Azure Machine Learning and PyTorch Lightning

Azure Machine Learning and PyTorch Lightning

This article is contributed. See the original author and article here.

This session focuses on Machine Learning and the integration of Azure Machine Learning and PyTorch Lightning, as well as learning more about Natural Language Processing.


 


PytorchLighting.PNG



This session speakers are:




  • Aaron (Ari) Bornstein – an Senior Cloud Advocate, specializing in AI and ML, he collaborates with the Israeli Hi-Tech Community, to solve real world problems with game changing technologies that are then documented, open sourced, and shared with the rest of the world.




  • Tal Baumel – a PhD graduate from the Computer Science department at Ben Gurion University. Tal worked on the Natural Language Processing Project under the supervision of Professor Michael Elhadad – focusing on automatic summarization. Tal is now working as a data scientist for Microsoft on Conversation Intelligence in Dynamics 365 Sales Insights.




Watch the video here:





Resources from the session
































































Resource URL
Training Your First Distributed PyTorch Lightning Model with Azure ML https://aka.ms/cs-pytorch-azureml
Configuring Native Azure ML Logging with PyTorch Lightning https://aka.ms/cs-aml-pytorch-config
Multi Node Distributed Training with PyTorch Lightning & Azure ML https://aka.ms/cs-aml-distributedtraining
Train with PyTorch Lightning – GitHub Repo https://aka.ms/cs-aml-pytorch-repo
PyTorch Lightning Tutorials https://pytorchlightning.ai/tutorials
Azure Machine Learning Documentation https://aka.ms/cs-aml
Azure Machine Learning – Microsoft Learning Path https://aka.ms/cs-aml-path
Visual Studio Code Documentation https://code.visualstudio.com/docs
Azure Machine Learning Studio https://aka.ms/cs-aml-studio
Azure for Students https://aka.ms/azure4students
PyTorch Lightning Documentation https://pytorch-lightning.readthedocs.io
PyTorch Lightning Website https://aka.ms/pytorchlightning.ai
PyTorch Lightning Bolts – GitHub Repo https://github.com/pytorchlightning/pytorch-lightning-bolts

AzUpdate: Azure portal updates, ARM Template support for file share backup and more

AzUpdate: Azure portal updates, ARM Template support for file share backup and more

This article is contributed. See the original author and article here.

It might be snowing in parts of the Northern Hemisphere, but we won’t let that stop us from sharing Azure news with you.  News covered this week includes: New Azure Portal updates for November 2020, Azure Resource Manager template support for Azure file share backup, How to use Windows Admin Center on-premises to manage Azure Windows Server VMs, Multiple new features for Azure VPN Gateway now Generally Available, and our Microsoft Learn Module of the Week.


 


 


Azure Portal for November 2020


Two new updates have been applied to the Azure portal which include:
 



  • Resource moving: the ability to navigate to a resource group and move resources to another region. The ability to add missing dependencies, customize destination properties, and track the progress of moves are also now available.
     

  • Filter pills: bring further consistency to the filtering experience while also making it WCAG 2.1 compliant and fully accessible


Further details can be found here: Azure portal November 2020 update


 


ARM Template support for Azure File Share Backup


Azure Resource Manager (ARM) provides a powerful way to manage infrastructure through declarative templates. Azure Backup now supports configuring backup for existing Azure file shares via ARM templates.  This enables organizations to backup existing file shares by specifying the vault and backup policy details in a JSON file which is deployable via using the Azure portal, CLI or Powershell.

Further details can be found here:  ARM Template – Backup Azure File Share to Recovery Services Vault


 


Managing Azure Windows Server VMs via On-Premises Windows Admin Center


Currently the Windows Admin Center (WAC) add-in for the Azure Portal is in preview and it might be a while before the feature becomes generally available.  Sonia Cuff and Orin Thomas share steps to spin up a WAC gateway server instance on a local VM, configure Windows Server’s built in Azure Network Adapter as a VPN connection.


 


Details on the steps required to complete this can be found here: Using Windows Admin Center on-premises to manage Azure Windows Server VMs


 


Multiple new features for Azure VPN Gateway


The following new Azure VPN Gateway features have recently been announced as generally available:
 



  • Custom IPsec/IKE policy with DPD timeout: Setting IKE DPD (Dead Peer Detection) timeout allows organizations to adjust the IKE session timeout value based on their connection latency and traffic conditions to minimize unnecessary tunnel disconnect. 
     

  • High availability for RADIUS servers in point-to-site VPN: Organizations can now enable highly available configuration via RADIUS/AD authentication for their point-to-site VPN.
     

  • FQDN support for site-to-site VPN: Organizations without static public IP addresses can now connect to Azure VPN gateways leveraging dynamic DNS services and their Fully Qualified Domain Name (FQDN). Azure VPN gateways will automatically resolve and update VPN targets to establish IPsec/IKE connections.
     

  • APIPA support for BGP speaker: Organizations with legacy VPN routers and Amazon Web Service (AWS) VGW, Google Cloud Platform (GCP) VPN which use Automatic Private IP Addressing (APIPA) addresses as their Border Gateway Protocol (BGP) speaker IP addresses are now supported and can establish BGP sessions with Azure VPN gateways using APIPA (169.254.x.x) addresses.


Community Events



  • Festive Tech Calendar – New content from different communities and people around the globe for the month of December

  • Introduction to Cloud Adoption Framework – Sarah Lean investigates Microsoft’s Cloud Adoption Framework offering and what is available for organizations to take advantage of

  • Patch and Switch – It has been a fortnight, so Rick Claus and Joey Snow are back for another episode.


 


MS Learn Module of the Week


Microsoft_Learn_Banner.png


Implement Windows Server hybrid cloud management, monitoring, and security


Looking to addresses problems related to managing, monitoring, and securing a hybrid environment? This learning path provides insight on how to manage and maintain hybrid Azure and on-premises workloads. 
 


This learning path can be completed here: Windows Server hybrid cloud management, monitoring, and security


 


Let us know in the comments below if there are any news items you would like to see covered in next week show. Az Update streams live every Friday so be sure to catch the next episode and join us in the live chat.

Sap on oracle setup on Azure – Part1

Sap on oracle setup on Azure – Part1

This article is contributed. See the original author and article here.

Overview


This document covers the step by step procedure to set up and configure SAP on Oracle ASM (Oracle Linux 8.2 /Oracle 19c) on Azure . As this setup involves a large number of steps, it is very easy to miss or misconfigure ,that may result in errors/issues ,which could be very cumbersome to resolve. Hence these steps are covered here in detail. Since we are talking about the Oracle ASM install, scope of this document is restricted to SAP DB instance install.


 High Level Process Flow :



  1. Create VMs

  2. Patch OS and pre-install

  3. Create disks

  4. Setup ASM

  5. DB Install with SWPM

  6. Oracle software installation

  7. SBP Oracle DB instance

  8. SBP Oracle Grid

  9. Confirm patching successful + run Oracle Enterprise Manager


Deploy Linux VMs


via Azure portal


  1. Create a Resource Group

  2. Create a Virtual network

  3. Use the Virtual Network create above

  4. Create Virtual Machine 1 for App server . Virtual Machine 2 for ASCS server, Virtual Machine 3 for DB server .Use at least Oracle Linux 8.0 image from azure marketplace image gallery. In this example Oracle Linux 8.2 image is used.


via Azure CLI


     1. Login to Azure


        az login



  1. Create a resource group


         az group create –name oraasmtestrg   –location <location>


3. Create a virtual machinesaz group create


 


App server


az vm create –resource-group oraasmtestrg  –name oraapp1 –image Oracle:Oracle-Linux:ol8_2-gen2:8.2.01 –size Standard_E4s_v3 –admin-username sapadmin –admin-password <password>  –location southeastasia –vnet-name oraasmtestvnet –subnet default


ASCS:


az vm create –resource-group oraasmtestrg  –name oraascs1 –image Oracle:Oracle-Linux:ol8_2-gen2:8.2.01 –size Standard_E4s_v3 –admin-username sapadmin –admin-password <password>  –location southeastasia –vnet-name oraasmtestvnet –subnet default


Database server:


az vm create –resource-group oraasmtestrg –name oradb7 –image Oracle:Oracle-Linux:ol8_2-gen2:8.2.01 –size Standard_E8s_v3 –admin-username sapadmin –admin-password <password> –data-disk-sizes-gb 512 512 512 512 –location southeastasia –os-disk-size-gb 128 –vnet-name oraasmtestvnet –subnet default


Jump server


az vm create –resource-group oradgsap-rg –name oradgjmp-vm –image win2016datacenter–size Standard_E2s_v3 –admin-username sapadmin –admin-password <password> –location < location> –vnet-name oraasmtestvnet –subnet default


It is a good practice to disable the public Ip Addresses of SAP VMs. You can access these VMs from Jump box via private Ip Addresses


 


OS configuration and pre-install


Resize OS disk 

The default provisioned size of OS disk on Linux Vm on azure is 30GB which is not sufficient for the Oracle install. As the OS selected is Oracle Linux 8.2 which has GPT partition in OS disk, follow the steps here https://docs.microsoft.com/en-us/azure/virtual-machines/linux/resize-os-disk-gpt-partition  to resize the OS Disk with GPT partition


Install ASM libraries 

 Refer Oracle ASMLib Downloads for Oracle Linux 8  For more information about installing Oracle ASM libraries.




    • Login as root for install



sudo su –




    •  Update the OS



 sudo yum update




    • Download and install the Oracle Preinstallation RPM:



# yum -y install oracle-database-preinstall-19c


# rm oracle-database-preinstall-19c-1.0-1.el7.x86_64.rpm




    • Install Oracle ASM libraries



yum list | grep oracleasm


 




    • Verify that Oracle ASM is installed:



rpm -qa |grep oracleasm




    • This should result in following output



oracleasm-support-2.1.12-1.el8.x86_64


oracleasmlib-2.0.17-1.el8.x86_64




    • Verify users and groups were created correctly:



id oracle




    • This should result in following output similar to the following:



id=54321(oracle) gid=54321(oinstall) groups=54321(oinstall),54334(asmdba),54322(dba),54323(oper),54324(backupdba),54325(dgdba),54326(kmdba),54330(racdba),54331(sapinst),54332(asmoper),54333(asmadmin)


 


Setup Oracle ASM


  • Create a folder for user oracle and change the owner:


mkdir /oracle


chown oracle:oinstall /oracle



  • Setting up the Oracle ASM library driver involves defining the default user (oracle) and default group (oinstall) as well as configuring the drive to start on boot (choose y) and to scan for disks on boot (choose y). You need to answer the prompts from the following command:


# oracleasm configure -i



  • The output of this command should look similar to the following, with prompts to be answered:oracleasm.jpg


 


 


 



  • View the disk configuration:


cat /proc/partitions


 



  • Enter the following command to load the oracleasm kernel module


# oracleasm init


 



  • Verify the Oracle ASM status:


  • oracleasm status



  • Format disk /dev/sda, /dev/sdb, /dev/sdc, /dev/sdd  by running the following commands      


   fdisk /dev/sda


   fdisk /dev/sdb


   fdisk /dev/sdc


   fdisk /dev/sdd



  • Answer the prompts from the above fdisk commands with:


n for new partition


p for primary partition


1 to select the first partition


press enter for the default first cylinder


press enter for the default last cylinder


press w to write the changes to the partition table


 



  • Create Oracle ASM disks:


oracleasm createdisk DATA_DISK_01 /dev/sda1


oracleasm createdisk DATA_DISK_02 /dev/sdb1


oracleasm createdisk ARCH_DISK_01 /dev/sdc1


oracleasm createdisk RECO_DISK_01 /dev/sdd1


 



  • List Oracle ASM disks:


oracleasm listdisks



  • Change the passwords for the root and oracle users:


passwd oracle


passwd root



  • Change the directory permissions:


chmod -R 775 /oracle


chown grid:oinstall /oracle


chown oracle:oinstall /dev/sda1


chown oracle:oinstall /dev/sdb1


chown oracle:oinstall /dev/sdc1


chown oracle:oinstall /dev/sdd1


chmod 600 /dev/sda1


chmod 600 /dev/sdb1


chmod 600 /dev/sdc1


chmod 600 /dev/sdf1


 


DB Instance Install(SWPM)


Before we begin the DB instance install , mount the sapmnt (NFS share) directory which must have been created during the ASCS instance setup.


 



  • Install NFS libraries
               sudo yum -y install nfs-utils



  • Create sapmnt directory and mount remote NFS file system
                mkdir /sapmnt
                mount <<ip of NFS server>>:/sapmnt  /sapmnt

  • Every host running the SAP installer requires the presence of the C shell command language interpreter as documented a. here. Verify the existence of the /bin/csh script file. When not existing install using following command:
                yum install csh

  • Verify that the /bin/csh script file exists using the following command:
                ls -al /bin/csh

  • Start the SAP SWPM installer and select the appropriate options:
    Software Provisioning Manager 1.0 SP 29 –> SAP NetWeaver 7.5 –> Oracle à Application Server ABAP–> Distributed System –> Database Instance

  • Specify the profile directory


              asm-profile.jpg                   




  •  Specify the DBSID and select the ‘Single Instance on Oracle ASM 



  •  


              asm-dbsid.jpg


 



  • You may see this error – “Supported Linux distributions for SAP Products…” .This can be safely ignoredasm-OSerror1.jpg

  • Select 19 as Oracle server and client versions.


            asm-oravers.jpg



  • Select ‘Remove database and recreate’ 


              asm-reuseDB.jpg


               asm-OraMTDB.jpg



  • Enter ORACLE_HOME and ORACLE_SID  for GRID and select “Oracle Grid Software not installed”


                  asm-oraHome.jpg



  • Select the Number of parallel jobs based on the CPU cores. The default number is 3               


                     asm-DBImportJobs.jpg



  •  SWPM stops for the installation of Oracle software


                    asm-pauseInstall.jpg


 


 


 Oracle Grid Install 



  • Download the following from SAP portal as documented in SAP Note 509314



An empty folder /oracle/stage/19 is created by SWPM installer. We downloaded the grid and oracle rdbms installer into this folder



  • Run the grid installer setup .Login as oracle and unzip the grid installer:
          cd /oracle/stage/19/grid_home
          unzip -q linuxx64_12201_grid_home.zip

  • Run the grid installer setup .This would launch Oracle Grid Infrastructure Setup Wizard
          ./gridSetup.shCurrently we have a known issue with Oracle 8.2 install.The Oracle Installer fails with error INS-08101:

  • Currently we have a known issue with Oracle 8.2 install.The Oracle Installer fails with error INS-08101:


                     asm-oraOSerror.jpg


The work around to resolve this is:
⦁ Set the OS parameter in your terminal to a previous version and re-start the Oracle Universal Installer.
export CV_ASSUME_DISTID=OEL7.8



  • Enter the Disk group name for DATA, select the disk path of Data disks and set the discovery path (e.g. ‘dev/oracleasm/disks/):
           asm-createDiskgrp.jpg

  • Specify the password for ASM user accounts (SYS and SNMP)


                 asm-oraPass.jpg


 


                 asm-EMcloud.jpg



  • Select name of operating system group,which you want to use for system authentication to Oracle ASM


                     asm-OSgrp.jpg



  • Select the path for Oracle base


                    asm-OraBasePath.jpg



  • Select Oracle inventory directory path


                     asm-OraInvPath.jpg 



  • If you choose to run the configuration scripts automatically , specify the ‘root’ user credentials


                    asm-rootScript.jpg



  • Verify the settings and click Next to finish


                  asm-gridFinish.jpg 


 


                  asm-gridFinish1.jpg


We have just configured/created  data group named ‘DATA’  .. To configure other disk groups (ARCH and RECO) , we use ASM Configuration Assistant tool.



  • To start ASMCA, enter asmca at a command prompt inside the Oracle Grid Infrastructure home.
           cd $ORACLE_HOME/bin
             ./asmca


              asmca_start.jpg


              asmca_createDG.jpg
              asmca_attachDisk.jpg


 


Oracle DB Installation:


 


       OraDB_1.jpg


 


      OraDB_2.jpg


 


     OraDB_3.jpg


 


     OraDB_4.jpg


 


    OraDB_5.jpg


 


    OraDB_6.jpg


 


   OraDB_7.jpg


 


   OraDB_8.jpg


 


   OraDB_9.jpg


 


   OraDB_10.jpg


 


   OraDB_11.jpg


 


 


   OraDB_12.jpg


 


 


   OraDB_13.jpg


 


 


   OraDB_14.jpg


 


 


   OraDB_15.jpg


 


 


   OraDB_16.jpg


 


 


 


SAP Bundle Patches


Download following SBP patches(19.8) for Oracle RDBMS and GRID, and follow the instructions from respective readme files :


Oracle Database SAP Bundle Patch



  •  Following files were downloaded to the database host for Oracle DB SAP Bundle Patch:


SAP19P_2008-70004508.ZIP (this SBP)


GIRU19P_2008-70004508.ZIP (DBRU 19.8.0.0.200714)


OPATCH19P_2008-70004508.ZIP (OPatch 12.2.0.1.21)


 


             SBP1.jpg



  •     Follow the instructions in ‘readme’ file (README19P_2008-70004508.HTM ) and install the      SAP Bundle Patch. Main command to install this Patch is:


          env ORACLE_HOME=$IHRDBMS $IHRDBMS/MOPatch/mopatch.sh -v -s SAP19P_2008- 70004508.ZIP


 


        Oracle Database SAP Bundle Patch for Grid Infrastructure


Downloaded the following files for  SAP Bundle Patch for Grid Infrastructure:


SGR19P_2008-70004550.ZIP (this SBP)


GIRU19P_2008-70004550.ZIP (GIRU 19.8.0.0.200714)


OPATCH19P_2008-70004550.ZIP (OPatch 12.2.0.1.21)


 


                       SBP2.jpg


Follow the instructions in the ‘readme’ file(README19P_2008-70004550.HTM) and Install the patches of the SAP Bundle Patch into the grid home. Main command to install this Patch is:


                   env ORACLE_HOME=$OHGRID $OHGRID/MOPatch/mopatch.sh -v -s SGR19P_2008-70004550.ZIP


 


 


Continue/complete the DB Instance install (SWPM)



  •  SWPM was stopped/paused for the installation of Oracle software . Now that Oracle software(RDBMS, Grid ) and SAP Bundle Patches are installed, we can click ‘Next’ to continue with the installation.


       SAP_Cont1.jpg



  • This completes the Installation of Oracle DB instance with ASM.


         SAP_Cont2.jpg


 



  • You may verify by running the ASM instance .


          ora_ASM_verify.jpg


 



  • You can verify the setup by running the Oracle Enterprise manager


              https://mydbhost.example.com:5500/em/


for example: 


https://oradb.internal.cloudapp.net:5500/em/


When prompted for your username and password, log in as a user with DBA privilege (such as SYS or SYSTEM)


 


 


References (SAP Notes and relevant documents/papers)





























































Note number Title
1928533 SAP Applications on Azure: Supported products and Azure VM types
2015553 SAP on Microsoft Azure: Support prerequisites
1999351 Troubleshooting enhanced Azure monitoring for SAP
2178632 Key monitoring metrics for SAP on Microsoft Azure
2191498 SAP on Linux with Azure: Enhanced monitoring
2039619 SAP applications on Microsoft Azure using the Oracle database: Supported products and versions
2243692 Linux on Microsoft Azure (IaaS) VM: SAP license issues
1550133 Using Oracle Automatic Storage Management (ASM) with SAP NetWeaver based Products
1597355 Swap-space recommendation for Linux
1554661 Configuration of environment for ‘oracle’ user
2799920 Patches for 19c: Database
2660017 Oracle Database Software Installation on Unix
1915323 OS User Concept for SAP NetWeaver for 12c and higher

 


 



  • SAP Community WIKI:



How to cancel Azure SQL Database Import or Export operation

How to cancel Azure SQL Database Import or Export operation

This article is contributed. See the original author and article here.

Purpose


This article help you cancel ongoing import or export operation on Azure SQL Database. 


 


Step by Step guidance: 



  1. Open new PowerShell window, you may use cloud shell on Azure portal as well by clicking the cloud shell button

  2. Yochanan_MSFT_1-1606432077431.png

  3. Copy and paste the following PowerShell code and execute it – it will create a function for the current PowerShell session

  4. function Cancel-AzSQLImportExportOperation
    {
        param
        (
            [parameter(Mandatory=$true)][string]$ResourceGroupName
            ,[parameter(Mandatory=$true)][string]$ServerName
            ,[parameter(Mandatory=$true)][string]$DatabaseName
        )
    
        $Operation = Get-AzSqlDatabaseActivity -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName $DatabaseName | Where-Object {($_.Operation -eq "ExportDatabase" -or $_.Operation -eq "ImportDatabase") -and $_.State -eq "InProgress"}
        
        if(-not [string]::IsNullOrEmpty($Operation))
        {
            do
            {
                Write-Host -ForegroundColor Cyan ("Operation " + $Operation.Operation + " with OperationID: " + $Operation.OperationId + " is now " + $Operation.State)
                $UserInput = Read-Host -Prompt "Should I cancel this operation? (Y/N)"
            } while($UserInput -ne "Y" -and $UserInput -ne "N")
    
            if($UserInput -eq "Y")
            { 
                "Canceling operation"
                Stop-AzSqlDatabaseActivity -ResourceGroupName $ResourceGroupName -ServerName $ServerName -DatabaseName $DatabaseName -OperationId $Operation.OperationId
            }
            else 
            {"Exiting without cenceling the operation"}
            
        }
        else
        {
            "No import or export operation is now running"
        }
    }


  5. use the function 

    Cancel-AzSQLImportExportOperation​

    to cancel an Import or Export operation


  6. you need to provide the Resource Group name, Server name and Database name where the operation is currently running. 


 


I hope you find it useful. 


Thank you Roshna Nazir for pointing out this functionality.


if you have any feedback please do not hesitate to share it with me at yocr@microsoft.com


 


Yochanan.


 


 


 

Are your IaaS DC's Secured in Azure ?

Are your IaaS DC's Secured in Azure ?

This article is contributed. See the original author and article here.

Hi Everyone,


 


Zoheb here again with my colleague Tim Beasley. Today, we will be sharing some best practices to help ensure that your VMs (virtual machines) (including Domain Controllers) are secure in your Azure/Cloud environment.


 


I would like to start this blog with an African Proverb If you want to go fast, go alone. If you want to go far go together.


 


This proverb is one of the principals we refer to internally at Microsoft (#OneMicrosoft). It helps us utilize the synergy to build / leverage great ideas from other Microsoft employees across the globe.


 


This proverb sums it up perfectly of what occurred during the creation of this blog post. There were multiple contributors (Tristan Kington, Akhlesh Sharma, Pierre Audonnet and Shobhit Garg) who also helped provide details and additional information in hopes of benefiting our customers.


 


The Initial Problem I found myself facing – I forgot my Administrator Password!


While working in my lab environment in Azure, I sometimes forget what the Administrator password is (This rarely happens. Am I right? :p). Considering this is an important environment I needed to regain access to, I started thinking about different ways of retrieving my password.


Initially, I tried guessing what password was using a few random ones. However, this did not work (I have Azure AD Password Protection configured in my lab to help protect against known passwords :smiling_face_with_smiling_eyes:). I then tried the VM Password Reset option, but that only works for members of the local Administrators group.


Suddenly, I had an epiphany! I remembered the Extensions setting that is available for VMs running in Azure where you can execute scripts running under the System Context.


To achieve this, I located and selected the Azure Virtual Machine I was targeting and clicked on Extensions which is located under Settings. Here is where I will upload and execute a Custom Script Extension as shown below:


 


 

f1.png


 Figure 1. Click on Extensions.


 

f2.png


 Figure 2. Select Custom Script Extension.


 


 

f3.png


 Figure 3. Browse for the custom PowerShell script you wish to upload.


 

f4.png


 Figure 4. Select Upload to upload your custom PowerShell script.


 


As you can see below, I uploaded the testreset.ps1 PowerShell script (to be added as a custom script extension) and ran it on the virtual machine in my lab environment. The PowerShell script uses the native Command Prompt utility Net.exe. In this example, we used Net User to reset the password for an Administrator account named zdcadm using DontKeepe@syPassw0rd$ as the password.


Net User zdcadm DontKeepe@syPassw0rd$


 


f5.png


 Figure 5. Custom PowerShell script was uploaded.


 


After the extension was applied and executed against the VM, it successfully reset the password for my Administrator account (zdcadm), which allowed me to regain access to that VM.

We managed to achieve this because Azure VM Agent is installed by default on any Windows VM deployed from an Azure Marketplace image. When you deploy an Azure Marketplace image from the portal, PowerShell, Command Line Interface, or an Azure Resource Manager template, the Azure VM Agent is also installed.


 


Though I was happy that this allowed me to log back into the VM, it also started to concern me. So, I started thinking about how this could potentially affect our customers and whether they are protecting their environment from such risks where Privilege escalation can be gained by Azure operators to domain admin (and by extension, domain admin on-prem).


 


We found similar concerns that were raised / discussed for our traditional infrastructure (Hypervisors) where we provide broad guidance on how to secure them. You can learn more about this by reading the Virtualizing Domain Controllers using Hyper-V Microsoft article.


 


Why should you be concerned?


You as an organization who have DC’s in Azure or cloud you should check who has access to them in Azure & is the access to Subscription controlled well.


Do you have any Azure Operators who could do Privilege Escalation to become a Domain Admin?


Remember when you let someone else administer a lower layer than your own, you are implicitly trusting that person equivalently to yourself.


The 10 Immutable Laws of Security are applicable everywhere.


Increasingly we see permissions being mis managed in many organization and Identity team is not always managing subscriptions, this can lead to some loose permissions on your resources if left unmonitored/checked.


 


How can you check who has access to your Domain Controllers or Azure Resources ?


 


There are many ways you could see who has access to resources, I am listing one of the easier ways where you can get full information from a single dashboard.


Use the Azure Continuous Cloud Optimization dashboard, this can show the Azure RBAC (role-based access control) permissions from all the subscriptions a given Azure account has access to. You will be able to identify the roles applied to all Azure resources and if the subscriptions have custom roles. You can filter the information by:



  • Tenant

  • Subscription

  • Object type

  • User


f6.png


 


The Solution to this little dilemma:


This made us think about the “Level of Protection” we should recommend to our customers that have important VMs (e.g. Domain Controllers) running in Azure. After several internal discussions along with reviewing publicly available Microsoft documentation, we decided that the following recommendations below will add an extra layer of protection to help secure your Azure IaaS VMs / environment (Not all, but heavy hitters)


 



  1. Force MFA (Azure Multi-Factor Authentication) for Admins with access to Domain Controllers (no matter where they are at – on-premises and cloud) whenever they are accessing Azure Portal.

    1. This will ensure that access to Azure Portal has at least two factor Authentication.

    2. Use this policy for all the users who have access to Azure Subscription where DC’s are hosted.




  2. Use Conditional access policies to define Admins location, Trusted machines to access Azure Portal for Domain Controller Subscriptions.

    1. You can further control the access to the Azure Portal/Subscription by using Conditional Access.

    2. You could define Trusted location, Trusted devices and many such parameters.

    3. This will help reduce the access to Domain Controllers.




  3. Limit Highly privileged users and use RBAC permissions to allow access to only specific people to DC’s.

    1. This is probably the most crucial point of all, you need to review who has permission to do such an activity and if they really need this.

    2. You could review this using CCO dashboard.

    3. Alternatively you could navigate to Azure Portal and look for “Access Control

    4. Check for important Role Assignments like “Contributors, Owners etc.

    5. Review these users on a regular basis




  4. Where possible, use a Different Subscription for Domain Controllers or Tier 0 systems.

    1. Effective subscription design helps organizations establish a structure to organize and manage assets in Azure during cloud adoption.

    2. When possible use a dedicated subscription for all your Tier 0 assets




  5. PIM (Azure Active Directory Privileged Identity Management) for elevation to Domain Controller VM Access and follow just enough Administration (Least Privilege principal)

    1. Setup appropriate permissions to the “Azure Resource” through PIM.

    2. Define Eligible Assignments

    3. This will ensure that only users who are eligible get access to Domain Controllers in Azure

    4. Follow Just Enough Administration and least privilege model




  6. Use Azure ADDS (Active Directory Domain Services) when possible.

    1. When you create an Azure AD DS managed domain, you define a unique namespace.

    2. Two Windows Server domain controllers (DCs) are then deployed into your selected Azure region. This deployment of DCs is known as a replica set.

    3. You do not need to manage, configure, or update these DCs. The Azure platform handles the DCs as part of the managed domain, including backups.

    4. Since this is managed there is reduced risk also for this




  7. Using PAW(Privileged Access Workstations) to access Azure portal

    1. Secured, isolated workstations are critically important for the security of sensitive roles like administrators, developers, and critical service operators.

    2. Use highly secured user workstations and/or Azure Bastion for administrative tasks for Azure.

    3. The secured workstations can be centrally managed to enforce secured configuration, including strong authentication, software and hardware baselines, and restricted logical and network access.

    4. Using conditional access allow only approved machines to have access to Azure portal.

    5. Alternatively manage these machines through hardened GPO’s & Intune




 


Hope this helps,


Tim & Zoheb