Keep your Azure Arc Server extensions up-to-date #AzureHybrid #HybridIT #Azure

Microsoft Azure Arc enabled Servers

When you have your Servers Azure Arc enabled, you will work with Azure Arc extensions to work with Azure hybrid features like Defender for Cloud, Azure Monitor, Windows Admin Center and more. For each Azure Arc extension you can get updates, and it’s important to keep them up-to-date for new functionality and security. You have Azure Arc extensions for Windows Servers but also for Linux Servers.
Some of the Azure Arc extensions will automatic upgrade when you have enabled it and some must go manually from the Azure Portal.
More information about Azure Arc extensions you can find them here

In the next steps you will see the Update management of the Azure Arc enabled extensions :

Here I update one extension.

Inside the WindowsOsUpdateExtension

Here you can see that the WindowsOsUpdateExtension is up-to-date
and Status Succeeded

On the right of this screenshot you see Automatic Upgrade and some extensions are enabled, but some are not supported.
That’s why it’s important to check these updates.

Here you can see in the Status that two Azure Arc extensions are updating

And sometimes it failed to update.
But you can see what you can do best with this failed Status.

Here you see the error message and the Tips.
And when you can’t fix it yourself you can make a Support ticket right away.

Here you can see that all the Azure Arc extensions are updated successfully

So I selected all my Azure Arc enabled Servers and updated them all.

Conclusion

With Microsoft Azure Arc enabled Servers you have do some IT management to keep your Azure Arc extensions up-to-date.
I did this without rebooting Servers, just from the Azure Portal update Azure Arc extension.
Here you find more information about Microsoft Azure Arc for Azure Hybrid IT

Join Azure Hybrid Community Group on LinkedIn

Thank you #Community and #Microsoft for this Awesome Year 2022! Happy Holidays

What a Year 2022!!

I like to thank you Community for Supporting, Sharing and Reading New Microsoft technologies on my Blog, Twitter, Facebook and
LinkedIn Community Groups 💗 I wish you all happy Holidays, Merry Christmas and a Healthy New Year 2023 may the Best Wishes comes true ! 🎄🥂

I’m very proud and Honored  on the Microsoft Global MVP Awards 2022-2023 !

• MVP Award for Cloud and Datacenter Management
• MVP Award for Windows Insiders
• MVP Award for Azure Hybrid

Thank you Microsoft Product Groups, MVP Award Program, Windows Insider Team, Azure Hybrid Team, Windows Server and Azure Stack HCI Team for all your support, NDA PGI sessions, and for the Awesome software, Features, solutions you are building 🙂
Wish you all Happy Holidays, Merry Christmas and a Healthy New Year 2023 may the Best Wishes comes true ! 🎄🥂

Here are some Great links for Reading and Sharing :

JOIN these LinkedIn Community Groups for free and Share New Microsoft Technologies Together:

Windows Admin Center Community Group

Containers in the Cloud Community Group

Microsoft Azure Monitor & Security for Hybrid IT Community Group

Azure Hybrid Community Group

Azure DevOps Community Group

What I really love is the Microsoft Tech Community platform

---

For Microsoft Azure Hybrid:

Azure Arc Jumpstart site

Azure Hybrid and Multi Cloud documentation

Microsoft Azure Arc Community monthly Meetup (GitHub)

Follow on Twitter for Azure Hybrid:

@ThomasMaurer

@LiorKamrat

@rcTibi

——————————————————————————————————————————————————-

For Windows Insiders:

Microsoft Windows Insiders Blog

Windows Insider Team on YouTube

The Windows Insider Program Team is really active on Twitter:
@WindowsInsider

@JenMsft

@NorthFaceHiker

@brandonleblanc

@amanda_lango

---

Get started with the Windows Server Insider program

What’s New in Windows Server 2022

Overview of Windows Admin Center

What’s New in SQL Server 2022

---

#MVPLABSerie Azure Defender for Cloud with #AzureArc enabled SQL Server #AzureHybrid #Security

Azure Arc enabled SQL Servers Architecture

To keep your Business running, It’s important to secure and monitor your data. One of the security measures is doing Vulnerability assessments in your datacenter(s) to see the status and results for remediation. With Microsoft Azure Arc Defender for Cloud you can do a SQL Server vulnerability assessment in your on-premises datacenter or anywhere with the Azure Arc agent running.
Here you find more information about Azure Arc enabled SQL Server

Microsoft Defender for Cloud on Azure Arc enabled SQL Server

Here I activated Microsoft Defender for Cloud on Azure Arc enabled SQL Server, and Azure Defender for Cloud is doing a SQL vulnerability assessment to get the security status and results for remediation.

On this same Azure portal page you will see the Vulnerability assessment findings.

When you Open a Vulnerability finding, you get more information and the remediation for the issue.

Here you see the complete Resource Health of the Azure Arc enabled SQL Server.
Look at the Status of each severity.

Here you see all the vulnerability findings on these four databases.

When you do the remediation you will see the healthy status.
on the Passed tab.

Here I open only the OperationsManager database.
Now you see only the Vulnerability findings on this database.

Here you see a vulnerability finding on the SCOM database with the Remediation 🙂

You can make your Own Workbooks or use them from the Gallery.

Workbook example of Vulnerability Assessment findings.

Conclusion

With Azure Defender for Cloud vulnerability assessment and management you will learn a lot to set your Security Baseline on a higher level in your datacenter(s). Getting the right remediation of Microsoft to solve security issues is Great! You can do your assessments frequently to show your current status on demand. I Really like these Azure Hybrid Tools to make my work easier and the data more secure for the business.

Please join the Azure Hybrid Community Group on LinkedIn for free ( Sharing is Caring together )

#MVPLABSerie Azure Arc enabled SQL Server Health Assessment #AzureHybrid #AzureArc #SQLServer

Azure Hybrid

In earlier MVPLABSerie blogpost I wrote about making your on-premises Servers hybrid with Azure Arc enabled Servers.
In my mvplab.local domain, there is a SQL 2022 Cluster running which also has the Azure Connected Machine Agent version 1.24.

One of the benefits of Azure Arc enabled Servers for SQL is that you can do on-demand SQL Health assessments on your SQL Environment in your On-premises Datacenter. In the following step-by-step guide we will prepare the SQL Cluster nodes.

Go to this link to watch the video

In my mvplab.local domain I’m doing the following steps :

Go in the Azure Portal to Azure Arc
Click on SQL Servers under Infrastructure.
Click on Add

I Choose for Connect Servers
because both SQL Nodes are already connected in my MVPLAB.local domain.

Prerequisites
Click on Next Server details.

Select the right Azure Subscription and Resource Group
Select the region and Operating System
Set Proxy server URL if you need one
Click on Next.

Set your owner tags if needed.
Here you can find more information about Tags Management

From here you have to download the Script
and Run it locally on both SQL Nodes. ( or your Single SQL Server )

Run the script in administrator modus of Powershell ISE.
go to page https://microsoft.com/devicelogin
and enter the Code

Login and continue.

Here you see that the Azure Connected Machine Agent already is installed.
But it will now add the SQL Extension.

Installation Completed Successfully.

Now we have two Azure Arc enabled SQL Servers connected.

Overview of SQL 2022 Node in Azure Arc.

You can see the Databases running.

Here you can set your Admin from Azure Active Directory.

But we want to do a SQL Assessment, but the Azure Monitoring Agent is still missing.

Here you see that the SQL extension is installed.
Now we will add the Azure Monitor Agent to my existing Log Analytics Workspace.
Click on Add

Select Log Analytics Agent – Azure Arc.

Add your Workspace ID
Add your Workspace Kay
Click on Review + Create

Validation Passed.

Azure Monitoring Agent is Installed.

From here you can do the On-Demand SQL Assessments via
Microsoft Azure Arc enabled SQL Servers.

The SQL Server Assessment focuses on several key pillars, including:

• SQL Server configuration
• Database design
• Security
• Performance
• Always On
• Cluster
• Upgrade readiness
• Error log analysis
• Operational Excellence

Example of SQL Server Assessment results.

On each assessment result you get a recommendation from Microsoft so you can make your SQL environment Health and Secure!

Conclusion

To get these health results of your SQL environment is Awesome 🙂 You are in control of your Azure Hybrid Arc enabled SQL Servers to keep them Healthy and Secure. The following Azure Arc enabled SQL Server blogpost is about Azure Defender for Cloud for your SQL Servers. With these two Azure Arc for SQL Server features you get the best Insights to keep your data as save as possible.

#MVPLABSerie Azure Update Management Center (Preview) and #AzureArc enabled Servers #AzureHybrid

Microsoft Azure Update Management Center (Preview)

Update management center (preview) is a unified service to help manage and govern updates for all your machines. You can monitor Windows and Linux update compliance across your deployments in Azure, on-premises, and on the other cloud platforms from a single dashboard. Using Update management center (preview), you can make updates in real-time or schedule them within a defined maintenance window. Here you can find more information about Azure Update Management Center

In the following step-by-step guide, we will start with Azure Update Management Center (Preview) and Microsoft Azure Arc enabled Windows Servers running on-premises in my mvplab.local domain.

With getting started you can configure the environment.

I start here with my Azure Arc enabled Storage Server.

You have options like Hotpatch

We Check manually for Updates on Windows Server mvpstore01
Click on OK for Assessment.

Here are the Windows Server Security updates.
You can click on One-time-Update
But first we look in Update Management Center.

Here you see the Pending Windows Updates in Azure Update Management Center
Open query 

Microsoft Azure Resource Graph Explorer can be really powerful tool

When you have to manage many Windows Servers you can get the status
of these Azure Arc enabled servers and export the results into a CSV file.
Here you find some Azure Resource Graph Explorer queries

Now we start to Install One-time Updates.

Include Update Classification
Click on Add

Click on Next

Select the option if you want to reboot or not.

Review and Install

Updates installed on the Azure Arc Enabled Windows Server.

In Azure Update Management Center Overview Dashboard
you can see that one machine is completed.

For Monitoring you can make your own workbooks.

I like this History, to see if updates are successful or not.

Conclusion

Microsoft Azure Update Management Center is still in Preview but it’s a new way to manage all of your updates on your Servers on-premises with Azure Arc enabled, or on Azure Cloud, but also in other Clouds if you want. One Update Management Center from the Azure Portal is Awesome to work with and gives you control and overview of your update compliance in your datacenter(s).
Important: This Great tool is still in preview and not for production environments yet until it’s made GA by Microsoft and you have the full support on this awesome management tool.

JOIN Azure Hybrid Community Group on LinkedIn

 

Security Baseline for Azure Arc enabled Servers and Arc Kubernetes #AzureHybrid #Security

Azure Arc Enabled Server network connectivity.

Baseline security is very important to have that in place to keep your Servers more secure in your datacenter. You want Hybrid Servers like Azure Arc enabled servers for example to be secure running in your datacenter. This begins to secure and have up-to-date Server hardware running in your datacenter. Monitor for security updates and install Server hardware based on best practices from the vendor.
Then the Operating System like Windows Server 2022 standard needs the OS Baseline security. This is called:

Microsoft Security Compliance Toolkit 1.0

When your Windows Servers are security compliant by the rules of the company and/or Security Officer, then we can have a look at the Well Architected Framework (WAF) for Azure Arc Enabled Servers.  Here you find an

Introduction to Azure Arc landing zone accelerator for hybrid and multicloud

Azure Arc Single Control Plane.

This security baseline applies guidance from the Microsoft cloud security benchmark version 1.0 to Azure Arc-enabled servers. The Microsoft cloud security benchmark provides recommendations on how you can secure your cloud solutions on Azure. The content is grouped by the security controls defined by the Microsoft cloud security benchmark and the related guidance applicable to Azure Arc-enabled servers.

Security by Default in your Datacenter

Here you find more information about Azure Security Baseline for Azure Arc enabled Servers.

Here you find more information about Azure Security Baseline for Azure Arc enabled Kubernetes.

Security by Design with Azure Security Center and Azure Defender

Azure Arc Jumpstart

When you have read about Azure Arc Well Architected Framework (WAF) and you have your security in place, we can start with Microsoft Azure Arc.
Before you start implementing Azure Arc, you must have seen this Awesome website of Azure Arc Jumpstart!

The Azure Arc Jumpstart is designed to provide a “zero to hero” experience so you can start working with Azure Arc right away!

The Jumpstart provides step-by-step guides for independent Azure Arc scenarios that incorporate as much automation as possible, detailed screenshots and code samples, and a rich and comprehensive experience while getting started with the Azure Arc platform.
Our goal is for you to have a working Azure Arc environment spun-up in no time so you can focus on the core values of the platform, regardless of where your infrastructure may be, either on-premises or in the cloud.

Here you find my MVPLABSerie Azure Hybrid with Arc Enabled Windows Servers on-premises blog 

 

Conclusion

You can manage your compliance and security policies with Azure Arc enabled Servers, Kubernetes, or SQL Managed instances to make your hybrid solutions with
the Microsoft Azure Cloud in a secure environment.  When you work with security by design based on OSI model with 7 security layers and use Microsoft Arc enabled servers, you get also more Azure Hybrid security features like Azure Defender for Cloud, and much more.
Don’t forget the Microsoft Azure Arc Community Monthly Meetup

 

#MVPLABSerie Azure Arc enabled Servers #AzureHybrid

Azure Arc Infrastructure overview

In the last blogpost of MVPLABSerie we learned how to add Servers from anywhere to Microsoft Azure Arc services to get the Azure Hybrid benefit with awesome features and Management tools. you can find that blogpost over here:

MVPLABSerie Azure Hybrid with Arc Enabled Windows Servers on-premises

So with this I have added my on-premises Windows Insider Servers to Microsoft Azure Arc:

Connected Azure Arc Servers

In the following steps we are going to add Windows Admin Center to the Arc enabled Windows Servers on-premises.
Here you can read more about Azure Arc-enabled Servers using Windows Admin Center in Azure (preview)

With Windows Admin Center in the Azure Portal you can manage the Windows Server operating system of your Arc-enabled servers, known as hybrid machines. You can securely manage hybrid machines from anywhere–without needing a VPN, public IP address, or other inbound connectivity to your machine.

Open Servers and open your Azure Arc Enabled Server.

First of all we have to add the right Role assignment.
Click on Access Control on the Left.
Click on Add => Add Role Assignment.

Here you have to add the following Role Assignment.
Windows Admin Center Administrator Login.
Add this to your account

When the account is done, then go to Windows Admin Center (Preview)
on the left panel. Click then on Setup.

Click on Install

Setup Successfully!

Now you can Connect your Azure Arc Enabled Windows Server.

Here we have my Storage Windows Insider Server in mvplab.local domain.
From here you can do your IT Management with WAC.

Remote PowerShell on Azure Arc enabled Server.

Microsoft Azure Arc Insights Monitoring and Log Analytics

For IT Management and troubleshooting, monitoring and getting Insights is important to act quickly to keep the business and IT solutions running. With Azure Arc Insights you can see with Maps the connections of the Windows Server.

Azure Arc Insights with Map.
See also the Quick Link to Connection details

This is a really cool overview of your connections.
Here you can see if you have a Malicious connection!

Microsoft Azure Arc Log Analytics is very Powerful
Here you find more information about Log Analytics

Here I do a Query on the Arc Enabled Server mvpstore01
Update Summary.

There are a lot of Log Analytics queries to play with and mark them as your favorite for your Arc enabled Windows Server 😉

In the following blogpost we will have a closer look at Microsoft Azure Auto Manage and Update Management Center for
Microsoft Azure Arc enabled Windows Servers. We will not forget Security with Azure Defender for Cloud coming in the next blogposts.

Conclusion

With Microsoft Azure Arc enabled Servers you get a Microsoft Azure Hybrid environment with Great features and solutions.
Some features are still in preview and not supported for production workloads, but you can test them now like I do with my mvplab.local
This new innovative technology is going fast forward for Azure Hybrid Services to Manage your Windows Servers, Azure Stack HCI Clusters or your Linux virtual Machines. Azure Arc rocks and you can connect Microsoft Azure Anywhere 🙂

#MVPLABSerie Azure Hybrid with Arc Enabled Windows Servers on-premises #AzureHybrid #Winserv

Microsoft Azure Hybrid with Arc enabled Servers

the last MVPLABSerie blogposts was about Windows Servers Insider with mvplab.local domain and SQL Clustering on-premises :

• MVPLAB Serie Windows Server Insider Cluster with ISCSI Target Server

• MVPLAB Serie Cluster Aware Updating – CAU for Windows Server Insider

• MVPLAB Serie Installing SQL Server 2022 CTP on Windows Server Insider Cluster

• MVPLAB Serie Installing SCOM 2022 monitoring with SQL Cluster

• MVPLAB Serie Installing SCOM 2022 Web Console for Monitoring

Today every company wants to benefit from Cloud to achieve more for the business. Microsoft made Azure Arc to simplify governance and management by delivering a consistent multi-cloud and on-premises management platform.

Microsoft Azure Hybrid

In the following steps we are going to onboard the Windows Insider Servers and Windows 11 Insider Beta Virtual Machine which are running in mvplab.local domain into the Microsoft Azure Cloud. We will install the Azure Connected Machine Agent via a PowerShell Script in the next steps :

Login in the Azure Portal

1. Search for azure arc
2. Click on Azure Arc.

Getting Started with Azure Arc

Click on Servers and then Click on Add.

Here you can Choose for the right script.
I choose for Add Multiple Servers with a Service Principle.
Click on Generate Script.

Read the prerequisites access to port 443.
view Outbound URLs link.
Click Next

Select the right Azure Subscription and Resource Group.
Select your Azure Region.
Select Operating System
Select the Connectivity method.
Click on Next

If you don’t have a Azure Service principal, you can create one here.

Click on Create Service principal.

Create your Service Principal

Copy your Client ID and Client Secret !
You need this later.

Select the just created Service Principal.

Here you can Tag the Arc Servers.
Here you can read more about Tagging
Click on Next

Choose the Deployment method :
Basic Script or Configuration Manager ( I choose for Basic)
Download the Script

I have copied the script to my Domain Controller On-premises here.

Open with PowerShell ISE the OnboardingScript.ps1
and Copy / Paste your
Service Principal Client ID and Secret here in the Script.
Click on save and run the script.

Start PowerShell in Admin modus

Run Script .\OnboardingScript.ps1

Server is connected with Azure 🙂

Here is the Azure Arc Enabled Server, my Domain Controller.

Here I have all the Azure Arc Capabilities available for my Domain Controller.
Azure Hybrid

With the Same Script I added the mvplab.local Windows Insider Servers to Azure
They are all Azure Arc Enabled Servers.

On all Azure Arc enabled Servers is the Azure Connected Machine Agent installed.

Conclusion

In a simple way you can deploy Azure Arc agent on your on-premises Servers to make them Azure Arc Enabled so you can enjoy the Azure Hybrid features from the Cloud. IT management and Security from Azure becomes available for your on-premises Servers.
It’s not only Infrastructure but also Data Services and Application Services what you can use for your Azure Hybrid Solution.
In the next Blogpost we will have a look at the Microsoft Azure Arc Features in my mvplab.local domain.

MVPLAB Serie Installing SCOM 2022 Web Console for Monitoring #SCOM #MVPLABSerie

Microsoft System Center 2022 Operations Manager Web Console

In the Last Blogpost MVPLAB Serie we installed Microsoft System Center 2022 Operations Manager on a Windows Insider SQL Cluster for testing and monitoring. You can find that blogpost here

Before we install Microsoft System Center 2022 Operations Manager Web Console, you should have a look at the requirements of SCOM 2022 Web Console for the IIS settings and features.
In the following steps we will install SCOM 2022 Web Console

First of all you have to install the IIS Features.
See the Microsoft Docs.

Don’t worry if you missed a setting, Microsoft did make a requirements check in the installation procedure before you can move on with the installation of SCOM 2022 Web Console. You will see later.

Run the setup as Administrator of the SCOM 2022 software ISO.

Select Web Console.
Click on Next.

This is what I mean by forgetting a feature Role.
Install the feature Role.
Verify prerequisites again.
Then Click Next.

All Prerequisites have passed.
Click on Next.

Here you can select your website and activate SSL
More information about Configuring Authentication for the Web Console

Click on Next

Select your Authentication
Click on Next.

Read the Diagnostic and Usage Data
Click on Next

Check if the Installation Summary is good.
Click on Install

Setup is Completed

SCOM 2022 Web Console is running

Now you can configure your Microsoft System Center 2022 Operations Manager monitoring with the right Management Packs installed via your Edge web browser to get monitoring and alerts in place. Here you find more information about SCOM Management Packs

Now we have in our MVPLAB On-premises Datacenter everything running, we will have a look at Microsoft Azure Hybrid benefit in the following MVPLAB Series. Think about Microsoft Azure Arc Services, Security and more.

#Microsoft Windows Server 2022 Insider Preview Build 25140 #Winserv #WindowsServerInsider #WAC

Here you can Download Windows Server Insider Preview Build

Ps. I downloaded the VHDX file for Hyper-V, but you can get also the ISO file here.

Getting started with the Windows Insider Program for Windows Server

Get exclusive access to Windows Server Insider Previews and Remote Server Administration tools and help shape the future of Windows Server in the Windows Insider Program for Windows Server. Register here for the Windows Server Insider program 

From here you can build your own local domain and Clusters in your LAB to test all the Features Windows Server 2022 Insider Preview Build 25140 has. Checking new Security features and doing your own pen tests.

Windows Server 2022 Insider Preview Build 25140.

Microsoft Vulnerable Driver Blocklist 

Testing security with Kali Linux Rolling distro in WSL 2.0 against Windows Server Insider
in my Lab. And give feedback about features and or issues on Windows Server Insider :

Give feedback on Windows Server Insider Preview Builds

And of course don’t forget Windows Admin Center for your LAB to manage your Servers, Azure Virtual Machines and your Clusters. You can download WAC here

What is new in preview is Windows Admin Center in the Azure Portal with Azure Arc Enabled Servers.

Windows Admin Center in the Azure Portal for Arc Enabled Servers 😉
Manage your Servers from the Cloud.

Conclusion

With Windows Server Insider Builds and Windows Admin Center, you can test and make your own LAB environment together for free. You can give the Microsoft product group feedback to make the product better. In the mean time your are learning new features and security in Windows Server Insider Preview Build and WAC before you go into production 🙂
I say a good win win situation and it’s fun to setup your own hybrid LAB.

Follow Microsoft Windows Server Insider Team on Tech Community