity as well. For our policy, we don't need it. or a certain policy where you need

[5:29:18] to remediate certain things in that case you need to create the manage identity as well. All right, I hope what I was trying to All right, I hope what I was trying to explain is clear.

[5:29:34] in basics tab you just selected the policy and the scope. So this is the policy and the scope. So this is the scope I selected uh my subscription and then the policy definition that I selected allowed location for resource

[5:29:47] group that's all in parameters tab we selected what location should be allowed which location should not be allowed in remediation for our policy it doesn't require but for certain policy if

[5:30:01] required you can enable this okay when you are working with remediation you can create manage identity as well without manage identity ity remediation will not work. Okay, your remediation will fail. So once the manage identity is created,

[5:30:15] So once the manage identity is created, you can also provide the uh def uh sorry permissions to the policy as well. All right. And then next non-compliance right. And then next non-compliance message. So in our policy uh

[5:30:29] we need to add a non-compliance message like please deploy in any other region apart from India. So what this non-compliance message will do it will

[5:30:42] help user whenever user is trying to deploy the resource group and if that resource group is failing it will help user to understand why the deployment is failing. All right, please deploy in any other region apart from India. And then

[5:30:57] click on review create and then you can click on create. So now your policy is in place. Now remember before applying the policy, I deployed the resource group in India. Remember right now let's try again. Now before trying obviously

[5:31:13] it's better to sign out and sign in again to take the token or the the new token or the new policy. By default, it's uh it should be uh in in effect as

[5:31:26] soon as you apply, but sometimes it doesn't work. So, it's better to relog in. Okay. So, I logged out and then log in Okay. So, I logged out and then log in again.

[5:31:43] resource group in central India. So I search for resource group. I click on create. I give it a name a 305 RG03 and then

[5:31:55] central India is by default selected but if you see there is the non-compliance message that you added in the policy is is popped up please deploy in any other region apart from India so this is affected by the policy policy will not

[5:32:10] allow the deployment of this resource group in central India but if you select any other region apart from central India like Canada east or something it India like Canada east or something it to lock the pop-up is gone. Okay. So now

[5:32:23] uh it's confirmed that using policy we can enforce certain requirement that can enforce certain requirement that that is required uh by our company. So we can implement or enforce those kind of requirement.

[5:32:35] Next topic that we have is arbback. Now this is important topic to understand. Okay. So far we were discussing about the hierarchy and I mentioned that we have different scopes in the hierarchy. uh within that scope you can apply the

[5:32:50] policies. Policy we have already seen how to apply and we selected subscription as one of the scope. Similarly, arbback is something which will allow your user to give them

[5:33:04] certain rights. Rights like reader right so they can read something uh contributor right so they can contribute something to your subscription or uh

[5:33:16] owner rights. owner is like a full right okay u then you have uh there are different roles available built-in roles available in Azure that you can use to

[5:33:29] provide certain access in simple terms ARB stands for role based access control so as from the ZTM you need to make sure that least privilege access should be should

[5:33:44] be assigned to whoever wants the access. All right. So for that you need to understand arbback. A rback is role based access control. Okay. I see Ram is asking for break. Break will take in half an hour. Okay. 9 at exactly at 9.

[5:34:00] Okay. We'll go for half an hour of break that We'll go for half an hour of break that time. All right. Or you guys tell me do you do you all do you all agree for break right now or

[5:34:13] break right now or later? So, arbback arbback stands for role based access control. So far what we

[5:34:27] have what we have seen we have seen the hierarchy here also it's mentioned right. You have management group subscription resource group resource. So this is the hierarchy. Now who can do what? You will be having thousands of

[5:34:39] what? You will be having thousands of users. You'll be having um uh thousands of applications. what that application could can do. How how as an administrator I assign them the access. So in order to assign them the access

[5:34:52] you need to assign them the arbback role. Arbback stands for role based roles different different roles depending on what they want to do. Assignments assignments can be at any scope. So you need to assign those roles

[5:35:06] at any scope whatever scope is preferred for you. Okay. You want some some companies like to manage the access control at subscription level, some companies like to manage at the management group level. If you want low

[5:35:19] management overhead, you go with management group. If you want more management overhead, that means uh every time there's a new subscription, you groups and and and things, then you go at the subscription level. Okay.

[5:35:34] So different scopes at different scopes you'll be assigning different roles and you can come up similar to policies you can come up with different custom roles as well. There are lot of built-in roles by Microsoft Azio they have already

[5:35:48] created lot of built-in roles but at certain point in time you feel that built-in roles are not enough so you can create your own custom roles as well. In easy 104 we have one practical as well where we where we show how to create a

[5:36:02] custom role. Okay. So what is arbback? [snorts] Arbback stands for role based access control. So in order to see arbback you can go to any scope management group uh subscription

[5:36:15] resource group. So I I'll show you that at the resource group level. So I'm at the resource group level. If you see uh any point in time if you want to see at at which level I am. So you can see that here. Okay, it says resource group.

[5:36:31] here. Okay, it says resource group. If I go to the subscription, subscription, you can see at what level you are. So you are at subscription

[5:36:45] level. So at any level arbback can be assigned. That's why we have the hierarchy. Okay. So in order to see where I can assign the arbback or who is currently having what role you see this blade

[5:37:00] access control I am this blade is present at almost all resources all resource groups all subscriptions all management group. So whichever resource management group you you are at you can see this blade access control IM from

[5:37:16] here you can manage the access control. All right. Now if I go back to any resource group as well, you should see the same access control I am. If you go to management group, you will you will see the same. So doesn't matter uh from

[5:37:31] where you want to control. I would prefer for my company, we prefer management group. Why? Because we have lot of subscription. We don't want to keep doing the same thing over and over again. Assign once at management group

[5:37:45] level and you're free. Okay? then doesn't matter how many subscription you add there all subscription will inherit those particular role so best way and the best practice that Microsoft also recommends is to manage the access

[5:37:59] control at the management group level okay that would be easiest but doesn't matter at what level you are you should see this account uh sorry access control and there you should see all the access now let's come back to access control IM

[5:38:13] and here you can see the role assignments so this role assignment tabs assignments so this role assignment tabs provides you the current provides you the current uh access that users are having.

[5:38:25] All right. All the users who has access to what access what level at this particular uh resource group level. So if you see I'm at role assignment here

[5:38:37] my Hotmail account is having the owner role and if you see the scope here role and if you see the scope here sorry if you see the scope here

[5:38:53] subscription inherited. What does it mean? What is the meaning of inherited? What level I am? At what level I am?

[5:39:06] explain the role. Please hold on. I'm what I'm trying to explain. Plus see that. Okay. I'll explain the role as well. Don't worry. Resource group level. What level I am at? I am at resource group level. I am

[5:39:20] access control blade. And here if you see this is one of the user account, Hotmail account. This user account is having this particular role. Owner scope is what? What is the meaning of inherited

[5:39:37] arbback assigned at subscription level right? This is not directly assigned at the resource group level. It is being inherited from subscription. That means Hotmail account has got this role at the subscription level. That's why it's

[5:39:49] subscription level. That's why it's inherited. level. we haven't I mean administrator haven't level and assigned the role it was inherited from the subscription so

[5:40:05] that's why it's important to define the scope first where you want to control the access you want to control at the resource group level go uh management group level go there and assign role at that particular level okay clear

[5:40:21] the role obviously it's not possible to explain all the roles role but what are what are the important role I'll be explaining that okay now on the right hand side the next tab is the ro roles so here you see all the role now tell me

[5:40:36] is it possible to explain all the roles you see the number of roles you have and you see the number of roles you have and you have like 890 roles total okay so the role but I'll be explaining the important roles that you now what what

[5:40:51] important roles that you now what what what all these roles are if you know we have storage account in Azure in future topic we will be explaining storage So if you just search for that particular uh service like storage so

[5:41:05] some roles are storage related roles some roles are we have seen keyword right some roles are keyword related roles so if I just type key and search for it I should see the keyword related roles somewhere so similarly for

[5:41:21] database you'll be having certain roles for virtual machines you'll be having different different roles depending on that particular service now which roles understand from the exam point of view and from the

[5:41:36] interview point of view are these roles. Owner, reader and there's one more role with the name user administrator or user

[5:41:52] access administrator. Okay, so let me just search for that.

[5:42:07] All right. So, let me just explain these roles and then we can go on break. I'll take 5 minutes to explain these roles. Quite simple. Owner as the name specifies, you can do whatever you want. So if someone is having owner role that

[5:42:21] means he can do he or she can do whatever uh he or she want to do with particular management group. So understand if I give someone the manage owner role at the management group level he can do whatever he wants at all the

[5:42:38] group. So if you have thousands of subscriptions within this particular management group and you give someone owner role, he gets the owner role of on all that thousand subscription at the end on all the resource group at the end

[5:42:52] on all the resources. So owner is like administrator in Windows. So he or she can do whatever they want. Okay. If any point in time you don't understand what this particular role is doing, you can read

[5:43:05] the description here. So what this description says grants full access to manage all resources. So he or she can do whatever they want. Right? [snorts] Next contributor. So what is contributor? It is also similar to

[5:43:21] owner. If you see grants full access to manage all resources but does not allow you to assign roles in Azure Arbback. What does it mean? So let's take an What does it mean? So let's take an example here. You have user 01. You have

[5:43:34] example here. You have user 01. You have user 02. User 01 is owner user 02. User 01 is owner and user 02 is contributor. Okay. Now there is another user coming in joining in today. Now this user needs

[5:43:47] an access to virtual machine or resource group whatever. So owner can assign access to this user 03 to any resources he wants. Whereas contributor cannot do that. So that's the only difference. Owner full

[5:44:04] that's the only difference. Owner full access can can assign or invite any other user as well. Not invite but can assign access to other users as well to any of the resources. Whereas contributor can do everything.

[5:44:17] Can delete resource, can manage resource, can create resource. The only uh only thing that contributor cannot do is assign access to other resource other is assign access to other resource other users. That's the only difference.

[5:44:32] Next reader. Quite simple as the name specifies. If user 03 is a reader, he can read everything but cannot modify, cannot delete, cannot do any anything

[5:44:46] else. Okay. The last role that I mentioned was user access administrator.

[5:44:58] administrator he or she can assign access to any other user. So if I am UAA user access administrator I can assign any role to

[5:45:11] third user any role whatever role they they need. So if tell me now if someone is having contributor and user access administrator both what is going to administrator both what is going to happen?

[5:45:28] contributor he can do anything whatever he wants to do plus he's getting another role user access administrator that means user access administrator g uh gives the ability to this user to assign any role to any other user.

[5:45:44] Okay. Okay. So these are the four rule that you should be aware of and quite important from the exam point of view from the interview point of view and any conf confusion on this roles you [snorts] just need to remember four

[5:45:56] [snorts] just need to remember four roles as of now owner contributor roles as of now owner contributor reader and user access administrator. Owner like administrator can do whatever he wants. Contributor like similar to

[5:46:10] owner but doesn't have the ability to assign access to other users. Reader as the name specifies can read whatever he or she wants to read. User access administrator has the ability to assign

[5:46:23] access to other users. So if I am user access administrator I can assign any access administrator I can assign any role to any other user whatever us or she wants like he wants to manage virtual machine. So I can provide

[5:46:36] this user if I am a user access administrator. administrator. All right. Clear.

[5:46:52] user access administrator that's like equivalent to owner. Okay. All right. Now tell me I have a question. I get an owner role. Can I create a new user in in Microsoft Enter ID?

[5:47:08] Enter ID? I I I got an owner role. See if I go back to the role assignments here. My account

[5:47:23] create a user account when I have the Hotmail account? I mean if I have the owner role, can I create the user account? People are saying yes. Okay. And now here it comes [snorts]

[5:47:35] here it comes [snorts] uh here you need to understand in Microsoft Azure the there are two types of roles. Okay. Arbback roles. So whatever we have discussed so far owner contributor user

[5:47:53] access administrator reader these are related to arbback. Okay, arbback is mostly for managing the resources. So I can only manage the resource if I have the arbback role. I cannot manage

[5:48:09] the Microsoft entra ID. Remember these things. Okay. Microsoft entra ID user creation user deletion is part of which is is is part of governance or is it is is is part of governance or is it part of uh IM enter ID as part of enter

[5:48:24] ID. Okay. So there are two types of roles in Azure. A rbback role and the uh Microsoft Entra ID role. So in order to work with Microsoft Entra ID, I need to go to Microsoft Enra ID. And here also if you see there are roles and

[5:48:39] administrators tab. If I want to work with Microsoft Entra ID, there are separate roles. If I want to work with resources, there are separate roles. Okay. So which role is important in Microsoft Entra ID?

[5:48:54] Similar to our back role, there are a lot of roles again available here. Okay. Uh it's not possible to go through each and every role. But which roles are important for you to understand is global administrator.

[5:49:09] So global administrator is like full access at your m at your Microsoft enter ID. So if you have global administrator role that means you can do whatever you want to do. Okay. If you have the global reader role, you can read whatever you

[5:49:25] want, but you cannot modify anything. So if you get global administrator plus owner, then you have full access at the tenant tenant plus at the governance level. Okay, at

[5:49:40] the arbback level. So you can manage resources, you can do whatever you want. administrator, you can do whatever you want at the tenant level, at the Microsoft Enra ID level. Okay,

[5:49:54] apart from that there are few rules that you should know is password reset administrator. So if you see somewhere you have password administrator which gives you access to reset password. So if there is a helpex team

[5:50:09] who just need to reset the password then you can provide this role to them help you can provide this role to them help team right. And then there are uh there is user administrator role similar to user access administrator. So if you

[5:50:24] want someone to manage the assignment of uh user roles in Microsoft entry ID then this role is is something that you can assign. Okay just remember there are two roles in Azure

[5:50:40] Arbback role and Microsoft entra ID roles. Four roles, four important role that you should know from arbback side. Owner, contributor, user access administrator and reader. Main roles in in Microsoft entra ID is

[5:50:56] global administrator. It's like full ro full access at enter id level uh global full access at enter id level uh global reader full read reading capabilities

[5:51:08] user user administrator similar to user access administrator but at the at the entra side level at the entra tenant level that means if I have user administrator role I can assign whatever role I want at the tenant level okay I

[5:51:23] administrator role someone global administrator someone whatever as per their requirement. Clear? The last topic that we have about governance is landing zones. Now whatever we have discussed so far

[5:51:37] management group, subscription, resource group, tagging, policy, arback. So out of this tagging, policy, arbback are the three important uh features that helps you to achieve the governance. The rest is just the hierarchy. Okay, rest like

[5:51:53] resource is nothing but the hierarchy. This actually won't help you to uh implement the governance. To implement the governance you have tag, policy and arbback right. So using policy we can

[5:52:06] sure that we are meeting our compliance requirement using tag we can organize our cost or automation and using arbback we can organize or maintain our access

[5:52:18] control. So what is this this last topic? This landing zone is a is a is a concept where you can create your Azure platform. You can uh maintain or

[5:52:31] configure your Azure platform before landing your workload. That's the only meaning of landing zone. Okay. Like for example, I want to uh land a uh a

[5:52:43] airplane in my city. So I need to build a air airport first. that airport within that airport we have runway. So runway is nothing but the landing zone for that airplane. Right? Similarly, if I want to let's say

[5:52:59] uh have a shop in my mall. So I need to first build entire mall and then within first build entire mall and then within that mall we will have different uh area square feet of of shops and according to the requirement of the c of the users or

[5:53:14] of the uh uh the shop owner they will buy their own shop. So in order to make sure that shop uh is is available we need to first build entire mall first. Similarly uh in the airplane uh in the airport terminology we need to make sure

[5:53:29] the runway is there so that my plane can land. Similarly in Azure we have landing zone concept where you can define all of your policies, define all of your arbback rules, define your ARM template,

[5:53:45] define everything and then deploy your application, then bring your application. Okay, so landing zone is just a concept in Azure where you can prepare Azure platform before landing your

[5:53:59] workload. So how to prepare? Obviously you need to define the policies that you want to come up with. You need to define who will have what rules. You need to define if you want to use tags and all. Right? So in Azure a simple everything

[5:54:13] is blended into this and you can create your own landing zone. So in Azure we call this as blueprints. So if I go to blueprints and there you can see >> um uh you can create a blueprint and there you can see all the landing zones.

[5:54:29] Okay. You can start scratch and you can define your own policies or Azure has given you some some uh samples like foundational

[5:54:41] landing zone, migration landing zone. Okay, common policies that it's like a best practice policies that you should be using. If your company wants to be be using. If your company wants to be ISO 2000 27,01 compliance, then you can

[5:54:55] use this landing zone. If your company wants to be have a shared services right if you want to create resource group with certain arbback so you can create this kind of landing zone. So if I select the foundation one [snorts] I'm

[5:55:10] just showing you uh this is nothing but the best practice landing zone that Azure has created. So you just have to give it a name like for example give it a name like for example foundation landing zone. Okay.

[5:55:22] And then where you want this uh location to be. So you can select management group or or subscription. So I'll select subscription here. Okay. I I don't see management group since this user simply user doesn't have access to that. Next

[5:55:36] in the artifact tab you can define all of the policies. So within subscription if you expand you see this policies append cost center tag. So tag will be mandatory uh tag will be mandatory for resource group. You will you are

[5:55:51] enabling monitoring. You will define allowed locations for your resources. resource group. So these are nothing but all the policies. So what landing zone is come up with different come up with whatever policy you want. If you want to

[5:56:05] add any policy later, you can add that as well. Like click on add artifact, select artifact type policy, then select what policy you want to you want to add whatever you want to do. Okay. So that policy is added. So what we are doing

[5:56:20] with lending zone we are making sure that we are compliant since we are asking people to add tags. So whenever people are creating is assigned since this policy will make it mandatory. Then we are enabling

[5:56:34] monitoring for all of our resources. We are defining which location to deploy the resources in. So these are all the policies. You can add as many policies as you want. Apart from that you're creating a resource group for shared

[5:56:48] services. So resource group will be created where keyword will be deployed, log analytics will be deployed, right? Another resource group will be created where all of your virtual networks will be deployed. Another resource group

[5:57:01] where you will be having identity service. So if you have uh domain controller or any other identity service, you can deploy it there. And then when you when everything is deployed there is an additional resource

[5:57:14] group where you'll be deploying your first application. All right. So landing zone is just a way or or or a way where you are you are um blending or adding all of the stuff that we have learned today like we are

[5:57:31] creating resource groups. We are making making the tag mandatory. we are applying certain policies that require for our uh our compliance then we are providing the arbback rule. So landing zone is just a

[5:57:47] logical you can say a logical way of making sure that your infrastructure is ready your platform is ready before you start adding the application. All right. If I want to provide any

[5:58:03] arbback role at at any point at let's say this resource group. So I can select the artifact type role assignment and I can provide owner role to any uh user or or any group or I can add it later as well once the resource group is created.

[5:58:21] All right. So that's something that you can defide beforehand before bringing your application. Now initially when people started using Azure this was this people started using Azure this was this concept was not there but uh Microsoft

[5:58:34] concept was not there but uh Microsoft introduced is introduced it very u in in a year or so when Azure Azure was there. So initially people were people were not aware of this landing zone thing. So they started deploying

[5:58:47] resources without considering the compliance and all. So blueprint is a way where you can define your landing zone first and once you have defined your landing zone you can bring your application. Remember

[5:59:01] landing zone is to be done uh before bringing your Once you have deployed your workload after that if you are bringing the landing zone you can still bring it but uh that that's not how it should be

[5:59:16] working. All right landing zone should be created first. It's like just consider it's like your plane in order to land the the airplane you first need runway you cannot land your plane right? So similarly landing zone is something

[5:59:30] that you should be uh creating first or deploying or making sure it's ready first before you bring your resources. All right. So that's about a landing

[5:59:42] zone. Yeah, you can create custom landing zone So you just need to go to blueprint and there you need to click on create. Okay, here you can define whatever you want. I selected the foundation one. It you have

[5:59:57] the option to start with the blank. Okay, just name it uh provide the uh location the definition location and start adding your artifacts. So I'll add what I want. I want policy, I want role, I want ARM template or I want resource

[6:00:13] group whatever I want. So if I want policy, I select policy from here. Add then again add artifact policy. Then I add again another policy whatever I add again another policy whatever I want. Okay. So you can select your own

[6:00:27] want. Okay. So you can select your own uh blueprint your own uh landing zone as uh blueprint your own uh landing zone as well. landing zone in real scenario. Okay. Have you understood what landing zone

[6:00:41] is? Forget about what is the use as of now. landing zone is? All right. So what we are doing in landing zone? We are just defining the policies. We are just defining the arback. Have you understood

[6:00:54] what is the uh requirement or use case of policy arbback in in real world to meet compliance you need to meet compliance what landing zone is giving

[6:01:07] landing zone what we are doing in landing zone we are just comprising or blending all this thing in into one thing instead [snorts] of doing this separately every now and then what we are doing we creating a landing zone and

[6:01:19] we are adding all this stuff at once so if you're adding all this stuff at once what when and after adding all this stuff and creating landing zone once you when on once you're deploying your resources you're deploying VM storage

[6:01:33] account or whatever now tell me these resources will be compliant to your resources will be compliant to your requirement or no

[6:01:45] this resource will be compliant to your requirement or no [snorts] the use of lending zone to make sure that whatever we are deploying is compliant. So next year when there is auditing uh audit auditor will will come

[6:02:00] compliant to whatever certificate we want whatever compliance requirement we logical thing where you are just comprising all of your policies that you want into one landing zone. So at future point in time if you want to see all the

[6:02:15] policy you can see all at in central place what is assigned what is not assigned. Okay.

[6:02:27] landing zone is. So when I deploy any resource that resource will be compliant every company will have their own requirement. Every company will have their own compliance requirement. So depending on your compliance

[6:02:41] requirement, you'll be adding policies over here. Whenever people are deploying resources, that resource should already be compliant. Why it's compliant? Because if that resource is not meeting certain policy, the landing zone will

[6:02:54] not allow that user to deploy that particular resource without meeting the compliance whatever you have defined here. Okay.

[6:03:12] zone. Foundation landing zone is just just for you to understand what landing zone is. I'm not saying that you need to apply the foundation lending zone at your organization. Okay? You need to understand first what lending zone is.

[6:03:25] Lending zone is a blueprint of your Azure platform of your cloud platform. Within that blueprint, you're defining what I should be deploying, what I should not be deploying. So if I go here, I can define the location. This is

[6:03:38] my subscription where landing zone is being applied. I click on next artifact. And here I'm defining what policies I want to deploy. So I select all the policies. For example, I don't want to deploy high configuration virtual

[6:03:55] machine. So I restrict that using a policy. I want to make sure that tagging is in place. So I select any policy related to tag. I select that and I add tag over there. So what I'm doing here? I'm preparing my platform. This is my

[6:04:10] Azure platform. I'm adding certain restriction. So and so VM is not allowed. So and so location is not allowed. So and so uh skew is not allowed. Making sure monitoring is enabled. Making sure we

[6:04:24] defined here as a landing zone. Landing zone is not a physical thing which I can touch and see. Okay. Now once I have defined all this thing then my team whoever is responsible for deploying resources when they start deploying the

[6:04:39] resources that resource will be evaluated against all this policy and all this requirement which is defined over here. If it's meeting that policies and that requirement then only the resource deployment will be allowed. If

[6:04:52] it's not meeting it will throw some error and ask the user to fix and then error and ask the user to fix and then user will deploy. Okay. So why why we want to do that? Because we want to make sure that whatever resources is being

[6:05:04] deployed is compliant compliant to the requirement. Okay, that's what the the meaning of lending zone.

[6:05:21] a project. It's just an example how you can use landing zones in real world. All can use landing zones in real world. All right.

[6:05:38] traffic enters. See traffic is is a network part right landing zone is just def definition of policies and all where you're defining everything. Now where traffic will enter that will define at your network level. These are not the

[6:05:51] network related policy. These are the governance related policies. [snorts] Suresh is saying okay you means to say if I select 27,0001 the compliance will meet according to 27,0001

[6:06:06] or else it won't allow us to create as like in 27,0001 what is defined what is required to meet that particular certificate that particular ISO certificate. So if I select that there will be certain policy which Microsoft

[6:06:20] will be certain policy which Microsoft has already defined. Okay. So uh first I subscription and when I go to the artifacts

[6:06:35] added certain policy which will make sure you're meeting ISO 27,01. So whatever is defined in that policy if you're when when you're deploying your resource if that meeting that criteria you're allowed to deploy. If it's not

[6:06:48] allowed. So if the resource is not deployed obviously the auditing is is not in the question here. Okay. If resource is deployed and it's not meeting certain criteria then you're not compliant. Your your whatever you're

[6:07:02] doing is non-compliant. And when ISO team comes to audit your organization or your platform they'll see that you're not compliant. So if you're using this will make sure that whatever resource you are using is compliant to this

[6:07:16] particular policy. whatever is defined in that policy. in that policy. Okay.

[6:07:28] subscription or the management group level. So it's it's nothing but policies arbback and everything. It's not something fancy or something new or you're deploying. It's not a physical resource. It's a logical thing. Okay. So

[6:07:43] if you see the definition location here, this is nothing but the scope. You can keep it at management group, at subscription, at resource group. Okay, management group and subscription not at the resource group. Okay,

[6:07:59] it's similar to what you do with policy. With policy what you're doing where you can apply your policy at management group or at subscription. Same thing with the blueprint. Same thing with the landing zone. Okay,

[6:08:19] rules or res uh predefined uh rules or conditions that this is deploying your resources, those conditions will be evaluated.

[6:08:31] If your resources are meeting those conditions, resources will be allowed to deploy. If not, uh resources won't be deployed. there would be some error like like I'm trying to deploy resource group right now and it's not allowing me right

[6:08:44] why it's not allowing me if I click on create resource group and I I put it in central India it's not allowing me to deploy why what is the reason why it's to do is non-compliant to my organization

[6:08:58] what I'm trying to do I'm trying to deploy something at central India which that's why I'm not allowed to do similarly landing zone will do the same thing it's not something new it's not something different okay it's just that

[6:09:12] you're blending your policies with your arbback with your arbback and uh with the if you want to deploy anything in in in in uh freehand you can use ARM template and all to deploy

[6:09:25] things okay so all these things are blended together and it's called as landing zone that's all okay okay Clear.

[6:09:41] the location. That's all. And now I'm compliant.

[6:10:08] this. So if you can open this uh and go to governance. So here we have the case to governance. So here we have the case study.

[6:10:40] uh I know this case study is asking you to design uh a governance solution for your company. So let's read through it. So, Tailwind Traders again this is the fictitious fictitious company that we

[6:10:54] will be using and Microsoft uses this name for defining anything right. So, some significant changes to their governance solution. They have asked for your assistance with recommendations and questions. Here are the specific

[6:11:08] requirement. Cost and accounting. Telvin traders has two main business units that handles apparel and sporting goods. Each of the business unit consists of three departments. Product development,

[6:11:22] marketing and sales. Each business unit and subunit will be responsible for tracking their Azure spend. At the same time, the enterprise IT team will be responsible for providing companywide Azure cost reporting.

[6:11:37] project. The company has a new development project for customer development project for customer feedback. The CFO wants to ensure all cost associated with the project are captured. For the testing phase,

[6:11:49] workload should be hosted on lowerc cost virtual machine. The virtual machine should be named to indicate they are part of the project. Any instance of the non-compliance with the resource consistency rules should be

[6:12:03] automatically identified. So these are the task. So for cost and accounting what are the different ways Telvin traders could organize their subscription and management group which would be the best to meet their

[6:12:15] requirement design alternative hierarchy and explain your decision make decision-m process. So what you need to do here is you just need to come up with the management group hierarchy for cost and accounting for this Telvin traders.

[6:12:31] Okay. So what they have mentioned is you need to come up with two alternative hierarchy and explain your decision-m process. Then for the new development project what are the different ways Telvin traders could track cost for the

[6:12:44] ensuring compliance with the requirements of virtual machine sizing? Uh propose at least two ways of meeting the requirements. Explain the explain your final decision. So in simple you

[6:12:58] just need to come up with with a management group strategy. Okay. How you'll be defining the management group. So what I'll be doing is the main tenant

[6:13:10] root group. Obviously you'll be having it behind within that tenant root group I'll be creating a management group with Telwind traders. Then it's totally up to Telwind traders. Then it's totally up to you. You can divide it as per the

[6:13:24] the uh unit business unit apparel and sporting goods or you can keep everything in same business unit and divide it on on the uh subscription level. Okay. So what I'll be doing here apparel this is one management group and

[6:13:41] then sporting unit this is another management group. Then within this business unit you have three department product development, marketing and product development, marketing and sales. Each business unit has this uh

[6:13:53] this department. Okay. So what you can do you can again create three management do you can again create three management group if you want having uh product development. Here you'll be having marketing. Here you

[6:14:08] you'll be having sales. Sim similar here product development, marketing and sales. And then you'll be having each sub each subscription depending on what subscription is not mentioned over here. Okay, since they are saying that each

[6:14:22] responsible for tracking the Azure spend. So it's better to have a separate subscription for each or else you can have a single subscription subscription you don't need to have three different management groups over

[6:14:37] here. So another strategy could be like this tenant root group Delvin traders and then two business unit apparel and uh sporting apparel and sporting and then you can have one subscription each okay within each subscription in order

[6:14:52] okay within each subscription in order to track the cost. You can use tags and all okay in order to separate the top if you're going with single subscription. But here they they mention that uh each subunit will be responsible for tracking

[6:15:06] their Azure spend. So it's better to divide them into three different subscription which will be easier for you. Why it will be easier? Because one subscription will have cost and you can simply put that in their cost center

[6:15:19] right. So I can have three subscription like this is for product development, like this is for product development, this is for marketing, this is for uh for sales. Similarly in uh sporting unit I'll have three different subscriptions.

[6:15:31] So either you can divide them in three different management group then have one each one subscription each or you can simply put subscription within the main management group. All right. So these are the two different uh hierarchy you

[6:15:45] can come up with. It's totally up to you which you want to go. Okay. different ways Tailwind traders could track the cost. So again you can have a

[6:15:57] track the cost. So again you can have a new management group here for uh new development project. I I'll mention that as NDP. Okay. How are we going to ensure the compliance? Obviously we need to use policy. So you can just mention here as

[6:16:11] your policy. Okay. And if you have any other way you can come up with that way as well like you can put management group and then subscription or directly subscription. Totally up to you. All right. just go through this uh

[6:16:26] subscription uh case study and come up with a solution and uh I I did not get any solution from you guys for the last case study. So you need to go to draw io and come up with a solution and send me that solution over the email over my

[6:16:42] personal email. All right, like this. So you did not came up with like this. So you did not came up with any solution.

[6:16:54] management group. Same thing what what what I explained. Same thing what what what I explained. Okay.

[6:17:15] Somewhere you should have management groups.

[6:17:42] be main management group. You can add a tagging or something. So you can add a text over here. So this is let's say my tenant root group. Obviously

[6:17:57] I can increase the font and all that I leave to you. Okay, this is my tenant root group. Then I can copy paste to have the same thing here. This is my Telvin traders just rename. Then I can have additional management group. So

[6:18:11] just similar to what what you're seeing over here what what I what we discussed right now you need to come up with that solution. Okay is asking how to get Azure icon. So in order to get Azure icon you first go to

[6:18:27] draw io app diagrams.net net and then from there you can simply click on more shapes here and here once you click on more shapes you should get Azure just take check this box Azure and click on apply so you should get the Azure icon

[6:18:42] okay all right any questions on case study or questions we can move on to the next topic so next topic that we have is topic so next topic that we have is design compute service okay so if you go

[6:18:57] design compute service okay so if you go to a305 5 study guide or a 305 to a305 5 study guide or a 305 uh learn path. This is this is the topic that we are covering right now.

[6:19:09] So we have completed this except monitoring. So monitoring we'll be doing everything. So we have covered governance, we have covered Monitoring is pending which we will cover at the end once we have done with

[6:19:23] all the solutions. Now we are moving on to the infrastructure solution. Design design infrastructure solution we are going with the compute solution design

[6:19:36] and Azure comput solution. This is the this is the chapter topic which uh topic this is the chapter topic which uh topic we we are covering right now. Okay. All right. So before we start I just need an answer from you what is a

[6:19:49] compute service? Now we have seen uh in basics of cloud computing that cloud computing is nothing but the delivery of compute services over the internet. So what that compute service mean? What is compute service?

[6:20:15] what only VM is compute service. What what is that compute service? someone says compute, compute is nothing but the computation

[6:20:29] but the computation uh services like like memory which is uh services like like memory which is nothing but RAM. Okay. Uh CPU right and then uh storage. So these are the three thing which comprises of

[6:20:43] compute service. In simple if someone ask you what compute service is. So compute is just the home to your application. Okay. Compute service is nothing but home to your application. Compute is

[6:20:58] actually where application lives. What is application? We have discussed is quite simple. Application is nothing but list of files. So when developer codes they codes in a file. So you'll be having file like if developer is writing

[6:21:11] in Python they'll be having certain py. If they're writing in net, they'll be If they're writing in net, they'll be having some C related files, right? So these files are nothing but the actual application and in order to make sure

[6:21:23] your application run using a runtime, you need a home for that. So that home be anything that can be a virtual machine, can be a physical machine, can

[6:21:35] be app service, can be a container. So there are different different compute services available in Azure. That's what we are going to see uh in this topic in this chapter. All right. So in simple compute is home to your application. Now

[6:21:50] remember one thing whatever we will be learning and for whatever reason the whatever reason the infrastructure background is out there is because of the application. If there are no applications in the world if there are

[6:22:04] no web app there are no desktop app then it is not required. Okay. Business can can happen physically by by making a physical uh building a physical shop and asking customer to come physically there. Right? If there's no app, we are

[6:22:20] not required. Cloud is not required. On-prem infra is not required. So whatever we are doing is for the app. All right? So application in order to make sure your application can leave you need to have a compute

[6:22:32] service in place. And in Azure what compute services we have that's what this topic is about. We have a lot of compute services. So just to describe or or make you uh make you intro introduced to the compute

[6:22:49] services. These are all the compute services we have in Azure. Virtual machine app service Kubernetes service Azure function Azure batch logic app. One is missing which is Azure container instance right ACI. So if you

[6:23:04] see every compute has its own dedicated section. So I'm not explaining each and every service here. I'll keep it to it own u dedicated slide. All right. for

[6:23:17] own u dedicated slide. All right. for this slide. Is it clear what compute service is? For me to keep an application, for me to make sure that my application, for me to make sure that my application uh can be accessed by the

[6:23:30] people or my application actually can run, I need to have compute service in place. All right. So in that compute service which is nothing but home to my application, I'll keep my application

[6:23:42] and application nothing but files. Is that clear guys? what compute is. compute service, not all comput service are meant to keep the application. Okay.

[6:23:58] Uh not all comput service are meant to host the application. Like out of this six services, the first three services Azure virtual machine, Azure app service and Kubernetes service are the services where you you'll actually deploy your

[6:24:14] application. Okay, rest are are different. They're not they're not mean to host the application. Okay, so we'll see what is the difference and what what each compute service is used for.

[6:24:29] So which compute service to choose from? There's a there's a long or or a big uh you can see a flowchart that Azure has created. Now which one to choose at at what point in time? uh this flowchart will help you to decide but apart from

[6:24:45] that if you sit until the end of this comput obviously today uh I don't think so we'll be able to complete or or cover all the services but tomorrow we we will be done with this compute section so tomorrow once once we are done with the

[6:25:00] compute section you'll be able to identify or define or uh take a decision on which compute service to use for your for your work or for your use case. All right, but let's go through this flowchart and see which compute service

[6:25:15] flowchart and see which compute service to choose at what point in time. So from here you are starting. All right. The first question is are you migrating from on-prem or I mean from anywhere not only onrem or you are

[6:25:27] building new. Okay. So if you are migrating go this way. If you're building new go this way. All right. So let's say we are migrating since when I started my Azure career most of the customers were migrating and

[6:25:43] I helped my second or third company to migrate. we had the uh everything in in data center in Australia. So we migrated it to Azure since we were going global. So if you're migrating these are your

[6:25:58] options. Okay. So let's come over here and see. Now once you say yes we want to migrate. So th this way you need to go left side and here are you doing a lift and shift or you are doing cloud optics. Lift and shift is like whatever your

[6:26:13] application's condition today is, you're just using asis and you're just shifting changing anything. Okay? You're just lifting your application from onrem, lifting your application from onrem, AWS, wherever it is, however it is. It's

[6:26:27] written in old u old format or old framework. You're just using that framework and shifting it to Azure. That's all. Okay. So if your answer to lift and shift is yes, you'll go this way. If your answer to cloud optimize is

[6:26:44] yes, you'll you'll go this way. Okay. So let's consider lift and shift. So I I'll go I'll go this way. Now once you're lifting you're using lift and shift is your container using uh I mean is your application containerized? That means

[6:26:59] are you using container platform? So if you're using container platform, you go this way. If you're not using container platform, you go this way. So let's say we are not using container platform. So if you're not using container platform,

[6:27:11] if you're not using container platform, we have two options to choose from. Azure app service or Azure virtual machine. Okay. Now when this yes and no is happen is whether your application is is web app or API. So if your

[6:27:25] application is just a API or web based, you can go to app service. If it's not, you can go to virtual machine. If your application is containerized, you again have two or three options. You can go for Kubernetes services. You can go for

[6:27:41] Azure app service again with container option or you can go for Azure container Okay, it's mentioned here somewhere here. All right. So these are the three options you have when your application is containerized.

[6:27:55] are migrating, you have this these options. When you're migrating your application to Azure, you have these options. You can make use of virtual machine. You can make use of Azure app service. You can make use of Kubernetes

[6:28:08] service or you can make use of Azure app service with container. These two options are only valid when you are doing containerized application. That means you're using Docker or any other container platform and you have

[6:28:21] containerized your application and you're deploying it as a container. So either you can use EKS as your Kubernetes service or Azure app service. If it's not containerized then you have left with virtual machine or as your app

[6:28:33] left with virtual machine or as your app service. Okay. you're building new. So if you're building new obviously you have all the options. Now which option to choose when do you need full control?

[6:28:47] Do you need a full control on operating system? Do you want to make uh uh system? Do you want to make uh uh control your operating system like every using Windows operating system, you have to patch it. Even Linux you have to

[6:29:02] patch it. So do you want those kind of full control? If yes, virtual machine is the option for you. Okay, as I mentioned, your application is not hosted on Azure batch service. But do you require the HPC workload? HPC stands

[6:29:16] for high performance compute. So do you need that kind of workload? Uh do you require high performance? Mostly you'll be using it for for when you are processing big huge amount of data. So for your big data pipeline and all

[6:29:30] you'll require HPC. Do you require that kind of workload? Then you go for Azure batch service. Are you using microser architecture? Same. Are you using containerized application? Okay. Micros service

[6:29:42] architecture. If yes, you have a zero container instance, service fabric or container instance, service fabric or Kubernetes services. Okay. Uh if no, if if you want to go with eventdriven architecture, you have Azure functions

[6:29:56] or logic app. Okay. Logic app is not mentioned here, but that is also used mentioned here, but that is also used for for event driven. Okay. And the last one which is Azure app service. It's like a platform as a service. uh

[6:30:12] platform as a service that that that you can use like you don't want to have you operating system that means you you want to uh outsource the patching and all to Microsoft. So in this case you can make use of your app service. Now I see it's

[6:30:27] it's overwhelming obviously you can't get entire workflow or entire flow chart get entire workflow or entire flow chart in in just 5 minutes. But as soon as we go to go through each service uh we'll revisit this this flowchart again at the

[6:30:42] end and at that point in time obviously it will make sense for you. Okay. So before I move on to the first compute service any questions on the compute service for now you just need to understand that compute service is the

[6:30:55] home to your application. That's all any questions on this before I move to any questions on this before I move to the first service that we have.

[6:31:12] you mean by storage also? See, we are not uh understanding so storage as of now. We're just understanding the compute. That means where my application will be running or hosting. Okay.

[6:31:26] We're [snorts] not migrating. If your question is related to migrate, we we are not migrating storage as of now. Okay, for storage we have a dedicated chapter. You'll your questions will be cleared there. Uh how storage is handled

[6:31:40] when it comes to hosting an application. Okay. So under lift and ship we are not migrating storage as of now. It's just application related things. All right. So let's go on to the first

[6:31:55] topic which is Azure virtual machine. This is the simplest uh you can say simplest compute service available in Azure that you can use to host your application. Now I'm I'm damn

[6:32:09] sure that everyone here might have worked with Azure virtual machine or if worked with Azure virtual machine or if not you might have worked with uh EC2 M not you might have worked with uh EC2 M uh MS Amazon web services EC2 right or

[6:32:21] virtual machine or VMware virtual machine if you haven't worked with any just consider this virtual machine as your own laptop but running on Azure

[6:32:33] like it's not a physical laptop it's a virtual laptop running somewhere on virtual laptop running somewhere on Azure your data center. Okay. So what is virtual machine? Virtual machine is software computer running on Azure as

[6:32:45] the name specifies virtual. It's not a physical thing. It's a virtual machine. All right. So it's a virtual software virt sorry software computer. So what this virtual machine gives you? This virtual machine gives you the storage

[6:33:01] like in our laptop. What do we have? We have hard disk, right? So what that hard disk does? It allows us to store something. Similarly, this virtual machine gives me storage where I can keep certain files like operating

[6:33:14] system. Obviously, my operating system will be there. Apart from operating system, I can add additional discs and I can keep my application related file if can keep my application related file if I want to. That's not mandatory. You can

[6:33:26] I want to. That's not mandatory. You can keep your I mean OS will be the uh the default disk that you'll be getting. Apart from the default disk, if you want to add additional disk, you can add to keep your application data. Right? So,

[6:33:39] cloud-based ondemand scalable computing instance that uh you can deploy whenever you want. You can decommission or delete it whenever you want. So, it's an ondemand compute. You

[6:33:56] need it, deploy it. You don't need it, just delete it. Okay. So, what are the features? virtualized computing. You don't need to and then create a virtual machine. You simply go ahead and create the

[6:34:10] virtualized. Just deploy it using Azure portal, PowerShell or CLI whichever is portal, PowerShell or CLI whichever is whichever you prefer prefer. The usage is to host an application. So you'll be having OS. So it supports Linux as well

[6:34:23] as Windows. Whichever is your preference. you when you're creating or deploying a virtual machine you just mention Azure that I need Windows or I need Linux and once you have Windows or Linux installed on top of it you can

[6:34:36] deploy your applications okay scalability for it's scalable as this is one of the feature or benefit of cloud computing so any point in time if I feel

[6:34:49] computing so any point in time if I feel that 2 GB RAM is not enough for me I can scale it to 4 GB or 8 GB whatever according to my requirement. So scalability is the feature that you get when it comes to compute

[6:35:03] virtual machine networking. I have the option to uh define who can connect, who cannot connect. Okay, who as in which IP can connect, which IP cannot connect. So that's something that we can define. So networking is attached with it.

[6:35:18] management you can manage like login you can take a remote access of this virtual machine and manage it or certain management like changing the size and all you can do it directly from Azure portal or cla powershell okay billing is

[6:35:33] portal or cla powershell okay billing is a pay as you go so you will be build hourly so if I keep my virtual machine deployed uh for let's say 24 hours so I'll be

[6:35:48] paying for 24 hours. Okay. Next day I stop my virtual machine. I'm not running machine for the compute. For storage obviously you'll be paying. Okay. With storage the the disk that that is that is deployed. So for disk I'll be paying

[6:36:03] but if I keep it stop I won't be paying for the compute. All right. So it's pay as you go. Apart from pay as you go you can reserve virtual machine for like 3

[6:36:15] years. So there are reserve plant. So if I if I want to reserve I can reserve the virtual machine. So I can go to reservation and reserve. Obviously my subscription doesn't support it. But if your subscription

[6:36:29] supports it, you can reserve virtual machine for 3 years. Okay. Right now my it won't show. But you can reserve it subscription is not eligible. So my subscription doesn't support it. But if

[6:36:43] I reserve it, I'll be saying saving around 40% of the pay as you go cost. can see this uh here.

[6:37:06] and if you see here if you see here if you go for reserve plan so everything which size you are choosing you go for 1 GB RAM this is the normal cost this is

[6:37:21] the saving plan this is again threeear saving plan so if you go with threeear saving plan so if you go with threeear saving plan you'll be having around 54% saving plan you'll be having around 54% of savings okay

[6:37:33] this Question from Mustach. When should we reserve and when to pay as you go? Okay. Do you want to save money [snorts] for your company? Do you want to save money? So if you want to save money, go for reserve plan. You'll save

[6:37:48] around what 54%. Now when to decide whether we should go for reserved or not? You ask your project manager is this project going to be running for at least 3 years? If he says yes then go for

[6:38:02] threeear saving plan. So you'll save you'll save 54%. If they're not certain you'll save 54%. If they're not certain that we might close this project in one one year or so. So don't go for saving plan. Pay as you go. Okay. Totally

[6:38:18] depends on project by project basis. Are you going doing are you deploying a virtual machine for just quick test? If yes, don't go for reservation plan. Go for pay as you go. Since I'm I'm I'm doing it for testing and I'll be

[6:38:31] decommission decommissioning or deleting it in in after 3 months 4 months whatever right. So at that point in time just go for pay as you go. Okay. just go for pay as you go. Okay. [snorts]

[6:38:48] why it's reserved. If you want if you are sure if you know that it you you are not going to use it for 3 years reservation is not for you. Okay? just go for pay as you go since reservation uh you can't cancel it. If you can there

[6:39:03] uh you can't cancel it. If you can there will be certain cost. Okay. Uh so it will charge you more as pay as you go if you cancel it before the contract. All you cancel it before the contract. All right. [snorts]

[6:39:20] Okay. So coming back to the topic I'll I'll take the questions later. VM sizes. So there are different types or family of VMs uh available in Azure. All right. First one is general purpose. So general purpose is mostly like for not for

[6:39:35] production use. Okay. You can use it but it's not recommended for production use. it's not recommended for production use. It's used for uh dev test uh demonstration like the trainers are are are

[6:39:50] encouraged to use general purpose VMs for demonstration purpose. you will be deploying virtual machines. So you should use general purpose or or your hands on right. So this general purpose are for dev test or demonstration or

[6:40:04] those kind of things. Compute optimize will get a powerful CPU uh to memory ratio. Okay. So you'll get more processing power as compared to

[6:40:16] memory. So you'll be getting a good CPU as compared to memory when you go for compute optimize. Okay, in memory optimize you'll be getting powerful memory. So your memory processing would be more as compared to CPU. So where

[6:40:30] you'll be using memory optimized. So memory optimized can be used when you want to host a database. So you need to create a database server. So we know that we need a powerful memory for database. So SQL DB, MySQL, whatever

[6:40:44] database engine you want to install on a VM at that uh for for that scenario. If you're using a virtual machine then you go for memory optimized virtual machine. Compute optimize when you need more processing power like you want to host

[6:40:58] an application. So we know that uh in order to host an application we need more compute we need more CPU. the CPU can process those requests quickly, right? Or else if you're using a virtual machine for a solution where you are

[6:41:14] encrypting or decrypting or you're working with SSL quite often, then you go for compute optimiz since encryption removing encryption working with those algorithms requires a more CPU. So we go for CPU for that. CPU compute optimize

[6:41:29] for that storage optimize where your IOPS input output operations per second uh will be optimized. So if you go for storage optimize so where you can use storage optimize for example my company is

[6:41:43] coming up with something some service like Google drive where I'll be storing people's data. So when I'm storing people's data when they are trying to access I need to make sure that data is readily available. So in that point in

[6:41:58] time I I would be using storage optimize or let's say my company is creating a SAN kind of solution for my internal software or for my internal environment software or for my internal environment or organization. So sand kind of

[6:42:13] uh solution requires good throughput and good input output operations per second. So at that point in time you can go for So at that point in time you can go for storage optimized. Okay. Then you can go

[6:42:26] for GPU. GPU stands for graphic processing unit. So when you are when you want to work with graphical images or videos where you want to make sure that whenever people are rendering something it should be fast. So at that

[6:42:42] point in time you can you can go for GPU like for example gaming servers or um nowadays uh uh artificial intelligence right llama or something you want to host so you can go for GPU. Uh then the last one we have is HPC

[6:43:00] which stands for high performance compute. So if I need high performance compute like I'm coming up with my own big data pipeline and I want to use virtual machine for that. So I can go for HPC kind of size of virtual

[6:43:14] machines. Apart from that there are lot of lot of other sizes available in the in in the Azure portal or in the Azure platform. But these are some sizes that you should you should know. Okay. Once again you have general purpose which is

[6:43:30] for dev test kind of environment not meant for production. Compute optimize where you need high CPU right I need more CPU power. For example I'm hosting working with something known as encryption decryption and application

[6:43:45] want to process that very quickly. So I need high CPU there. Memory optimize when you need more memory. Okay, I mean powerful memory, not more memory. Powerful memory. Uh so if you're hosting a database kind of thing um where you

[6:44:00] require more memory then you can go for uh memory optimized storage optimized where you need good storage like for example you're coming up with sand of thing or Google drive kind of thing where people are storing and you need a

[6:44:15] where people are storing and you need a quick read write access to that to to to that data which is written over there. So you can go for storage optimize GPU graphic processing unit where you need more more graphics like gaming servers,

[6:44:27] more more graphics like gaming servers, AI rendering, marketing materials, HPC come up with your big data pipeline and all kind of things and you want compute for that you can go for HPC uh type type of Azure virtual machine.

[6:44:43] Okay. Then if you want to create clusters of virtual machine then in Azure we have something known as virtual machine scale sets. So virtual machine scale sets are like deploying virtual machines as a group of virtual machine

[6:44:56] like a cluster. So you'll be deploying more than one instance. Why we have scale sets over here? If let's say I'm hosting my application in one virtual down what is going to happen? My application will be impacted. Right? So

[6:45:10] if I don't want to do that what I can do I can deploy that virtual machine scale set instead of single virtual machine in instead of individual virtual machine I deploy more than one virtual machine as a scale set and in that case Azure will

[6:45:24] goes down another one will be created by availability which means if one of my virtual machine going down it's not impacting my application since my application can

[6:45:38] still serve the requests coming in from user uh using additional instances. All right more on this later we have a dedicated slide for virtual machine scale sets as well when we go to the high availability uh concepts. Okay. But

[6:45:52] like a group of virtual machines that you're deploying together and if one virtual machine goes down, you still have uh other virtual machines which have uh other virtual machines which will serve your requests. Okay.

[6:46:06] Now main thing when to select Azure virtual machine quick test you want to do a very quick test of your application whether it will be running or not. What issue can what issue you can have right HPC kind of workload. So if you want

[6:46:20] high performance compute then obviously you cannot go for other compute instances. Obviously batch solution supports it. Apart from batch solution other will not be able to support it. So you can go for a virtual machine. Legacy

[6:46:33] you can go for a virtual machine. Legacy app. Legacy app is old applications which are not supported in which are not cloud native or cloud optimized. So you can go for virtual machine in that case and you need a full

[6:46:48] control over operating system. So with when you deploy a virtual machine you can log into the virtual machine and you can install whatever software you want. So you have full control over the operating system. Okay. Now this is the

[6:47:02] excerpt from from that flowchart. machine when you are building a new application or you're migrating uh and using lift and shift. So if you're

[6:47:14] require full control go for virtual machine. When you're migrating and using lift and shift can you containerize it? If no can you use web app or API app? If no then you go for virtual machines. Okay. This

[6:47:29] you go for virtual machines. Okay. This is the same ex excerpt from this flowchart. All right. So before I go to the portal, All right. So before I go to the portal, any questions on this?

[6:47:48] for dev and uh dev environment. So dev environment you go for virtual machine environment you go for virtual machine [snorts] shutting it down during non-b businessiness hours. So which will save

[6:48:04] money for you. Okay. If you keep virtual machine doesn't matter whether it's general purpose or any other family size uh any other VM family if you keep it running for 24/7 you'll have you'll pay extra even when you're not using it. So

[6:48:18] it's better for dev test environment you use virtual machine and then uh use general purpose virtual machine and then make sure it's shut down when it's not in use. [snorts] Okay,

[6:48:33] Okay, Mustach is saying VPS are cheaper. Okay, which probably

[6:48:52] is asking what other applications installed in VM after OS in real that's up to you what applications you wants to install. By default, there won't be any. By default, when you create a VM, when I'm creating a VM, only OS will be

[6:49:05] installed. That's all. Apart from OS, nothing else will be installed. So, what application you need, you can deploy. That is the meaning of full control. Okay? So, when you go for virtual machine, you have full control. You can

[6:49:18] machine, you have full control. You can deploy whatever you want. All right? So, by default, there won't be anything. So if I select Windows OS installed. Softwares will not be installed. If I need additional

[6:49:31] softwares I can install it afterwards once I have access to the V. Okay. Any questions before I move on to the portal.

[6:49:50] policy and I remove the policy of that central India. central India. Same thing sir, since I want to uh Okay, before I delete, if you see the overview page here, you should this you

[6:50:03] compliance? The meaning of compliance is what our policy is saying. Our policy is saying that you should not have resources in central India, West India policy compliance, I have three resources out of which two are

[6:50:19] compliant, one is non-compliant. That means one is still in central India. So that's the kind of audit or compliance report you get when you use uh policy. Now since we only have one policy, I see this kind of compliance. You'll be

[6:50:34] seeing percentage kind of thing like for example here 14%. example here 14%. [snorts] All right? So this is where the [snorts] All right? So this is where the uh policy comes in place to define or to

[6:50:48] see your compliance level before the audit obviously. So you can make sure audit obviously. So you can make sure that you are uh 100% compliance to whatever requirement your your company or your clients are giving to you.

[6:51:03] All right. So let me remove this policy now. I don't need it.

[6:51:15] have any compliance in in some time this compliance will go away since you don't have policy. Okay. [snorts] All right. Now let's see our first demo of compute section. So here what I'll be doing I'll be deploying a virtual machine and

[6:51:29] within that virtual machine we'll deploy a very simple application. It's not an application it's a simple uh static website. So I'll be deploying that. So let's see that and I'll be using using same static website to deploy it in all

[6:51:42] compute services whatever we are going to cover whatever demo demo we are going to cover whatever demo demo we are going to see. Okay. So let's see that quickly. So what I'll be doing in order to create a virtual machine you need to

[6:51:55] uh search for virtual machine and then click on virtual machine and then click on create. Okay. So as usual uh with any resource the

[6:52:07] first two things will be will be common and mandatory. So you need to provide subscription and then you need to provide resource groups. Right. So which subscription Azure should Azure should charge you and which resource group you

[6:52:19] want this virtual machine to be part of. Okay. So I'll be selecting Azure training subscription and that's the subscription I have access to. and resource group I can create new if I don't have one but if you remember we

[6:52:33] created a resource group with the name A305 RG02 so I'll be selecting that resource group okay you can select whatever resource group you want but remember one thing when you deploy a virtual machine

[6:52:46] everything will be deployed under this resource group now with laptop when you buy a laptop what do you get when I buy a laptop with this laptop within this laptop we have a keyboard here we we have a CP CPU installed on the

[6:53:00] motherboard, right? We have the storage. So, we have some SSD or HDD and then we have virtual uh sorry physical nick as well the network card. So, network interface card is also added to to the keyboard. So similar to sim similar to

[6:53:15] keyboard. So similar to sim similar to laptop here also you will see the disk is getting uh created with disk you will be having virtual nick since this is a virtual machine you'll be having virtual network interface card right and then uh

[6:53:30] CPU will also be allocated the virtual CPU will also be allocated to this virtual machine so all those stuff will be in the same resource group then next machine name so I'll go with a simple name. So let's consider this is my web

[6:53:46] name. So let's consider this is my web server. So I'll give it a web server 01. world, what name you'll be giving? Totally depends on your naming convention. Whatever what I have seen in the real world is

[6:54:01] people use uh the environment uh the environment pro what this server is. This server is web server. So they use web SRV and then what is the number of this web server 1

[6:54:14] 0 some some people add the region as well like for example this is deployed in central India so CI gets added and then the number 01 so that's how uh the naming convention would totally depends on company to company basis so someone

[6:54:29] on company to company basis so someone can have like this proderver some some have this some have just prod web server totally depends. So we we'll

[6:54:44] keep it simple and we'll go with web server 01 or web server. [snorts] All right then region. What is the region? Region is a physical location where you are deploying the virtual machine. Now you're using Azure portal.

[6:55:01] So this is the cloud portal which we are using to deploy our virtual machine. But this virtual machine is not sitting in my home. sitting at my home. What we are doing, we're deploying it somewhere on Azure data center. Okay, it's cloud.

[6:55:14] What is cloud computing? Your data on someone else's data center. Your data on deploying this virtual machine in Azure's data center. So, Azure has data center all over the all over the world. So, central India is one of the region

[6:55:29] So, central India is one of the region in Azure. So, that's what we are see we are selecting here. Okay. Then availability option uh I'm not selecting one and I'm not explaining right now since we have the high availability

[6:55:43] since we have the high availability uh topic later when we do the network thing. Okay. So we have that topic. So we'll cover it there. But uh you can high availability. If I want to deploy more than one virtual machine of the

[6:55:57] same thing then I can make use of these availability options. All right. availability options. All right. Security type. If you want to make uh you want to have basic security, you want to have like uh TPM, TPM is used

[6:56:10] for Bit Locker, you want to have secure boot, right? You want to have more security against uh the type of attack that is being launched against the cloud virtual machines. So if you want to have if you want Azure to protect it against

[6:56:23] those kind of attack, you can go for trusted or you want to have totally confidential uh virtual machine, you can go with with this as well. Okay. Now for our use case we can go for trusted launch and in real world as well you can

[6:56:37] go for trusted launch since that's quite secure and trusted launch gives you the option to encrypt the the discs the virtual disk that you're going to get. Okay. Then image. So this image will help you define whether you want the uh

[6:56:54] Windows operating system virtual machine or Linux operating system. Now there are a lot of images like if you see we have Windows server, we have Ubuntu, we have SQL server, we have again 2022 Windows server. Okay. Apart from this you can

[6:57:11] see all the images available in the marketplace. You can come up with your own image as well. You can create your own image, push it to the gallery and [snorts] Okay. So these are all the images we

[6:57:26] have. These are all the marketplace images. Some images uh might have extra cost. So cost will be mentioned over here. Okay. Like for Red Hat the license is included or not. Once you select it, it will tell you whether the uh cost is

[6:57:41] not compatible with the security type that I have selected. So I need to change the security type. Okay. And at the cost page once I go to the review create it will tell me whether uh the cost is separate or uh the license cost

[6:57:56] is separate or or it will be included in the image itself. Okay. So I'll go for Windows Server 2025 data center since we want the Windows machine. So I'll I'll select the Windows Server 2025 data center which is the

[6:58:11] latest server operating system from Microsoft. All right. And then you have size here. Okay. What is size? Size will decide how many CPUs you are going to get and what amount of RAM you're going to

[6:58:26] and what amount of RAM you're going to get. 8 GB. Okay. 8 G. And then there's a estimated cost. So if you keep your virtual machine running for 24/7, how much you'll be paying? All right. So I'll go for B2MS or or D2 SV3.

[6:58:42] These are the options I have selected. Then once I create the virtual machine, you have your laptop. Uh in order to go into the laptop and do any changes, you need to provide uh um username and password. Right? So that's the safe

[6:58:56] username and password you need to keep here. So I'll go for simple Azure user and my default password so I don't forget it.

[6:59:09] Okay. And then the network rule. So which port you want to allow or deny. All right. What these ports are? These are the TCP ports. So if you keep 3389

[6:59:24] are the TCP ports. So if you keep 3389 open, what happened with 3389? Now this is the basic thing. Uh not part of 305 but I'll explain. Okay. Anyone knows what is this 3389 remote desktop, right? So those who are

[6:59:38] experienced in taking remote connections of Windows they would know. So this is of Windows they would know. So this is the port number where we send request to this virtual machine. So I'm sitting here somewhere in in Malaysia. Okay. And

[6:59:51] my virtual machine is sitting somewhere in Azure data center central India. So not connected directly. So what I'm internet. I'm sending request over internet to this virtual machine that I

[7:00:05] internet to this virtual machine that I want to take your control. allowed or not because I'm I'm sending the request on port number 3389. So it will check whether the port number is allowed or not. So if you don't allow

[7:00:20] the port number here, if I just go ahead and untick this, I won't be able to take control, that's why you need to keep 3389 open. Okay. So this will allow your virtual machine to to to accept your

[7:00:35] request. And then next you have disks. So here you can define the disks. So if you're using simply learn subscription, make sure you're changing this disk to uh standard HDD. Okay. So if you're using simply learn

[7:00:49] subscription, make sure you change it otherwise your VM deployment will fail. So if you're not changing this to standard HDD your deployment will fail because of our policy the simply learn policy which is in place. Clear? Now

[7:01:02] since I'm not using simply learn policy I'll go with premium SSD. It doesn't uh it it should not restrict me from deploying next uh quite

[7:01:15] understandable. So if you see the networking topic do you want to have a public IP? Do you want to create another virtual network? Do we want to have subnet? We have a network topic but obviously we're not

[7:01:27] going to discuss everything in in in deep. Uh we will be discussing it from easy 305 point of view. But what this is doing when you're creating a virtual machine a new network is also getting created. Okay. So if you see the new

[7:01:41] uh word here in the bracket that means a new virtual network will be created. within that virtual network a new subnet will be created and a new public IP will be created. Similarly, new network

[7:01:55] will be allowed. The port that we have defined there 33 389 will be allowed. Okay. So, we have a network topic where most of the things will get clear. For now, just know that whenever you are creating a virtual machine, a network is

[7:02:11] also getting created. All right, that's all. Once that is done, then you have the management section where you can define uh whether you want to assign manage identity to this virtual machine or no, whether you want to login using

[7:02:25] Microsoft enter ID or no, whether you want to auto shutdown your virtual machine. So if you're using dev for dev and test, if you're using it for dev and test, it's better to keep auto shutdown on. So automatically VM will be shut

[7:02:38] down at so and so point in time whenever you want 700 p.m. UTC or 7 p.m. IST whatever. Okay. Then monitoring. So if you want to enable monitoring you can have we have a dedicated chapter for monitoring. So we

[7:02:52] not doing any changes here. Then in advance if you want to run any script after the VM is getting deployed. So you can give that script here and Azure will execute your script once the VM is deployed. Okay. Then tags and review

[7:03:06] create. So if you want to have tags for your virtual machine like uh environment fraud, you can add the tag and then review create. Okay. Now Kash is asking what happens if we select enter ID login. It doesn't join

[7:03:21] When you create enter ID, you're not creating domain. Okay. So if you select Microsoft enter ID, this will give you the option. When you select this, it

[7:03:33] will allow you to use your enter ID credentials to log to this virtual machine. So this enter ID credentials. So anyone having the so-called uh role like virtual machine administrator login role or virtual machine user login role

[7:03:49] uh from the arbback to this virtual machine they'll be able to login using their enter ID credentials. It's not joining domain. It's not creating joining domain. It's not creating domain. Okay. [snorts]

[7:04:05] create uh and then create so it will start deploying the virtual machine. So just in short what did we do? We provided the subscription resource group the virtual machine name region uh image image will help you decide whether you

[7:04:20] machine. Then you need to provide the size of your virtual machine 8 gig or two or 4 gig whatever you want and then username password uh inbound role that's all rest even if you're not making any change and you click on review create it

[7:04:36] change and you click on review create it should it should work okay so rest are just non-mandatory things which Azure is automatically selecting for you and then I click on create so it will start deploying the virtual machine

[7:04:50] minutes for the virtual machine to be [snorts] Okay.

[7:05:35] machine is deployed. Now in order to connect definition of cloud computing we just put the definition of cloud computing.

[7:05:49] What is the definition of cloud computing? delivery of compute services over internet. Now my question is where is internet. Now my question is where is this virtual machine sitting

[7:06:03] you. Where is this virtual machine deployed or sitting central India and where I am? I am in Malaysia or even if I'm in India I'm not sitting or I'm not I'm in India I'm not sitting or I'm not inside the Azure data center. Okay. So

[7:06:19] Central India is not Nagpur Hurry. Central India is uh Pune for Azour. Okay. For us is it's Nagpur but it's it's the data center is actually in Pune. Okay. So I'm sitting in Malaysia. Now delivery

[7:06:34] of comput services over internet. So if I want to connect to this web server machine, what I need? I just need an access to internet. That's all. And the IP address and the credential of this virtual machine. Okay. So let's connect.

[7:06:48] virtual machine. Okay. So let's connect. In order to take a remote access of this virtual machine, what I'll be doing, I'll be right click. I'll do a right click on my start button of my laptop. So if you

[7:07:00] see, I'll do right click and then I go to run. And after run, I'll do MSTSC.

[7:07:12] a shortcut to open the remote desktop connection wizard and here you need to provide the IP address the public IP address which is mentioned here in the uh on on the screen. You see the public IP address here. So I just copy this

[7:07:27] public IP and I paste the public IP here and then I click on connect. So once I click on connect it asks me the credentials. So I provide the credentials.

[7:07:40] the credentials that we provided at the first page when we were creating the virtual machine. Okay. Then click on yes and it will give me access. Now I'm inside my virtual machine. So whatever software or install

[7:07:56] installation I'll be do that will be impacting my virtual machine not my virtual machine. You can see the public IP of the virtual machine. similar to IP of the virtual machine. similar to what you see here 20.219.24.129.

[7:08:14] Okay. Okay. You can see that here.

[7:08:45] 2025. So let's start with our uh let's continue our compute journey where if you remember uh when we were when we completed the yesterday's session uh we deployed a virtual machine and on that

[7:09:00] virtual machine we hosted one single a very basic website okay so uh since the deployment of website was very quick so what I have done I've already created

[7:09:13] what I have done I've already created the same virtual machine web server 01 which we had yesterday. So I'll be connecting to that web server 01 and role and after that I'll be hosting the website. Okay. So I'll copy the public

[7:09:28] IP. This is something we covered at the last uh yesterday uh at the last half an virtual machine. This is my virtual public IP and I'll connect to this virtual machine. Now since this is a

[7:09:43] Windows virtual machine, what I have to do? I have to connect it using RDP and I need to make sure that port number 3389 is open which we discussed yesterday. All right. So if I scroll down here, you see port number 3389 is open. So I can

[7:09:57] copy the public IP and then connect to this virtual machine. So I copy the this virtual machine. So I copy the public IP. I I press Windows R on my laptop and I type MSTSC which is the shortcut to Microsoft uh sorry to RDP to

[7:10:12] RDC connection to remote desktop connections. Once I type MSTSC and press enter it will open this run uh this dialogue box this wizard where I can paste the public IP of my machine and then I can click on connect.

[7:10:26] So once I click on connect it ask me for the credential. These are the credential which we provided when we created the virtual machine. All right. So I'll go virtual machine. All right. So I'll go with the credential that I used

[7:10:42] credentials are okay then I can u click on yes and it should uh connect me to the virtual machine that is deployed on uh in central India that is deployed on uh in central India on Azure platform.

[7:11:00] any service? This is nothing but a server, right? So we deployed a Windows server operating system. If you see this, if you see the operating system server 2025 data center. So it's a server operating system. The operating

[7:11:15] system that you have in your laptop, which is for commercial use, is is a client operating system. You might be having Windows 10 or Windows 11. So that the difference between server and client? Server provides some kind of

[7:11:28] service and client accesses those those service. So if you want to host your website then you need a server operating system. You can't do that with client operating system. All right. So that's why here we have selected Windows Server

[7:11:43] 2025 which would give us the capability to deploy whatever service we want. As of now we are focusing on deploying a website. Okay. So in order to deploy a website I need to deploy web server role. In Microsoft Windows you have web

[7:11:58] server role known as IIS. If you're working with Linux Linux has different working with Linux Linux has different flavors like you can install Nixux is another web server. So you can use that. So let's say instead of Windows

[7:12:11] So let's say instead of Windows operating system you deploy uh Ubuntu. Ubuntu is a distribution in Linux. So for that I need to deploy engineext on top of Linux operating system or you can make use of HTTP also known as Apache.

[7:12:25] We can use Apache as well. So Apache is another web server that you can deploy on top of Linux operating system. But as of now we have deployed Windows server operating system. So we will touch the uh we will install the IIS role. All

[7:12:40] ro I have to connect to my virtual machine which I have connected remotely. Right. So once I connect to that virtual machine there in every Windows uh virtual machine in every Windows machine

[7:12:53] not virtual in every Windows machine you have something known as server manager. Now there are different ways to deploy the role or service on Windows uh machine like you have graphical way you have powershell way you have cmd way. So

[7:13:08] there are different different ways available. Now since we have uh 40 50% of freshers here so I'll be sticking to GUI way since that would be easy to understand okay instead of doing it via PowerShell and all [snorts]

[7:13:24] by default in Windows machine or Windows this server manager which should open automatically even if you don't uh open it it should uh open its wizard

[7:13:37] automatically if it's if if you see let's Say for in your case if server manager is not popping up what you can do you can you can go to the start button in the in virtual machine and here also you can see server manager. So

[7:13:50] if the server manager windows or or dialog box is not opening you can click here and it should open right this is the first page that I should see whenever I connect to my virtual Windows virtual machine. Now I have to wait. You

[7:14:05] see this blue line which is uh collecting some inventory. So I need to wait. It won't let me do anything until this is gone. Okay. So what it does, it's preparing your server, collecting inventory data like what is the IP

[7:14:17] address, what is the name of the server, all those stuff it's collecting. So this is Windows specific. I need to wait until this is gone. So if I click on add rules and feature it won't let me do okay. So it's letting me do that means

[7:14:29] it has already collect collected the data. You see now that blue line which was which was traveling is gone. Okay. It's gone. That means now I can work with my server. Okay. So what I did on the homepage on

[7:14:41] the dashboard itself I clicked on add rules and features and from here you can select whatever service you you want to provide you want your server to provide provide you want your server to provide like if I click on next next here you

[7:14:55] have the tab known as server role okay what this server role is if you let's say we discuss about active directory domain service right so if you want to uh have this server behaved as an identity server you can install active

[7:15:08] directory domain service. If you want this server to behave as a DNS server, you can install the DNS server. Right? Now, what we are interested here, we are interested in the web server role. So, if you see here W under W, you have web

[7:15:22] server IIS. So, this is the role which you use uh to host the websites or web applications. Okay. So, I selected web server and then I do nothing. I just click next, next, next, install. That's all.

[7:15:37] So now it will start installing the server role for me. All right. Which installing web server. Once the role is installed, I'll simply copy paste my installed, I'll simply copy paste my application files and this

[7:15:51] uh this machine, this web server or this uh Windows machine should host my website and I should be able to access that website. That's where we stopped yesterday. Okay. So I'm continuing from there since this was very quick

[7:16:04] there since this was very quick yesterday. That's why I'm repeating. So I'll have to wait until the installation is done. Okay. I see Ram is asking today's topic. Uh I think I already covered today's topic is is the

[7:16:18] same. We are continuing our compute journey. So we only saw one compute as of now virtual machine we still have other compute services to to see. Okay. Once that is done we will start with our networking topic. So these are the two

[7:16:34] networking topic. So these are the two plan topic in the agenda for today. All right. So [snorts] I'll have to wait until this complete, I just have to copy the files. That's all. Where I'll be copying the

[7:16:47] file since this is Windows machine. I have a file system here. Uh where I can navigate to C uh inet and here you have dubdubdub. So

[7:16:59] this is the folder where your application lives. All right. So I select dubdubdub. These are these are the default files. So if I don't change anything, a default website would be loaded

[7:17:14] to wait until the installation is done and then only copy.

[7:17:31] done. The steps are important to understand what we did. We first deploy the uh the virtual machine and while deploying the virtual machine we selected that we want Windows OS. You can select Linux if your pref if your

[7:17:45] preference is Linux. After installing the Windows OS what we did we added the role the web server role known as IIS. And after the IIS is installed we are copying our files. So this is the the

[7:17:59] the steps these are the steps that we are taking. All right. Virtual machine creating virtual machine we selected Windows operating system. Windows server

[7:18:11] operating system. On top of it we deployed IIS. On top of it we will be copying our files. Once the IS installation is done.

[7:18:25] already installed. So instead [snorts] of waiting let's just okay it's done. If says installation succeeded on web server 01. So once that is done you can close it right without changing anything. If I hit the IP address the

[7:18:39] public IP address of the server uh it should load the default website. Okay I just hit the public IP address. This is the default website. So if I navigate or go back to the server, you

[7:18:54] should see this is what is being loaded. So if you open this with paint or [clears throat] if you open this with paint, this is what is being loaded. So if I replace this with my own website, I should be able to uh see my own website.

[7:19:10] Okay. So I made some changes. Click on save and then minimize the virtual machine and refresh the the page. So you see the changes are reflected instantly. Right? So now if I copy my simple uh app. So if I go to downloads and copy

[7:19:33] website. So I copy all this file go to the same location where the default website is located. Remember the location the path is cetpdw.

[7:19:45] Okay. So I delete this thing the default one and I copy I paste all the files that I have for my website. Okay. Now if I minimize the virtual machine and uh

[7:19:57] refresh the browser now it should load my website. All right. So it's it's it's that simple. But uh if you want to learn more on how it's it's it's not this much on on web server. There's a lot that you

[7:20:11] can do with web server. Okay. Now since we just want to understand how compute works so we are doing this. All right. Now you can just [snorts] go to the public IP of this machine and you should be able to see the same website. Okay.

[7:20:28] The Babrata is asking to repeat uh from which step you want me to repeat what what what we did is we installed or we created a virtual machine. We deployed a virtual machine. We [snorts] selected Windows OS and then we installed IIS.

[7:20:43] This is clear. Okay. So the address where you make changes is within the virtual machine CET. This is C drive. C drive. Inet

[7:20:56] group. So this is the folder where you have your website. Okay.

[7:21:14] we install in this server. Uh this is not something at easy 305 level. You can install as many as you want. Uh depends on the configuration that you have on the configuration that you have selected. Okay. So I have selected uh

[7:21:27] four uh 8 GB virtual 8 GB memory. Okay. So if my web app is is is lightweight web app, lightweight traffic, light traffic is coming in, I can install as many as my server can support. Okay, there's no proper limit. You can install

[7:21:43] whatever you want. If you want more, you just change the size here and you install hundreds of web app. It should work. Okay. work. Okay. All right.

[7:21:59] something uh we should cover in uh uh a305 okay it's IIS related. So if you want to learn more on server thing then I would recommend you to go for a 800 or

[7:22:12] a 8001 okay so these are the courses where you cover where we cover the uh server related thing but if you want to do that that you need to do from the IIS uh management console. So if I search for IIS here

[7:22:32] another website. All right. So here if you see I have one site this is the default website which is running. I can add a additional website but this has nothing to do with a 305. So I'm not covering this here. Can give it a name.

[7:22:45] application is wherever you want to store. Mostly you'll be storing it in pub. You add additional site here with the name whatever name you want to give

[7:22:57] my site or something you select that you add your files there and and it and you should run it. Okay. So this is how you do it but this is has this has nothing to do with a305. If you want to learn more on this uh I would encourage you to

[7:23:13] go for IIS course or server level course. Okay. But remember one thing uh on port 80 my default website is running. So I cannot use the same port for second website. So that's the catch there. So you need to

[7:23:29] that's the catch there. So you need to do some routing here and instead of uh reaching out to server over port 80 you need to use the naming the host name uh these host name routing here instead of port numbers. All right. So here

[7:23:44] whatever host name I'll be giving that host name this server will be listening for port number 80. All right. So let's not complicate it.

[7:24:00] demonstration how you can uh host a web app or a website on on Windows server. app or a website on on Windows server. All right.

[7:24:14] So next compute service that we have is Azure batch solution or Azure batch service. Now Azure batch service is not something uh similar to what we just saw. It's not a virtual machine where you can host your application. It's a

[7:24:27] totally different compute service where you can run large scale batch processing. What is the meaning of batch processing? When you want to process multiple files parallelly. Okay, many files parallelly at once. So if you have

[7:24:43] that kind of requirement then Azure batch uh Azure batch solution is the service for you which you can use to run multiple processes or multiple files. You want to process lot of files at once parallelly. So if you want to process

[7:24:59] that kind of thing, you need large compute, heavy compute. So Azure batch solution is for you. Okay. Now what is the uh advantage of using Azure batch processing. If you have anything where you require HPC, HPC stands for high

[7:25:14] performance compute. You want to do distributed computing. Okay. I want to uh process certain files for uh in two virtual machines and certain files in three virtual machines. So I can do that kind of uh thing. It also helps you to

[7:25:29] do the orchestration. uh you can optimize cost by by uh combining different sizes of virtual machine in one pool and then obviously you can integrate it with any other Azure service. Now where where in real

[7:25:44] world it's it it's being used. Okay. So I give a very simple example of uh I give a very simple example of uh YouTube. Okay. So what is YouTube?

[7:26:02] please share the today and all past topic. Sorry. Sorry. What you mean M? I don't understand what you're trying to ask. Okay. [snorts] So I'm trying to explain batch solution. So please focus here.

[7:26:14] All right. So I'm explaining batch solution here. What is batch solution? It's again a compute service in Azio which helps you to uh do a batch YouTube. What is a YouTube service guys? YouTube is a service where you can

[7:26:29] stream videos, right? You can stream videos. So what what I can do? I can video streaming service. Apart from video streaming service, what you can do with YouTube? You can create your own channel,

[7:26:44] right? You can create your YouTube channel and you can upload videos. channel and you can upload videos. Anyone here who is a YouTuber or I'm I'm I'm damn sure that 50% of people might have tried YouTube and they might have

[7:26:57] their own channel there and they might be uploading videos as well. So anyone here who knows how YouTube works. So what you do you create a channel and then you upload your videos. Now tell me are you the only person in the world who

[7:27:10] has the channel and who is uploading the video how many videos are being uploaded on on YouTube at this point in time 7:26 p.m.

[7:27:23] YouTube at this point in time 7:26 p.m. day. What do you think? How many videos day. What do you think? How many videos are being uploaded? Come on, quick. Just take a guess. How many videos in 1 second? How many videos are getting

[7:27:36] uploaded to YouTube? Million billions of videos, right? There's no count. Millions of videos are being uploaded. Now, when you upload a video to YouTube, what YouTube does? YouTube processes

[7:27:50] what YouTube does? YouTube processes your video, right? If I go to YouTube, I your video, right? If I go to YouTube, I upload my video. If I have a channel,

[7:28:03] video, you have different options to play like you you can play that in 1K, play like you you can play that in 1K, 2K, 3 uh 4K, right? So 1080 pixels. So there are different different uh once anyone is uploading the video, YouTube

[7:28:18] it's available in different different resolutions. Right? It's not loading. I don't know why but let's come come back to the topic. So when someone is uploading at at any point in time thousands or millions of people are

[7:28:33] are getting uploaded to YouTube. Now tell me when YouTube is processing, YouTube has certain kind of application which is processing this video.

[7:28:48] being uploaded and YouTube needs some service which can process this millions of videos parallelly at the same time. Now imagine you are uploading the video and your video is in queue. After the million videos only your video will be

[7:29:04] it will take for that video to be available on your channel. Right? So I need some kind of service as a YouTube I need some kind of service which can process this this millions of videos parallelly and quickly. So Azure

[7:29:19] batch solution is the service which can helps you to achieve this kind of thing. So if you have any application where you require batch processing then Azure batch solution is the service for you. Another example, you have your marketing

[7:29:34] team in in your uh company. What does marketing team do? They come up with videos. Has anyone here work with editing or anything? So when you edit a editing a video, what do we do? We cut our uh I mean we we record a raw footage

[7:29:51] first. Once you record a raw footage, you then take that footage, put it in any of the editing tool and then you cut the unwanted footage. So when you when

[7:30:03] you cut unwanted footage, that means you are uh you just like final after the final cut. Right? So when we

[7:30:15] are finally there I mean we have cut all the unwanted footage and now we have uh added all the all the clips of footage that we need. So that means this is my final cut. After the final cut what do we do? We export our video. Export is

[7:30:30] nothing but this is my final video export it in in a full video kind of thing. So when you are exporting your video what that what does that editing tool do? Have you heard the term render?

[7:30:43] So the what this editing to tool is doing it's rendering your video that means it's making your full video whatever final cut you have come up with it's making that into a single video since you have cut your raw footage and

[7:30:55] you have changed entire change your entire video and when you click on export it it starts rendering your video that means it's exporting that video to a full video like maybe you have used MP4 or whatever format you have used now

[7:31:08] imagine your company is your company is creating or editing thousands of video uh in one day. So at that point in time I'll I I'll require the HPC the high

[7:31:23] performance compute to render my video since this rendering takes a lot of So if that's my requirement I can rely on Azure batch solution service. Okay. U

[7:31:35] so these are the two examples from the real world that I can came up with. All right. I don't have any demonstration for Azure batch solution since I don't have any application which can do this kind of stuff. Okay. But Azure batch

[7:31:47] solution how it works behind the scenes. You create Azure batch pool and whenever there is a there is a task which is coming in the compute will be will be processing that task. That task can be anything. You're doing this kind of

[7:32:01] You're doing this kind of stuff where you are rendering videos or you're working with 3D modeling. So in 3D modeling also we require high performance compute kind of thing. That's why you might see that any editor

[7:32:16] That's why you might see that any editor mostly uh any editor who who is working on editing and all they they use the Apple uh Mac Mac studio or or Mac Pro Apple uh Mac Mac studio or or Mac Pro right why because th those PCs those Mac

[7:32:30] PCs are built for this kind of work. So similarly if I want to process now now Mac is like built for one single kind of thing like I'm I'm I'm an editor and I'm processing or rendering or creating or developing a video and I want to edit

[7:32:45] that. So I'm working on one video at a time or mostly two video in in a day. So I'm doing that. So for that kind of work Mac is okay. But if you want to do in batches that means multiple or many videos at at at uh in a single day or in

[7:32:59] a single minute and that point in time you'll require something which can handle the batch processing. So Azure batch solution is that solution is that service where you can uh which you can use to do this kind of work.

[7:33:12] All right, clear. Any questions on batch processing clear. Any questions on batch processing or or sorry Azio batch solution?

[7:33:26] uh scientific research where you need like like for example weather weather prediction models where you need to work on large amount of data from previous days and then you need to come up with a uh with with a prediction what what can

[7:33:41] be today's weather tomorrow's weather. So that's where Azure batch solution uh So that's where Azure batch solution uh perfectly fits. Okay. [snorts] I don't have any demonstration mir okay I'm sorry I don't have any demonstration

[7:33:55] since you need an application which can which can do the batch processing and you need to send data in batches so that you can see that in live I don't have that what I can show is just creation of batch solution which will not make any

[7:34:08] sense okay I don't have any any demonstration for that all right

[7:34:20] Azure app service as your app solution. This is another compute service. Okay. It's not like ETL run. Okay. Batch processing. Yeah, you can use it for ETL as well. So if you're doing any uh extract, transform, load kind of thing,

[7:34:35] you can use batch solution for that. So it's similar to that. All right. But it's similar to that. All right. But main job of this is is to mostly where I have seen bat solution is implemented is uh in in in in the in in the marketing

[7:34:50] uh team. So I've seen my friend working in a company uh and they have implemented this as your batch solution for their marketing team. Okay. But it's similar to ETL right where you will be taking data that

[7:35:05] data will be triggered and that data will uh triggered your compute your compute will process that data and then that you can integrate it with any other that you can integrate it with any other service to load that data somewhere.

[7:35:17] service to load that data somewhere. All right. next compute service that we have in Azure is Azure app service. Now, Azure

[7:35:29] app service is also a service where you can host your application. All right. So, if you want to host your web app, uh you can make use of app service. Uh the infrastructure for this is managed totally. So, fully managed

[7:35:43] infrastructure. Uh you have the option to scale it out or scale it in depending on your requirement. Uh it's highly available. You can integrate it with DevOps. uh it gives you the option to make sure that your data is secured and

[7:35:58] compliance. By default your data will be secured. Okay. Then you can integrate Azure app service with with other Azure services since this is an Azure service. integrate it with Azure other Azure services and it has support for

[7:36:11] containers as well. So main main thing that you need to understand for Azure app services this is mainly used for hosting web apps or website. Okay. Or

[7:36:24] APIs if you're creating if you're working with APIs. So you can host these three things. Now question may arise for freshers that here also I can host web app. In virtual machine also I can host

[7:36:37] web app. So what is the difference between these two? The difference between these two is virtual machine is infrastructure as a service. Okay. Where you have the full control over operating system. So I can

[7:36:52] as as you saw that I logged into the virtual machine and then I can make any change instead of web server. If I want to make this as a DNS server, I can do that. I have that flexibility or that option or that capability to make this

[7:37:04] as a DNS server. Okay, I can make it as a DHC DHCP server as well. So I have full control over operating system. Whatever I want to install, I can do that. So that uh instead of just keeping this as a web

[7:37:17] server, I can install all these roles as well. So that uh benefit we get when we in when we use Azure virtual machine whereas when you're using Azure app service you do not have control over the operating system. If you remember from

[7:37:33] operating system. If you remember from from the uh basics from the first uh session we discussed infrastructure as a service and platform as a service. What as a service and platform as a service? In infrastructure as a service, you have

[7:37:47] In infrastructure as a service, you have full control over the operating system. So when I use infrastructure as a service model, I am deploying a virtual machine. I'm selecting an operating system and I have full control over that

[7:38:00] operating system. When I'm selecting platform as a service, I can select which operating system I want whether Windows or Linux. But I don't have That means when I say I don't have control I'm I cannot log to that virtual

[7:38:14] machine when I'm using platform as a service model. So what uh what pass can help you to do is host uh what pass can help you to do is host your web app website or uh web app

[7:38:28] website or API but you won't be able to log the v operating system that you have selected whether it's a windows or linux. Okay. Now when you don't have control over the operating system, what advantage you have?

[7:38:42] When I don't have control over operating system, I am not responsible for the patching of the Windows OS. So if I'm using infrastructure as a solution and using infrastructure as a solution and I'm deploying everything in VM, I am

[7:38:54] responsible for the patching. So if I go to the settings and Windows update, I need to make sure whenever a new update is available, I need to make sure that I have installed it. like these two updates are already there in my virtual

[7:39:06] machine. So I should be the one it's not Microsoft's responsibility is my responsibility since I had deployed the virtual machine. So this should be installed by me as a as a user as a consumer. Okay. Whereas in path service

[7:39:20] responsibility. So underlying virtual machine will be patched by Microsoft. All right. So that's the advantage that that you get. Now the question may arise which one to use?

[7:39:34] If you are a developer the best option for you is app service. If you want more control on the infrastructure and you are infrastructure admin and you want more control then infrastructure as a service

[7:39:48] is the option for you. That's the best uh bet for you. All right. like you just within the same virtual machine you need to install some other softwares and some other uh uh roles like DNS, DHCP whatever you

[7:40:04] need for your infrastructure so you can install that that option you will not get in app service all right now whenever you want if let's say uh in interview you get a question explains the difference between p and I

[7:40:19] so you just remember this table so with IAS infrastructure as a service you have IAS infrastructure as a service you have more responsibility you as the as the uh consumer you have more responsibility when you're using IAS model

[7:40:36] when you're using pass model you have less responsibility less responsibility okay so just remember this box what this box is let's say you want to deploy an

[7:40:48] let's say you want to deploy an application what option you have uh I'll I'll draw one more box for onrem okay on premises that means your own data center so what options you have when you want to host an application

[7:41:02] when there is there was no cloud the only option that we had was on-prem right so what you used to do when when you were when when we were using on-prem you had to had your own server physical server right on top of that server

[7:41:17] system let's say you're using Windows operating system or Linux operating system whichever. On top of that you need to deploy a runtime. What is a runtime? Runtime is a is a is a framework which is used to uh

[7:41:32] run your application in simple terms. Okay. So your developer might be writing Okay. So your developer might be writing application inn net or java or python whatever or or node. So there are different different runtimes available

[7:41:45] right. So if my developer is writing uh the application inn net I need to have net framework installed net runtime installed. Okay if my developer is writing application in java I need to have java installed similarly python or

[7:42:00] node whatever so this also I have to install net if my application is written in net and on top of that I'll be having actual files of my application. So when you're using on-prem you're responsible for everything from bringing physical

[7:42:15] server installing operating system on top of it installing net framework on top of it and then bringing your files that means copying or adding your files responsibility when you go for on-prem now when cloud introduced cloud was

[7:42:30] introduced in different uh models like infrastructure as service pass as a have the physical server and infrastructure service we still have the physical server. What is this physical whose responsibility? Uh when you're

[7:42:45] using cloud physical server is the responsibility of the cloud provider. If you're using cloud the physical server is the responsibility of cloud provider. All right. Now you have the option you have the flexibility to choose whether

[7:43:00] you want to use Windows OS or Linux OS. So you let's say you're using Windows OS. So if you're using infrastructure as a service Windows OS is my responsibility. That means the license which which is required for Windows

[7:43:12] operating system is my responsibility. The monthly patching that I'll be doing is my responsibility. The runtime that I'll be installing is my responsibility. Let's say I go forn net or java whatever. Okay. So net installation of

[7:43:25] net is also my responsibility. Then again files obviously the application go for infrastructure as service out of the four boxes the three boxes are your responsibility. The operating system, the framework and the files.

[7:43:38] the framework and the files. Okay. Then if you move to p platform as a service, the physical server the the state setup will be same. The physical server is still there. Now it's it depends whether they're using virtual

[7:43:50] machine or what. Right? And then operating system is still there. You just have to tell the provider that I want to use Windows or Linux. The framework is still there. What your responsibility as a when

[7:44:04] you're using P model is only the files. So you just focus on development that's So you just focus on development that's all the last box the I mean from the top the first box only the files is your responsibility

[7:44:18] rest three are the responsibilities of the provider so when you use on-prem everything is your responsibility from scratch when you're using cloud uh or infrastructure as a service the physical server becomes the provider's

[7:44:34] the operating system is your responsib responsibility. The framework that you want to choose is your responsibility. The files that you want to install on top of uh uh files are nothing but the application. The application that you

[7:44:46] Windows operating system or Linux operating system is your responsibility. operating system is your responsibility. In p you are only responsible for development. The infrastructure, the entire infrastructure, the platform is

[7:45:00] the provider's responsibility. Okay. So that's the difference between virtual machine and app service. App service is a path service. So what we are responsible for is the the files that we need that we need to uh deploy.

[7:45:15] You create an Azure app service and then just push your files into that app service. All right. runtime. Runtime is the framework. Pankage. Okay. So runtime is the

[7:45:31] framework as I mentioned here. Net, Java, Python, Node. So in order to install or host any application, your developer will be writing an application term, it's a language which your

[7:45:44] developer is using uh to to write your application. He can be use he might be using Python, you might be using net car, might be using Java, might be using Python. So in order to host that application, I need to have that

[7:45:58] framework installed, that runtime installed on my machine. And if I install that runtime, runtime is like a runtime which helps your application to run. All right. Clear.

[7:46:14] Okay. So what we did when we installed the virtual machine we provided we we informed the server the service provider the cloud that we need Windows operating system and then on top of it whatever we had to do we did like we installed IIS

[7:46:29] then we copied our files right now next month when there's patching I will be responsible for the patching the physical infra still uh cloud providers responsibilities and now now let's see uh demon let let me demonstrate how you

[7:46:43] can use Azure apps service to host the same application that we are hosting on a machine on on a virtual machine. The same application which is hosted here. Now I'll host the same application on an app service.

[7:46:56] All right. So in order to create an app service, you need to search for app service in the s search bar. So I'll search for app service here. All right. I click on app service. This is the first one app service. So I'll

[7:47:09] click on the app service and then I click on create. I click on create web app. All right. Now, as usual, whichever resource you are deploying on Azure cloud, you need to provide subscription

[7:47:21] where Azure will be charging and a resource group where this where the resources for this service will be deployed. So, I select AZ305 RG01 where my resources will be deployed. Then the instance name. Instance name is

[7:47:36] the web app name. Okay. So, what web app name you want? Let's go with simply learn. should be globally unique. Okay. So if I go for simply learn, you see uh this name is not available. That means someone has already deployed a web app

[7:47:49] with this name. All right. So what I do, I just add some random number uh on on on front of it. All right. And this is the runtime stack that I was saying whether you want to use net, you want to use Java, you want to use Python. All

[7:48:04] right. So these are all the runtime that you need to install when you want to host an app. But when you're using a pass service, you just need to tell the provider that I want this runtime Python and they will install Python. I want

[7:48:18] this runtime node and they will install node. So they are making sure that your platform is ready. You just need to bring your code. That's all. So if I select net 10, net 10 will be installed on top of Windows operating system. So

[7:48:32] what I'm telling the provider is install Windows operating system. on top of that install.net. All right. And then the region where your uh where you want to deploy the app service. So I I'll be mostly I'll be

[7:48:46] using central India for all of my servers. Oh, sorry all of my services. servers. Oh, sorry all of my services. So I'm using central India here. Okay. And then there is a plan. Plan is the skew on

[7:48:59] um on the basis of which Azure will decide uh how much to charge. So there are different plans available. So there are different different plans available. You can select whatever you want. So if I

[7:49:12] click on explore pricing plan, these are the different plans available. So it decides how much RAM you'll be getting, how much CPUs you'll be getting, right? You can go for premium plan which will give you one virtual CPU and four uh GB

[7:49:27] of RAM. So depending on your requirement, you can choose whatever you requirement, you can choose whatever you want. All right. uh for some plans the the prices are also the estimated prices are also mentioned. All

[7:49:42] right. Now since this is just for demo purpose so I'll go for standard or uh basic since that that that will cost me less. So we have standard plan as well. Standard S1 now consider this plan as

[7:49:56] just the amount of RAM you'll be getting amount of uh CPUs you'll be getting. All right. And how much it will charge you, how much Azure will charge you for that particular uh RAM. It's not like that once you choose and it will it will stay

[7:50:11] like this. If you in future if you want to change the plan, you can change it. let's say I'm not satisfied with standard the performance of standard S1. So if I want to go for premium, I can go. Okay, I can switch any point in

[7:50:27] time. That's the that is the the benefit that you get in cloud. So you see the benefit number three the feature number three scalability. So right now when I'm deploying the service I'm selecting a different plan and in future if I need a

[7:50:40] different plan and in future if I need a different plan I can do that. Okay. All right. So I I'm selecting standard S1 for low cost as of now. All right. And this is the name of plan. So this is the name. You can uh give whatever name

[7:50:53] you want. So this is the default name or uh a random name that name that Azure is name you can you can give. So this is my simply learn uh app service plan 01. So

[7:51:06] I can give it something like this. Okay. You can give whatever name you want. All right. Now once that is defined that's all. If you don't want to touch any other uh uh tab that's fine. You just click on review create and your app

[7:51:20] service will be created. But you can associate or create database here if you associate or create database here if you want. You can uh ass you can have your uh CI/CD pipeline as I mentioned here key features DevOps integration. So if

[7:51:35] you have a CI/CD pipeline, you can integrate uh with C CI/CD pipeline as well. If you want to integrate it with network, you can do that. All right. If you want to have uh a different service which will be monitoring uh this web

[7:51:50] app, you can uh enable that. I'm not enabling it. We have a dedicated chapter for monitoring. So I'll keep it for that. All right, that's all. You can associate it with database, you can associate it with CI/CD pipeline here,

[7:52:04] right? If you have a network and you want to integrate your app service with network, you can do that from here. If you want to enable monitoring, you can enable it from here. All right, that's all. I'm not doing anything just I'm

[7:52:16] going with the default setting. I just uh in the monitoring section I just u change the radio button to no that's all and then I can click on review create and I click on create.

[7:52:29] All right so it will start deploying my app service.

[7:52:45] Oh, we did change the the plan, right? Okay, it selected premium P1. I want to select standard or maybe basic.

[7:53:03] standard now. And uh it's it's now going to the deployment page. In 5 minutes your app service will be up and ready. [snorts] All right. So I can browse my app service from here. As a end user if you want to go to YouTube how do you go?

[7:53:16] You type dubdubdub.youtube.com on your browser. Right. So this is where this is the address where YouTube lives. Similarly for your app you have an address uh where your application is is living. Here you can see the domain. So

[7:53:31] application is living. Simply learn 5689.azeites.com. as yoursites.net. So here we have our app running. Okay. In sometime you should see your app. Now what we have done, we have just made sure that platform is ready. We still

[7:53:46] haven't pushed our code. We have not added our code. What did we do when we when we uh worked with virtual machine? We deployed the virtual machine right on

[7:53:58] top of it. We deployed the in uh IIS role and then we copied our file. So so far in app service what we have done we have done this part we still have not copied our files so we need to copy that all right we need to copy that

[7:54:15] so you see when I browse that that endpoint that URL it says my web app is running but waiting for the content so I still haven't published my content yet now for web app there are different different ways to publish the content

[7:54:30] one one way is to use the DevOps way of of publishing the content. Another way is to use the CLI to publish the content. So there are different different ways to publish the content. But for our use case uh it's a simple

[7:54:45] website which which we are using. So what we can do we can use the graphical way app service editor. I can open the editor. So it gives me the access uh

[7:54:57] access to the file system where I can simply upload my files. Remember what we did with virtual machine, we deployed the IIS and then we copied our files. So we have to do the same thing with with the app service as well. So I need to

[7:55:10] copy that file. So in order to copy what what Azure has done, Azure has given you what Azure has done, Azure has given you the access to the file system. So under the development tools you have app service editor and from here you can

[7:55:23] app service editor and from here you can open the editor and uh you can copy and paste your files here. Okay. So let we have to wait until this is So let we have to wait until this is fully loaded. It takes s some time

[7:55:37] and in any point in time if you want to change the plan the app service plan you have the option here under app service plan you have scale up scale out. Okay. So when you want to scale up you can change from basic to share to basic 2 to

[7:55:50] basic 3 to premium. So if you feel that the traffic which is coming to my the traffic which is coming to my application uh is not served properly or served very slow. So that could be because you only have 1.75

[7:56:05] GB of RAM. So it might take lot of time for processing a particular request. So if you feel that at any point in time you can change your your plan. Now remember if you go for premium plan the cost will increase. Okay, depending on

[7:56:19] which plan you're choosing and the amount of memory you are getting your your cost may increase. All right. [snorts] So now as you can see it's loaded and this is where where did we copied our

[7:56:33] file under dubdubdub root right in virtual machine if I go to the virtual machine we copied all of our file to dubdubdub root right. Similarly here also you have the dubdubdub root folder from where you can to where you can copy

[7:56:48] your file. So what I can do I can delete this one the the default one and then I can right click and I can upload my simp my simple app files. So if I go to my simple app files. So if I go to download and search for simple app

[7:57:07] it. So this copy will be uploaded the files will be uploaded here right the index.html this is the file which will be loaded. Now if I refresh my my endpoint, I should see the similar uh application here.

[7:57:23] Okay, same website which is being loaded from virtual machine. Now it's being from virtual machine. Now it's being loaded from the uh app service as well. Clear you can also try to browse this and you

[7:57:36] should see the same website being loaded. What is the advantage of using getting the SSL certificate free of cost. I mean the cost it's included in the in the app service plan. You see HTTPS

[7:57:49] uh which I need to buy separately if I'm using virtual machine. So I need to buy my virtual machine traffic is not secured. In order to secure that I need to buy a SSL certificate and obviously I need to buy a domain name as well since

[7:58:02] I'm directly hitting that at the IP address. Right? That thing is that is is benefit when you're using path service. you already have HTTPS plus you have a domain name. You don't you're not hitting the website on on a particular

[7:58:16] IP address. You're getting a domain name separately free of cost. Okay. [snorts] All right. So for deploying the code it's very simple. You can go and you can place your since my website is quite

[7:58:30] basic so I can do that from the app service editor. But if you want to deploy an entire code uh in that case you can make use of a web app command from from from where you can deploy the code. So a easy web

[7:58:44] you can deploy the code. So a easy web app deploy or easy web app uh deploy is the is the command that you can use. So this is the command that can be used in order to deploy entire source code. Okay. So your source code can be in in

[7:58:57] Okay. So your source code can be in in jar file or in in zip file and you can deploy your source code. The example is also given over here. Right? If you want to deploy a war file uh this is the this is the command. If you want to deploy a

[7:59:10] zip file this is the command right. So there are different different uh ways to deploy the code. If you want to use uh the command line way then this is these are this this is the command that you have. Okay. Apart from command line,

[7:59:24] you can also deploy using uh something known as visual studio code. So from known as visual studio code. So from here also you can deploy the the the the source code. Apart from visual studio code, there is another software from

[7:59:38] another IDE from Microsoft which is Visual Studio. From there also you can ways to deploy the source code. Since our application is quite simple uh it's just a website. So I deployed using the graphical way which will be easier for

[7:59:53] graphical way which will be easier for freshers to understand. All right. Um in future we have advanced topic as well. So once we are done with database once we are done with uh the app service architecture in the app service

[8:00:08] architecture we are going to deploy a a fully looking app uh application. Okay. Uh so that's that's where you will understand how to deploy an entire

[8:00:20] directly. >> Now we have come to the end of our session on a 305 designing Microsoft Azure infrastructure solutions. Thanks for watching and keep practicing because

[8:00:32] cloud architecture is not just about knowing services and do not forget to subscribe simply learn for more such valuable courses.