Storage Accounts Overview

Storage Accounts

• For Data Lake Storage, storage accounts must support blob storage available in standard general-purpose v2 and premium block blobs.
• Immutability policies include timed retention and legal hold policies to prevent block deletion.
• Lifecycle policies dictate the behavior of blobs or containers over time.
• Access tracking must be enabled with lifecycle management rules for automatic blob movement or deletion based on modification or access times.
• POSIX-compliant access control lists require hierarchical namespace activation.
• Microsoft Entra Kerberos can be used for identity-based access in file shares.
• Block blobs and append blobs support Immutable Storage to ensure data integrity.

Deletion Locks

• Deletion locks cannot be applied to management groups.
• They can be applied to resource groups, subscriptions, and VMs.

Azure Policies

• Custom recommendations must use the RemediationDescription field in metadata for Azure Policies.

Microsoft Entra Roles

• User Administrator role allows user and group management, support ticket handling, and monitoring service health.
• Billing Administrator focuses on financial management.
• Service Administrator has full access to Azure services.
• Cost Management Reader can view billing information and manage budgets.
• User Access Administrator grants permissions for resource locks.
• Not all Microsoft 365 services are universal; usage location must be defined for license assignment.

License Assignment

• Dynamic groups are needed for assigning licenses based on MS Entra ID attributes.
• Rules must be configured on custom attributes for dynamic groups to sync automatically.

Deployments

• TemplateUri specifies the location of the template file.
• TemplateFile indicates the local directory of the template file.
• TemplateSpecId refers to templates saved within Azure.
• Resource group specification is possible during template deployment.

App Service Plans

• Free: 0 instances, 1GB storage.
• Basic: 10GB storage, 3 instances.
• Standard: 50GB storage, 10 instances.
• Premium: 250GB storage, 30 instances.

Useful Commands

• netstat -an: Lists the ports the server is listening on.
• Test-NetConnection: Executes a ping/ICMP test.
• nbtstat -c: Checks the NBT cache.
• Get-AzVirtualNetwork: Retrieves virtual networks within a resource group.

Azure Metrics

• Log Analytics workspace is essential for log data from Azure Monitor.
• Azure Monitor uses a time-series database optimized for time-stamped data analysis.
• Activity logs can help preemptively detect and address issues.
• Azure Advisor analyzes configuration and usage metrics without time-lapsed data.
• Azure Cost focuses on spending optimization.
• Azure VM Insights monitors VM health and performance.
• Log analytics requires creating a log analytics resource and enabling diagnostics on load balancers.

Virtual Machines (VM) General Info

• VM backups are maintained for 30 days by default.
• Azure Custom Script Extension facilitates post-deployment configurations.
• Desired State Configuration (DSC) allows management via configuration as code.
• Azure VMAccess extension enables console access for Linux management.
• VMs cannot be moved to another VNET; deletion and recreation are necessary for a new VNET target.
• Creation of VMs in availability zones requires configuring availability options.

Alerts

• Email notifications for events require an alert rule and action group setup.

DNS Resolvers

• Virtual network links integrate with private DNS zones.
• Azure DNS Private Resolver facilitates DNS query proxying between on-premises and Azure.
• Custom DNS servers can be deployed as VMs or appliances but do not work with private DNS zones.

Domain Name Records

• A record connects a domain name to an IP address.
• CNAME record links one domain name to another.
• NS record assigns delegation for subdomains.

Azure Dashboard

• Data can be pinned for a 14-day limit.

Network Peering

• IP addresses must not overlap; location is irrelevant.

Azure Load Balancers

• Basic Load Balancer operates within a single availability zone and supports only Basic SKU public IP.
• Standard Load Balancer is zone-redundant with a higher cost.
• Session persistence must be set to ClientIP and Protocol for consistent server connections.
• VMs using Basic Load Balancer must be part of a scale or availability set.
• Standard Load Balancer requires VMs to belong to the same virtual network.

Tokens

• SAS (Shared Access Signature) requires SignedServices for specifying accessible resources and SignedResourceTypes for service types.
• SAS optional parameters include SignedStart for validity start and SignedIp for IP range restrictions.

Azure Instances

• Azure Spot Instances offer reduced-cost VM provisioning but are susceptible to interruption for higher priority workloads.
• VMs must attach network interfaces within subnets for communication.

Backups

• To restore VM backups, Microsoft Azure Recovery Services Agent must be installed on the destination VM.

Azure VM Series

• A-series: Best for entry-level workloads.
• D-series: Balances vCPUs, memory, and storage for typical production workloads.
• E-series: Optimized for memory-heavy applications.
• F-series: High CPU-to-memory ratio.
• M-series: Ideal for memory-intensive applications.

NSGs (Network Security Groups)

• NSGs can be associated with network interfaces and subnets.

Access Restrictions

• Virtual network service endpoints restrict Azure Blob Storage access to specific networks or IPs.

Diagnostics

• Application Logging (Blob) must be enabled to store warning-level logs for over a week.

Azure Import/Export

• Large data transfers to Azure Storage require Blob Storage or File Storage.
• Only containers, such as blobs, can be exported.

Azure Password Security

• Administrators have a different password reset policy without security question prompts.
• Fraud features block accounts for 90 days unless unblocked by an admin.

Service Level Agreements (SLA)

• Achieving 99.95% availability for VMs requires defining an availability set with a scale set.

Azure AD

• Windows devices joined to Azure AD add specific security principals to local admin groups.
• Authentication types include federated, pass-through, and password hash synchronization.
• Azure AD Access Reviews automate the review process, including reminders and revoking access.

Migration to Azure AD

• Migration methods include Azure AD Connect cloud sync, password hash synchronization, and staged migration processes.

Web Application Firewall (WAF)

• Custom WAF rules can protect applications from common web attacks by blocking specific patterns or keywords.

Disaster Recovery

• GRS, RA-GRS, and ZRS for Azure Storage ensure geographic redundancy and availability for enhanced disaster recovery.

Hub and Spoke Model

• Provides scalable architecture where the hub VNET houses shared services, and spoke VNETs contain specific applications.

Azure Service Endpoints

• Allow precise network access restrictions to storage accounts for heightened security.

Managed Identities

• Authenticate access to other Azure services using system-assigned or user-assigned identities.

Azure Backup Policy

• Retention ranges must be defined within the backup policy to ensure backups are maintained.

Azure Resource Graph

• Facilitates resource data queries using KQL, REST API, PowerShell, and Azure CLI.

Azure Security

• Azure Sentinel is used for the analysis of security threats and anomalies.

Alerts Management

• Rate limiting applies to alerts: SMS (1 every 5 min), Voice (1 every 5 min), Email (up to 100 in an hour).
• Create a log analytics workspace to prepare subscriptions for alerts.

Moving Resources

• Storage can be relocated across locations, but NICs attached to VMs cannot be moved.
• Public IPs are region-specific and thus non-transferable.

Virtual Networks

• A Virtual Network Gateway is required for connecting two VNETs across different subscriptions.
• Secure private connections from on-premises networks to Azure VNET utilize ExpressRoute.