Forum Widgets
Latest Discussions
Azure VM Networking Components Real Case Scenario
📌 Public IP 📌 🔹 Public IPs allow internet-based services to reach Azure resources, such as web applications hosted on VMs or Azure App Services. 🔹 Azure resources can use Public IPs to communicate with external services, ensuring connectivity for APIs, databases, and other cloud-based applications. 🔹 Public IPs can be assigned as static (fixed address) or dynamic (changes over time). Static IPs are ideal for services requiring a consistent address, while dynamic IPs are useful for temporary workloads. 📌 Azure Load Balancer (External / Internal) 📌 🔹 Distributes Internet Traffic – Balances incoming requests from the internet across multiple backend resources. 🔹 Balances Private Network Traffic – Distributes requests within an Azure Virtual Network (VNet). 🔹 Supports Multi-Tier Architectures – Ideal for backend services like databases and application layers. 🔹 Enhances Availability – Ensures high availability by routing traffic to healthy instances. 🔹 Provides Outbound Connectivity – Enables Azure VMs to communicate with external services using NAT. 📌 VNET Subnets Segmentation 📌 🔹 Web Subnet – Contains two VMs, each with a Network Interface Card (NIC) and is protected by a Network Security Group (NSG) to filter traffic based on rules. 🔹 App Subnet – Similar to the Web Subnet, hosting two VMs with NICs and NSGs, but uses an internal load balancer to balance traffic within the subnet. 🔹 Data Subnet – Also includes two VMs with NICs and NSGs, leveraging an internal load balancer for optimized traffic management. 🔹 Gateway Subnet – Hosts the VPN Gateway, ensuring connectivity between on-premises networks and Azure. 📌 Azure Network Security Groups (NSGs)📌 🔹 Traffic Filtering – NSGs allow or deny inbound and outbound traffic based on defined security rules. 🔹 Granular Control – Rules can be applied at the subnet or network interface level for precise traffic management. 🔹 Default Security Rules – Azure provides built-in rules to ensure basic security, which can be overridden with custom rules. 🔹 Priority-Based Processing – Rules are evaluated in order of priority (100-4096), with lower numbers processed first. 🔹 Supports Service Tags – Simplifies rule management by using predefined tags like Internet, VirtualNetwork, and AzureLoadBalancer. 📌 Azure VPN Gateway 📌 🔹 Secure Connectivity – Establishes encrypted connections between Azure Virtual Networks (VNets) and on-premises networks. 🔹 Site-to-Site VPN – Enables secure communication between an on-premises network and Azure using IPsec/IKE VPN tunnels. 🔹 Point-to-Site VPN – Allows individual devices to securely connect to Azure from remote locations using OpenVPN, IKEv2, or SSTP. 🔹 VNet-to-VNet Connectivity – Facilitates secure communication between multiple Azure VNets. 🔹 ExpressRoute Failover – Provides a backup connection for ExpressRoute in case of failure. 🔹 High Availability – Supports active-active configurations for redundancy and reliability. If you found this valuable, consider sharing so more professionals can benefit. Let's keep the conversation growing! 🚀
Cannot RDP to azure VM from local domain joined PC
I have an Azure VM behind an Azure VPN that I cannot connect to from certain PCs. This is an azure government instance at the free tier. The VM only has a Private IP, and can only be accessed when connected to the VPN. The VM doesn't have a DNS name/FQDN. I looked into giving it one, but the instructions call for a public IP so I couldn't complete the process. I am using the private IP address of the VM, and an Entra ID credential to connect through RDP I can reach the VM from my laptop, which is azure AD joined to a different tenant. I can reach the VM from a non-domain joined PC from the network I am working in. I CANNOT reach the VM from a local domain joined PC on the same network, even before applying policies. I get a "user logon failed" message from the PC I don't see the logon attempts in Entra ID Admin Center under "Sign-in Logs" I'm all out of things I know to try to get this to work. Any insight or guiding questions would be greatly appreciated. Thank you!🔥 Hybrid Networking 101: Linking On-Prem to Azure 🔥
Many organizations seek to extend their networks to include subnets and virtual machines (VMs) hosted on Azure. The goal is to enable seamless connectivity between on-premises computers in a data center and Azure-based virtual machines. 🔹 Common Use Cases for Hybrid Networking: # Application Connectivity: You have an Azure-hosted application that needs access to your on-premises database servers. # Branch Office Integration: Your business operates retail stores worldwide and requires a single centralized service to connect all locations. # Remote Access: You need secure remote access to your Azure VMs and applications. # Data Synchronization: You want to connect on-premises servers with Azure servers for real-time synchronization and data transfer. # To address these scenarios, Azure provides four key networking solutions: ✅ Point-to-Site VPN (P2S) ✅ Site-to-Site VPN (S2S) ✅ ExpressRoute ✅ Azure Virtual WAN One essential component that supports all these solutions is Azure VPN Gateway. Let's explore its capabilities! 🔍 🚀 Azure VPN Gateway 🚀 # Secure Connectivity Between Azure & On-Premises by encrypting data while transferring it between Azure VNets and on-premises servers over the internet. # Multiple connections can be established using a single VPN Gateway, sharing available bandwidth across all VPN tunnels. # The gateway consists of Azure-managed VMs, automatically deployed and configured in a GatewaySubnet with a CIDR size of /27. # There are two types of gateways: 🔹 VPN Gateway (for encrypted connections) 🔹 ExpressRoute Gateway (for dedicated high-speed connectivity) 💡 Gateway SKUs define performance characteristics, including: # Supported tunnel types (S2S, P2S, VNet-to-VNet) # Maximum aggregate throughput # BGP (Border Gateway Protocol) support # Scalability options (resize within the same generation and family via Azure Portal or PowerShell) 🚀 VPN Gateway Types: # Route-Based VPN: Supports S2S & P2S connections—widely used in hybrid networking. # Policy-Based VPN: Limited to Basic SKUs and allows only S2S connections (not ideal for Remote Access). 🔹 Local Network Gateway: Represents your on-premises router or firewall, enabling Azure to recognize your internal network's public IP and subnets for connectivity via IPSec IKEv1/2. 🔹 Azure Availability Zones can be leveraged for high availability and service continuity. 📌 Point-to-Site VPN (P2S) 📌 🔹 Secure access for individual users connecting remotely to Azure VNets. 🔹 Supported protocols: OpenVPN® (SSL/TLS-based; compatible with Windows, Mac, Linux, Android, iOS) SSTP (TLS-based; Windows-only) IKEv2 (IPsec VPN solution; Mac-supported) 🔹 Authentication Methods: (1) Certificate Authentication (requires client certificates issued from a trusted root certificate). (2) Azure AD Authentication (available for OpenVPN clients). (3) Active Directory Domain Server Authentication (via RADIUS server integration). 📌 Site-to-Site VPN (S2S) 📌 🔹 Enables on-premises data centers to connect with Azure VNets via IPSec IKEv1/2. 🔹 Supports VNet-to-VNet connections over Microsoft's backbone network. 🔹 Compatible with hardware devices from vendors such as Cisco, Fortinet, Barracuda, Check Point. 🔹 Supports software VPN devices, including Microsoft RRAS and Linux Openswan. 🔹 Enables dynamic routing via BGP to propagate network changes automatically. 📌 ExpressRoute 📌 🔹 Dedicated high-speed connectivity to Microsoft Cloud (Azure, Microsoft 365). 🔹 Up to 100 Gbps speeds with low latency, ideal for business-critical applications. 🔹 Layer 3 connectivity, using BGP for seamless route exchange between on-premises and Azure networks. 📌 Azure Virtual WAN 📌 🔹 A scalable networking service integrating VPN, ExpressRoute, and SD-WAN solutions. 🔹 Provides branch connectivity using site-to-site VPN or private ExpressRoute connections. 🔹 Supports remote user VPN (P2S) for secure external access. 🔹 Follows hub-and-spoke architecture, ensuring full mesh connectivity across Azure regions. If you found this valuable, consider sharing so more professionals can benefit. Let's keep the conversation growing! 🚀🔥The Power of Azure’s Security Arsenal 🔥
◆ Using a Public IP without securing your Azure applications and resources exposes you to security threats. Today, we’ll explore the most powerful security solutions from Azure’s arsenal. ◆ Azure provides a multi-layered approach (more than one layer of protection) to secure your resources when using a Public IP. Organizations can now transform this open gateway into a fortified checkpoint. Here’s how these tools work together to mitigate risks: 🚀 Azure DDoS Protection 🚀 ■ Protects your resources and services from being overwhelmed by malicious traffic. This excellent service is available for Network & IP Protection SKUs. ■ Uses Machine Learning to distinguish between normal traffic patterns and malicious flooding attempts (such as SYN floods or UDP amplification attacks) before they impact your applications and services ensuring availability. 🚀 Azure Web Application Firewall (WAF) 🚀 ■ Adds application-layer protection, intercepting HTTP/HTTPS traffic for inspection. ■ Blocks suspicious attacks like SQL injection or XSS by applying OWASP core rule sets, which define how attacks occur and how to defend against them, with continuous updates. ■ Enhances security for customer-facing services, ensuring trust and protection for your website and users. 🚀 Network Security Groups (NSGs) 🚀 ■ Acts as a virtual firewall at the subnet or network interface level, filtering traffic based on predefined rules. ■ Can allow only trusted HTTPS (port 443) connections while blocking unsolicited RDP or SSH attempts. ■ Implements the critical security principle of reducing attack surface, ensuring only authorized traffic reaches your target resources. 🚀 Azure Private Link 🚀 ■ In some scenarios, avoiding Public IPs altogether is the best security approach. This powerful service allows secure access to Azure SQL Database or Storage via Private Endpoints inside your virtual network. ■ Helps organizations minimize external exposure while maintaining secure, private connections to necessary services. 🚀 Azure Bastion 🚀 ■ Provides secure access to Azure VMs without Public IPs, using RDP/SSH over encrypted TLS 1.2 traffic. ■ Uses a browser-based HTML5 web client to establish RDP/SSH sessions over TLS on port 443, fully compatible with any firewall. ■ Connects to VMs via Private IPs while enforcing NSG rules to allow access only through Azure Bastion. If you found this valuable, consider sharing so more professionals can benefit. Let's keep the conversation growing! 🚀🚀 Mastering Azure Management with Global Admin Elevation 🌐
◆ Microsoft Entra ID and Azure resources are secured independently from one another. ◆ Microsoft Entra role assignments do not grant access to Azure resources. ◆ Azure role assignments do not grant access to Microsoft Entra ID. ◆ As a Global Administrator in Microsoft Entra ID, you can assign yourself access to all Azure subscriptions and management groups in your tenant. ◆ Use this capability if you don't have access to Azure subscription resources, such as virtual machines or storage accounts, and you want to use your Global Administrator privilege to gain access to those resources. ◆ When you elevate your access, you are assigned the User Access Administrator role in Azure at root scope (/). This allows you to view all resources and assign access in any subscription or management group in the tenant. ◆ User Access Administrator role assignments can be removed using Azure PowerShell, Azure CLI, or the REST API. 🚀 Why would you need to elevate your access? If you are a Global Administrator, there might be times when you want to do the following actions: ■ Regain access to an Azure subscription or management group when a user has lost access ■ Grant another user or yourself access to an Azure subscription or management group ■ See all Azure subscriptions or management groups in an organization ■ Allow an automation app (such as an invoicing or auditing app) to access all Azure subscriptions or management groups # Perform steps at root scope # Follow these steps to elevate access for a Global Administrator using the Azure portal. (1) Sign in to the Azure portal as a Global Administrator. Note : If you are using Microsoft Entra Privileged Identity Management, activate your Global Administrator role assignment !! (2) Browse to Microsoft Entra ID > Manage > Properties. (3) Under Access management for Azure resources, set the toggle to Yes. (4) Select Save to save your setting. If you found this valuable, consider sharing so more professionals can benefit. Let's keep the conversation growing! 🚀dynamic pipeline and deployments with approvals
I am looking to create a multistage YAML pipeline in Azure DevOPS that: * Dynamically generates jobs based on the value(s) of a variable from a previous step (e.g., host names). * Ensures that each dynamically created job includes its own approval step, either through ManualApproval@0 or via an environment. The challenge I am facing is that while "strategy: matrix" allows for the dynamic creation of build jobs, this strategy is not permitted for deployments, which are necessary for implementing approval steps. Do you have any suggestions on how to resolve this issue?
Branch is not created by az repos ref create command
I want to automate branch creation for my project. I am using the command az repos ref create --name testrelease/$MAJ_VER.$MIN_VER.$PATCH_VER --object-id xxxxxxxxxxxxxxxxxxxxxxxx --org https://dev.azure.com/myorg/ --project myproj--repository myrepo I see the response, 2023-11-30T16:00:57.5538690Z { 2023-11-30T16:00:57.5539015Z "customMessage": null, 2023-11-30T16:00:57.5539286Z "isLocked": false, 2023-11-30T16:00:57.5539489Z "name": "refs/testrelease/0.3.0", 2023-11-30T16:00:57.5539871Z "newObjectId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", 2023-11-30T16:00:57.5540718Z "oldObjectId": "0000000000000000000000000000000000000000", 2023-11-30T16:00:57.5541098Z "rejectedBy": null, 2023-11-30T16:00:57.5541701Z "repositoryId": "123212312321321312312312312321312312321", 2023-11-30T16:00:57.5542107Z "success": true, 2023-11-30T16:00:57.5542284Z "updateStatus": "succeeded" 2023-11-30T16:00:57.5545083Z } 2023-11-30T16:00:57.6145902Z ##[section]Finishing: create a branch But I couldnt find the branch created in azure devops.
Ownership of an Azure DevOps organisation
I and my colleagues have had Visual Studio Enterprise subscriptions for many years now (since they were MSDN Universal), through the company we work for. Some time ago I set up an Azure DevOps organisation under my account, and it is now used for all our repositories, pipelines, etc. I'm getting to the age were retirement is an option, and I'm concerned about the organisation being tied to my VSEnt subscription rather than our company's Azure account. I've been doing a bit of research on it, and the advice talks about creating a tenant and connecting the organisation to its Entra directory. My organisation is already connected to our Entra directory though, and we've always been able to add users from our AD. Would this have been done automatically because the account linked to VSEnt was part of our AD? More importantly, does this mean the organisation would survive the expiry of my VSEnt subscription? I'm currently the owner of the organisation, but changing that seems fairly straightforward. With that change and presence of the Entra link, does that mean I've nothing to worry about, or is there more to do?
Jira Service Management and Azure DevOps Integration: Optimize ITSM and Development Workflows
This article dives into how integrating Jira Service Management (JSM) with Azure DevOps can improve ITSM and development workflows. Let’s face it, businesses can no longer ignore the friction that comes from siloed support and dev teams. Integration, when done right, brings real-time updates, better visibility, and a smoother customer experience. For such integrations, you need tools that help you connect these multiple platforms together. Integration isn’t about one side changing its behavior to meet the needs of the other. It’s about combining strengths, working together, and reducing waste of time and resources on both sides. Exalate connects teams within and across companies by providing a scalable, reliable, and AI-assisted integration solution, eliminating the need to switch between multiple ITSM systems. How does Exalate work? Exalate works as a dedicated app on each system you want to integrate. Each tool admin stays in control. You decide what goes out and what comes in. Exalate is a script-based integration solution. It’s Groovy-based scripting engine allows the flexibility to implement deep integration between Jira and Azure DevOps. Got an edge case that doesn’t quite fit in the standard mold? Bring it on. It’s also available for other systems like Salesforce, ServiceNow, Freshdesk, Zendesk, and more. To make scripting faster (and more approachable), it also provides AI Assist. You describe your sync logic in plain language, and it turns it into dynamic sync rules, right inside the Exalate admin console. Replica and Triggers Exalate allows you to define sync rules that hold what data gets shared and how it maps across systems. Sync rules have a replica. A replica is a copy of an issue/work item that holds the data you want to share. Each integrating side has incoming and outgoing sync rules. In Jira, the outgoing sync will define what information should be transferred to Azure DevOps, and the incoming sync will decide how you map the information coming from Azure DevOps. Triggers kick off syncs automatically, based on conditions written in native query languages like JQL (Jira Query Language) or WIQL (Work Item Query Language). Some common use cases that you can implement. First Use Case: Support Escalation to Dev When a customer raises a ticket in JSM, some of those need to be escalated to the dev team in Azure DevOps, either as Bugs or Features. Map request types from JSM to work item types in Azure DevOps e.g., ‘Report a bug’ → Bug | ‘Suggest a feature’ → Feature Sync status and priority between both platforms. This ensures both teams stay aligned as tickets progress Triggers Used When the project name is SUPP and the request type is a bug or feature, send the ticket over to Azure DevOps. Second Use Case: Product Support Flow The product team creates epics and user stories in Azure DevOps. These entities on the project board are unidirectionally synced to Jira Cloud as epics and stories. The relation hierarchy between Azure DevOps and Jira is maintained. For instance, ‘Relations’ in Azure DevOps are mapped as ‘Issue links’ in Jira. Statuses are synced between Jira Cloud and Azure DevOps to reflect accurate progress. Integrate Azure DevOps and Jira: Get Started Integrating Jira and Azure DevOps is not only a tech decision, it’s a business strategy. With Exalate, you can tailor the integration to your workflow, your logic, and your comfort level. Got a unique use case? Think Exalate might be the answer to your scattered support processes and manual ticket escalations? Drop a comment below, or if you’d rather chat one-on-one, book a call with us. Let’s make your integration work for you, not the other way around.
