Study Guide for AZ-305: Part 2 – Design Authentication and Authorization Solutions

Hi Cloud Marathoners!

This is the continuation (Part 2/12) of blog post series to help you get ready for the latest AZ-305 exam. As title says – our focus will be on understanding and designing Authentication and Authorization Solutions in Microsoft Azure.

Feel free to check the previous post (Part 1/12) if you did not look into it yet ๐Ÿ™‚

Table of content (blog series)

What is the Authentication and Authorization?

To put it in plain English language, authentication is the process of verifying who someone is, where as authorization is the process of verifying what specific applications, files, and data a user has access to.

To relate these concepts to a real-world scenarious, you may think about your airport access and on-boarding to the plane experience. Thus, when you go through the security in an airport, you are required to show your ID to authenticate your identity. Then, you proceed and arrive at the gate, you present your boarding pass to the flight attendant, so they can authorize you to board your flight and allow access to your assigned seat.

Authentication vs Authorization. Authentication vs. Authorizationโ€” Theseโ€ฆ |  by Frank D'Amico | Medium

WHAT YOU CAN DO WITH Authentication and Authorization?

The authentication and authorization services are part of the Microsoft’s identity platform.

The Authentication sometimes shortened to ‘AuthN’.
The Microsoft identity platform uses the OpenID Connect protocol for handling authentication. On the other hand, Authorization sometimes shortened to ‘AuthZ‘. The Microsoft identity platform uses the OAuth 2.0 protocol for handling authorization.

In Microsoft Azure your authentication and authorization is delegated to Azure Active Directory (Azure AD). By using this centralized identity provider you can enable following secure workflows for your business:

  • Conditional Access policies – that require a user to be in a specific location.
  • The use of multi-factor authentication, which is sometimes called two-factor authentication or 2FA.
  • Enabling a user to sign in once and then be automatically signed in to all of the web apps that share the same centralized directory. This capability is called single sign-on (SSO).
From AD to Azure AD โ€“ Your Hybrid Identity Journey - New Signature

Part 2: Designing Authentication and Authorization solutions

The references below are taken from official Microsoft docs and focused on designing Azure Authentication and Authorization solutions. You could also find it helpful to check the Microsoft docs and learning paths with [Tutorials] below ๐Ÿ™‚

This collection of links is gathered with a focus on the exam objectives of the AZ-305 certification exam.

Azure identity management security overview
Azure Identity Management and access control security best practices
Five steps to securing your identity infrastructure
What is Azure Active Directory?
Compare Active Directory to Azure Active Directory
Azure Active Directory B2B best practices
Overview: Cross-tenant access with Azure AD External Identities (Preview)
Identity Providers for External Identities
Authentication and Conditional Access for External Identities
What is Azure Active Directory B2C?
Technical and feature overview of Azure Active Directory B2C
What is Conditional Access?
Plan a Conditional Access deployment

[Tutorial]: Secure user sign-in events with Azure AD Multi-Factor Authentication
[Tutorial]: Enable users to unlock their account or reset passwords using Azure AD self-service password reset (SSPR)
[Tutorial]: Enable Azure Active Directory self-service password reset writeback to an on-premises environment

What is Identity Protection?
What is risk?
Azure Active Directory Identity Protection – Security overview
Identity Protection policies
What are Azure AD access reviews?
What are managed identities for Azure resources?
What is identity lifecycle management?

Microsoft Azure Well-Architected Framework – Security
Authenticate apps to Azure services by using service principals and managed identities for Azure resources
Application and service principal objects in Azure AD
Azure Key Vault basic concepts

Best practices for using Azure Key Vault
Azure Key Vault logging
Virtual network service endpoints for Azure Key Vault
Monitoring Key Vault with Azure Event Grid

SUMMARY

Thank you for visiting the AZ-305 Study Guide and checking the Part 2 โ€“ Designing Authentication and Authorization Solutions.

The next blog will cover the Part 3: Design a solution to log and monitor Azure resources.

Study Guide for AZ-305: Part 1 – Design a Governance Solution

Hello friends,

As you might already know, a new AZ-305 exam for Azure Architects has been officially released a few days ago!!!

I would like to take this opportunity and help all my students and followers with preparation for this important exam.

My plan is to create a blog post series that cover official and community learning materials in addition to the Microsoft Learn, self-paced learning modules.

Table of content (blog series)

This exam is focused on designing cloud and hybrid solutions on Microsoft #Azure, and was made with #architects in mind ๐Ÿ˜


A list of helpful reference materials that will complement your four Microsoft Learn AZ-305: XXX learning paths on the official learning site are screenshotted below for your references ๐Ÿ™‚

What is the Cloud Governance ?

The Cloud Governance is a framework that guides how end users make use of cloud services by defining and creating policies to control costs, minimize security risks, improve efficiency and accelerate deployment. Itโ€™s imperative to have good cloud governance because itโ€™s a foundational element to your cloud practice that provides the ability to scale and be successful.

In short, the governance in Azure is one aspect of Azure Management. This includes the tasks and processes required to maintain your business applications and the resources that support them. Azure has many services and tools that work together to provide complete management. 

What you can do with Azure Governance?

  • Enforce and audit your policies for any Azure service
  • Create compliant environments using Azure Blueprints, including resources, policies, and role-access controls
  • Ensure that youโ€™re compliant with external regulations by using built-in compliance controls
  • Monitor spend and encourage accountability across your entire organization

The references below are taken from official Microsoft docs and focused on designing Azure governance solutions.

Build Enterprise Agile Azure Governance Foundation

Part 1: Design a governance solution

The references below are taken from official Microsoft docs and focused on designing Governance solutions in Azure. You could also find it helpful to check the Microsoft docs and learning paths with [Tutorials] belowย ๐Ÿ™‚

This collection of links is gathered with a focus on the exam objectives of the AZ-305 certification exam.

How to protect your resource hierarchy
Cloud governance guides
What are Azure management groups
Azure subscription and service limits, quotas, and constraints
What is Azure Resource Manager
Lock resources to prevent unexpected changes
Use tags to organize your Azure resources and management hierarchy

Azure Policy
What is Azure Policy?
Azure Policy built-in policy definitions
Azure Policy built-in initiative definitions
What is Azure role-based access control (Azure RBAC)?
Organize and manage multiple Azure subscriptions
Recommended policies for Azure services
What are Azure management groups?
[Tutorial] Describe core Azure architectural components
[Tutorial] Microsoft Cloud Adoption Framework for Azure
Governance in the Microsoft Cloud Adoption Framework for Azure
Define your tagging strategy

Summary

Thank you for visiting the AZ-305 Study Guide and checking the Part 1 – Design a Governance solution.

The next one will be Part 2: Design Authentication and Authorization Solutions.

Finally, the GitHub profile is updated ๐ŸŽ‰

Hello friends,

Hope everyone is having a great start in 2022.

I have to postpone a couple of things at the end of 2021 due to unexpected events, and one of them was updated to my old GitHub account.

Since the beginning of 2019, there were many great additions to the GitHub community. One of the remarkable features is the ability to customize your profile.

Image

Without any overdue, I have analyzed a couple of tips from the link above and looked into samples, and created my customized GitHub profile.

Of course, it is not perfect. I am looking to make it better over time.

Please, let me know your suggestions and feedback or share your #awesome GitHub profile with the community!

Latest updates on OSS ๐Ÿงก AWESOME Azure Bicep ๐Ÿ’ช

Hello Cloud Marathoners!

As you were informed in my last post, I have published a new GitHub repo to help the community and new learners with Azure Bicep resources. The new repo – AWESOME Azure Bicep ๐Ÿ’ช is getting a high interest from all of you.

Thank you very much for accessing, starring โญ and forking ๐Ÿด it!
If you learn about it now, please check it out here.

And this is not all. We have plenty of room to grow this repo with the latest contributions from you.

Two new contributors

In less than a week, we got two great contributions from Kasun Rajapakse and Luke Murray ๐Ÿ™Œ. Thank you very much for your contributions!

Get started with Azure Bicep

Let’s step-up your game and start learning the latest ๐Ÿš€ Azure #infrastructureascode language (aka, Bicep).
I sincerely invite you to become a part of this really great “learn and share” initiative of Azure Bicep.

Share your interest and knowledge with the community by opening your very first GitHub PR.

Looking for a video course on Azure Bicep ?๐Ÿค”
>> Azure Bicep First Look ๐Ÿ‘‰ย https://lnkd.in/eWsxf3hjย is here to help!

Summary

This project is growing and let’s become a part of this Azure Bicep community !

Ready to make your first PR to Awesome Azure Bicep repo?
Please check out the contribution guide or reach out if you need help in this process.

What is the AWESOME Azure Bicep ? ๐Ÿ’ช

Hello Cloud Marathoners!

I have been getting many questions on how to start an Azure Bicep journey – in a special and AWESOME way ๐Ÿ˜€ – which brought an idea to create the AWESOME Azure Bicep GitHub repo for the community ๐ŸŽ‰

Long story short, this has been on ideation for few days and is life now, as of Jan 18, 2022 ! ๐Ÿ˜

Now, I have started gradually adding important official and community resources to help new #Azure learnersย and #cloudmarathoners!

AWESOME Azure Bicep repo

Please, share โญ and fork ๐Ÿด this repo and make your contributions.

I really ask you ๐Ÿ™Œ๐Ÿ™ to make your contributions and help maintain and grow this repo going forward.

Thank you for all your ๐Ÿ‘จโ€๐Ÿ‘ฉโ€๐Ÿ‘งโ€๐Ÿ‘ฆ continued support!

Welcoming the Microsoft Exam Simulator โœ”๏ธ

Hi Cloud Marathoners!

It is pretty common for every new student to be worried about exam software โš™๏ธ and its user expereince, in addition to being prepared for the exam. However, this is not an issue anymore.

Microsoft Learn has introduced a demo exam simulator that looks, works and feels like you are having a real Microsoft exam. This news was just announced by Microsoft Learn Blog.

I believeย this is an important help for all the #cloudmarathoners and friends who are just starting their Microsoft Azure journey.

Why is it helpful?

Well, using this new exam sandbox should better prepare you for the exam experience. This should also increase your familiarity with the user interface, how to navigate between exam sections, pages and Q&A.

This simulator also shows you what actions are required to answer each of the different question types, where information about the exam is located, how to mark questions for review and how to provide comments at the end of the exam.

Important

Keep in mind that a secure browser that will be launched during a real exam will block all third-party applications running on your computer. Thus, I would strongly advise youย to install and run the exam provider’s (like, Pearson VUE or any other) simulator on your local computer a day or two before the actual exam date. This will be an additional peace of mind to have in your checklist for a pleasant exam experience.

Conclusion

I sincerely wish you Good Luck โค๏ธ in your upcoming exam(s) !

Are you ready to give it a try ?
Then check it out for #free >> https://aka.ms/examdemo

References: New to Microsoft certification exams?

Happy to join the #OpenHack Containers coaches club ๐ŸŽ‰

Hello Cloud Marathoners!

Few weeks ago, I participated in the Microsoft OpenHack Containers event. This was an awesome event where I had a chance to coach a team of professionals to tackle containerization challenges.

What is Microsoft OpenHack

Microsoft OpenHack is a developer-focusedโ€ฏengagement that connects development teams (Open)โ€ฏwith experts to tackle a seriesโ€ฏof real-world challenges through hands-onโ€ฏexperimentationโ€ฏ(Hack) in person or online (Virtual).

What was in the challenge?

We started with good old docker tooling for containers and ended up migrating those several containers and dependencies to the Azure Kubernetes Services. However, the most interesting part was applying best practices and security configurations to the migrated workloads.

Due to participation disclosure agreement, I would not be able to detail each team challenge (about 7-8). However, this was real teamwork that required learning and experimenting for all the team members.

My team went throughย ups and downs while trying to complete the necessary number of challenges to earn the badge. I am very happy that my team was able to complete the required challenges, learn important hands-on skills, and get theirย well deserved badges.

I was very pleased to help my team along their containerization journey. At the end, I feel very honored and appreciated to receive an OpenHack Containers Coach badge.

OpenHack: Containers Coach

Interested to get started with containers in Azure ?

Check out the following #free resources to start your own containerization learning path in Azure:

Thank you  ๐Ÿ™Œ for reading this post and checking the learning resources above.

Please, feel free to share your experience with the #cloudmarathoner community.
I will be happy to share your experience and tips here as well. ๐ŸŽ‰

I am planning to keep this post up to date with your valuable contributions going forward!

Study guide DA-100: Analyzing Data with Microsoft Power BI

Hello Cloud Marathoners!

I am very happy to announce my next Microsoft certification badge!.
This time, I was able to pass the DA-100: Analyzing Data with Microsoft Power ๐Ÿš€ BI.

Microsoft Certified: Data Analyst Associate

If you are looking forward to get prepared for this exam, then check out the following resources:

๐Ÿ“Œ Microsoft Learn modules:
โžŸ Get started with Microsoft data analytics
https://lnkd.in/g9_bfRhR

โžŸ Prepare data for analysis
https://lnkd.in/gguGnTzw

โžŸ Model data in Power BI
https://lnkd.in/gnXrGhRS

โžŸ Visualize data in Power BI
https://lnkd.in/gCr72iuH

โžŸ Data analysis in Power BI
https://lnkd.in/g4s4NGan

โžŸ Manage workspaces and datasets in Power BI
https://lnkd.in/gCRRAFDX

๐Ÿ“Œ YouTube courses:
โžŸ Analyzing Data with Microsoft Power BI | DA-100 Certification Exam Prep
https://www.youtube.com/watch?v=dyiCeP6JxaU

โžŸ DA-100: Analyzing Data with Microsoft Power BI โ€“ FULL COURSE in 2 hours
https://www.youtube.com/watch?v=Tfk3ae0qz3A

๐Ÿ“Œ Udemy Course:
โžŸย DA-100 certification: Analyzing Data with Microsoft Power BI byย Phillip Burtonย atย https://lnkd.in/gH5SuQ2F

Microsoft Learn Updates Jan 14, 2022

If youโ€™ve already earned the Data Analyst Associate certification, you will see the new name in your Certification Dashboard on February 28, 2022.

If youโ€™ve been studying for Exam DA-100, no worries. You have until March 31, 2022, to take it.ย 

If youโ€™ve just started preparing for Exam DA-100, consider reviewing the skills requirements for new Exam PL-300 and switching your focus to the new exam because the exams are very similar.ย  However, between February 28 and March 31, 2022, learners can pass either exam to earn their Power BI Data Analyst Associate certification.

Microsoft Lean blog
thumbnail image 1 of blog post titled 
	
	
	 
	
	
	
				
		
			
				
						
							Announcing a new name for the Data Analyst Associate certification

Conclusion

Thank you for reading this post and checking the preparation resources.

Please, feel free to share your experience, as i am planning to keep this post up to date with your valuable contributions going forward. #keeplearning

Azure Bicep First Look course is released!

Happy Friday friends,

Are you looking for a simpler, more efficient way to author infrastructure resources in Azure?

Azure Bicep First Look course


If so, youโ€™re in luck. Azure Bicep is here to help. Bicep is a new domain-specific language (DSL) for deploying resources in Azure. Itโ€™s also a much cleaner, more concise language than ARM JSONโ€”cloud admins and DevOps professionals, rejoice!

Please, let me know if you need any help with my new Azure Bicep First Look course.

I am here to help you in your Cloud journey!
Stay tuned for more Azure content!

What are the good options to manage sensitive info in Azure Bicep?

Hello Cloud Marathoners,

Every seasoned IT professional knows that sensitive information should not be exposed as a clear text on any code. This is especially true for infrastructure-as-code (aka, IaC) scenarios where passwords and keys are part of the deployment.

One way to stay compliant in accomplishing this goal is the integration of an Azure Key Vault service into your deployment code. This Azure security service is primarily intended to store sensitive information like password, keys, certificates, connections, etc.

In this post, we will look into two different ways how we could integrate Azure Key Vault services in our Azure Bicep code.


Option – 1: Using getSecret() function

Our first option is to delegate this important work to a getSecret() function. This option could be used with an existing Azure Key Vault resource that is declared in your Azure Bicep code.

Let’s look into an example where an existing Azure Key Vault service is referenced to provide administrative password for SQL server deployment.

Deploying Azure SQL instance with Azure Key Vault

This sample Bicep code is using sqldb.bicep file as a module, where parameters; such as sqlServerName and adminLogin are passed through with a secret name of ExamplePassword.

The ExamplePassword secret name should be already set and ready in the referenced Key Vault service above. Here is the view of this secret on Azure portal.

Azure Key Vault with secretes in portal

Let’s have a quick view into the sqldb.bicep file, as it is referenced in the main Bicep file.

sqldb.bicep file

Now, let’s deploy these resources with a secret value from Key Vault resource that has a secret name ExamplePassword.

What happened? I am getting an error on my first deployment execution ๐Ÿ™

Error on deploying Bicep code with SQL server provisioning

Upon carefully analyzing error, I see the following reason for this error:

At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.”,”details”:[{“code”:”RegionDoesNotAllowProvisioning”,”message”:”Location ‘East US 2’ is not accepting creation of new Windows Azure SQL Database servers at this time.

Azure deployment error

Based on the error message, we change the location to eastus and re-run the script. Now, we got the following positive result in console and portal:

Deployment results in Azure Portal RG

Next, we will attempt to login into a SQL Server instance.
A successful login will look like the following screen:

Successful login into the SQL instance

Important Note:

If you are getting an error during the login then try to check the following steps:

  • adminLogin name is entered correctly
  • your IP address is added to the SQL server firewall rules
  • grab a cup of coffee and check back in 5 minutes

Description of a typical login error into a SQL server instance is provided below. I checked the firewall rules and made a cup of coffee => before getting a successful log-in ๐Ÿ™‚

Requires your location IP activation

Option -2: Referencing as a secretName in parameter

The second option is pretty straightforward, if you have already used it on ARM template deployments.

Note: Please check out the following post – Four parameterization options for your Azure Bicep deployments for detailed information on available options.

We just need to reference Azure Key Vault secret like in the following example:

Using a parameter file and referencing the Key Vault secretName will do the trick in extracting the value and provisioning your resource.

Let’s run the bicep file that deploys multiple RGs and an Azure VM that uses VMPassword secret.

Running deployment with Bicep parameter file

A successful deployment provisions following RG with the VM resources:

Next, we should smoke test our deployment by locating the resource group “rg-demo-vm-1116” and using deployment parameters to RDP into Windows server:

Finally, we are able to see that secret and admin user name pair worked as expected

Azure VM deployed using Key Vault secret

Summary

In this post, we looked into two available options that harden our infrastructure code by removing hard-coded sensitive information and replacing it with Azure Key Vault reference. Thus, avoiding any potential leaks of passwords, secrets, etc.

IMHO, first option is better than the later one, because it does not expose subscription id and other small details.

What will be your choice? Please, share on LinkedIn post comments section.

Thank you for your interest my #cloudmarathoner friends!
Please, check other Azure Bicep posts and let me know your feedback.

What is next?

All code samples and presented Bicep files are placed in “Learn-Bicep” GitHub repo ๐Ÿ‘‰ https://lnkd.in/ds-h9VQx

Please, join me to learn more about Azure Bicep ๐Ÿ’ช on an Omaha Azure User Group meetup scheduled to happen on November 17th.