Azure Local and Landing Zones: How to Build Hybrid Cloud the Right Way with Christoffer Klarskov Jakobsen [MVP]

1
00:00:00,000 --> 00:00:03,720
Welcome everybody back to the M665 podcast.

2
00:00:03,720 --> 00:00:06,400
Today we are tackling a question that becomes

3
00:00:06,400 --> 00:00:11,760
incredible, important as organization,

4
00:00:11,760 --> 00:00:14,840
when they are modernized, when you modernize your infrastructure.

5
00:00:14,840 --> 00:00:18,840
What happens when your cloud strategy can't live internally

6
00:00:18,840 --> 00:00:20,360
in the public cloud?

7
00:00:20,360 --> 00:00:23,440
Azure has evolved, far beyond virtual machines,

8
00:00:23,440 --> 00:00:25,560
running in Microsoft data centers.

9
00:00:25,560 --> 00:00:28,440
Organizations are adopting cloud from services,

10
00:00:28,440 --> 00:00:32,240
infrastructure, the code automated, deployment, pipelines,

11
00:00:32,240 --> 00:00:36,040
Azure landing zones, while at the same time some workloads

12
00:00:36,040 --> 00:00:40,360
still need to remain physical, close to factories,

13
00:00:40,360 --> 00:00:44,920
offers regulated environments, or existing infrastructure.

14
00:00:44,920 --> 00:00:48,400
That's where Azure Local become particular interesting.

15
00:00:48,400 --> 00:00:51,000
My guest today is Christoher Clarkson, Yard Copson,

16
00:00:51,000 --> 00:00:55,600
Microsoft MVP Azure Specialist at Fellow Mind in Denmark,

17
00:00:55,600 --> 00:00:59,560
Christoher designs and implements Azure Solutions work,

18
00:00:59,560 --> 00:01:02,360
especially with Azure Local, Azure landing zones,

19
00:01:02,360 --> 00:01:04,920
Azure DevOps, PowerShell and Biceps,

20
00:01:04,920 --> 00:01:07,240
and has a strong focus on modern,

21
00:01:07,240 --> 00:01:10,960
rising security, automated, and infrastructure as a code.

22
00:01:10,960 --> 00:01:15,400
Today we are deep dive into how Azure Local fits

23
00:01:15,400 --> 00:01:17,520
into the Azure landing zone strategy,

24
00:01:17,520 --> 00:01:20,880
how organization can merge cloud and local infrastructure

25
00:01:20,880 --> 00:01:24,400
constantly, and while Christoher believes many companies

26
00:01:24,400 --> 00:01:27,880
are missing some of the possible Azure Local providers.

27
00:01:27,880 --> 00:01:31,680
Christoher, welcome to the MC65 podcast.

28
00:01:31,680 --> 00:01:32,720
Thank you.

29
00:01:32,720 --> 00:01:34,080
Thank you so much.

30
00:01:34,080 --> 00:01:38,200
Yeah. Before we get deep into Azure Local,

31
00:01:38,200 --> 00:01:43,160
how did your own journey into Microsoft technology began?

32
00:01:43,160 --> 00:01:47,760
Yeah, so I have been working with Microsoft Technology Stack

33
00:01:47,760 --> 00:01:50,960
for many years, I think, 15 years or so,

34
00:01:50,960 --> 00:01:55,440
started all the way back when I was a student,

35
00:01:55,440 --> 00:01:58,560
and I got to my first company working there,

36
00:01:58,560 --> 00:02:02,160
so part-time in school and part-time at this company,

37
00:02:02,160 --> 00:02:04,400
that's how that education worked.

38
00:02:04,400 --> 00:02:08,000
And that was all Microsoft, so back in the day,

39
00:02:08,000 --> 00:02:12,160
that was a lot of Windows Server was working on that.

40
00:02:12,160 --> 00:02:15,680
And then I've been working a lot of years,

41
00:02:15,680 --> 00:02:17,840
and then they used hosting provider,

42
00:02:17,840 --> 00:02:19,320
did that for around eight years,

43
00:02:19,320 --> 00:02:24,200
that was also based on Microsoft Windows servers.

44
00:02:24,200 --> 00:02:26,920
And then for, yeah, I think four years now,

45
00:02:26,920 --> 00:02:30,280
when we're going to implement, that is a company

46
00:02:30,280 --> 00:02:32,120
that focused entirely on the cloud,

47
00:02:32,120 --> 00:02:37,080
so that's naturally we are going to be focused on Azure,

48
00:02:37,080 --> 00:02:39,320
since we're going to implement this Microsoft partner.

49
00:02:39,320 --> 00:02:45,080
So yeah, I've been working with Microsoft for a lot of years,

50
00:02:45,080 --> 00:02:45,720
actually,

51
00:02:45,720 --> 00:02:49,720
maybe on Windows servers.

52
00:02:49,720 --> 00:02:52,760
But then recently, just more about the cloud also,

53
00:02:52,760 --> 00:02:55,560
and hybrid cloud, as you can call it.

54
00:02:55,560 --> 00:02:59,480
Yeah, I look a little bit when you do add photo,

55
00:02:59,480 --> 00:03:03,080
mind, you are involved in both an Azure solution

56
00:03:03,080 --> 00:03:06,040
and actually also implemented them.

57
00:03:06,040 --> 00:03:09,400
How important is this for architect to remain hands-on?

58
00:03:09,400 --> 00:03:13,880
I think if you ask some of my colleagues,

59
00:03:13,880 --> 00:03:16,440
maybe not that much thought, but for me,

60
00:03:16,440 --> 00:03:19,560
personally, I always want to be hands-on,

61
00:03:19,560 --> 00:03:22,360
because I feel like I cannot design solutions

62
00:03:22,360 --> 00:03:25,800
and write the whole design dark

63
00:03:25,800 --> 00:03:27,880
and write the implementation phases

64
00:03:27,880 --> 00:03:30,120
if I do not know how to implement it,

65
00:03:30,120 --> 00:03:35,320
because I think if anyone that has been implementing stuff

66
00:03:35,320 --> 00:03:39,400
knows that, you know, Sunday night at 2 a.m,

67
00:03:39,400 --> 00:03:43,160
shit stops working and what we need to do

68
00:03:43,160 --> 00:03:46,360
to fix it, that is where you get the hands-on experience

69
00:03:46,360 --> 00:03:49,480
that cannot be all written in the design phases,

70
00:03:49,480 --> 00:03:52,200
because sometimes you just, some,

71
00:03:52,200 --> 00:03:54,280
yeah, problem emerges that you did not,

72
00:03:54,280 --> 00:03:55,320
was aware of.

73
00:03:55,320 --> 00:03:59,160
So I feel like hands-on is very important for me,

74
00:03:59,160 --> 00:04:03,320
just to stay current with how do we actually deploy

75
00:04:03,320 --> 00:04:07,800
and migrate and modernize our customers'

76
00:04:07,800 --> 00:04:10,120
application and their workloads in general.

77
00:04:11,640 --> 00:04:15,880
Yeah, you have described modernization

78
00:04:15,880 --> 00:04:19,320
from the traditional VM-based infrastructure

79
00:04:19,320 --> 00:04:20,760
to about past and zas,

80
00:04:20,760 --> 00:04:23,640
as a particular interest.

81
00:04:23,640 --> 00:04:27,320
Why are so many organizations still heavily

82
00:04:27,320 --> 00:04:29,000
depend on virtual machines?

83
00:04:29,000 --> 00:04:36,600
Yeah, I think we see it in both in our Danish customers,

84
00:04:36,600 --> 00:04:39,880
but also in, we have a lot of international customers as well,

85
00:04:39,880 --> 00:04:43,160
and I think that there are two main reasons,

86
00:04:43,160 --> 00:04:46,200
at least from my perspective, one of the reasons

87
00:04:46,200 --> 00:04:50,600
that many of the customers are running some applications

88
00:04:50,600 --> 00:04:53,480
that is very old, so we can call them legacy applications,

89
00:04:53,480 --> 00:04:57,240
you know, 20, 20 years old applications that

90
00:04:57,240 --> 00:04:59,560
must run on a virtual machine, cannot run,

91
00:04:59,560 --> 00:05:03,320
and modern pass-based SQL Server.

92
00:05:03,320 --> 00:05:08,520
The other part is actually the IT department

93
00:05:08,520 --> 00:05:12,280
that those companies, if they feel confident in Windows Server,

94
00:05:12,280 --> 00:05:15,640
they feel confident that they can install applications

95
00:05:15,640 --> 00:05:19,960
on a Windows Server, sometimes they are actually also hesitant

96
00:05:19,960 --> 00:05:23,640
to get into the past area,

97
00:05:23,640 --> 00:05:27,240
and that is also, I don't know if you can call this,

98
00:05:27,240 --> 00:05:31,720
stalling, but it's dragging the modernization to pass also

99
00:05:31,720 --> 00:05:34,920
because we almost always find an application

100
00:05:34,920 --> 00:05:37,240
that could run on a pass,

101
00:05:37,240 --> 00:05:41,240
but that just didn't because this ECF for the IT department

102
00:05:41,240 --> 00:05:44,680
to install it on a Windows Server.

103
00:05:44,680 --> 00:05:49,960
Awesome, interesting, but let's establish the foundation.

104
00:05:49,960 --> 00:05:52,680
What does it look?

105
00:05:52,680 --> 00:05:57,000
Yeah, what is actually looking?

106
00:05:57,000 --> 00:06:00,200
I think some would say it's just Hyper-V

107
00:06:00,200 --> 00:06:04,520
and some are stores best-direct, it's just old technology,

108
00:06:04,520 --> 00:06:09,000
but for me, really there is a lot more to it, so of course,

109
00:06:09,000 --> 00:06:13,560
down at the core, we have some functionalities from Windows Server,

110
00:06:13,560 --> 00:06:16,600
we have the Hyper-V, we have the storage-based direct

111
00:06:16,600 --> 00:06:20,280
for when we're doing hyper-convicts stores,

112
00:06:20,280 --> 00:06:25,480
we can, as of recently, we can also use external storage,

113
00:06:25,480 --> 00:06:29,240
same-based storage, so that doesn't call components

114
00:06:29,240 --> 00:06:33,880
in oscillators that are very similar to a normal Windows Server

115
00:06:33,880 --> 00:06:37,720
technology you can deploy in one virtual machine.

116
00:06:37,720 --> 00:06:41,480
But then they also have that whole,

117
00:06:41,480 --> 00:06:46,040
Microsoft has this component in it called Microsoft Online Cloud,

118
00:06:46,040 --> 00:06:50,040
and on that one's something called an Azure Local in Bridge,

119
00:06:50,040 --> 00:06:54,280
and so that is some key components that is running locally,

120
00:06:54,280 --> 00:06:58,760
this Azure Local Environment, but has the connection to Azure,

121
00:06:58,760 --> 00:07:01,720
so we can use the management plan in Azure,

122
00:07:01,720 --> 00:07:05,880
we can use security and governance features from Azure,

123
00:07:05,880 --> 00:07:08,760
and it comes directly down to the cluster.

124
00:07:08,760 --> 00:07:14,120
So for me, the main difference between Azure Local and a normal

125
00:07:14,120 --> 00:07:18,760
Windows Server environment is that we get so much of the Azure experience

126
00:07:18,760 --> 00:07:23,480
out of the box, we do not have to do a whole lot of manual configuration

127
00:07:23,480 --> 00:07:27,480
if we deploy our Azure Local MSIS on our servers,

128
00:07:27,480 --> 00:07:30,280
connect it to Azure and configure the cluster.

129
00:07:30,280 --> 00:07:34,920
We are actually good to go, and we can run a lot of resources

130
00:07:34,920 --> 00:07:38,920
on our local environment, keeping our data locally,

131
00:07:38,920 --> 00:07:43,720
complying with whatever regulations need it,

132
00:07:43,720 --> 00:07:47,400
and have that sovereignty that some customers are asking for.

133
00:07:47,400 --> 00:07:58,760
Is it correct to think of Azure Local as simply Azure

134
00:07:58,760 --> 00:08:02,040
in your data center or is that too simple?

135
00:08:02,040 --> 00:08:08,920
In some ways, yes, of course, if you look at how many different

136
00:08:08,920 --> 00:08:14,120
products or services you can run in Azure Cloud,

137
00:08:14,120 --> 00:08:18,360
that number is huge compared to what you can actually run on Azure Local,

138
00:08:18,360 --> 00:08:21,960
because you can run virtual machines on Azure Local,

139
00:08:21,960 --> 00:08:25,000
you can run Kubernetes cluster on Azure Local,

140
00:08:25,960 --> 00:08:29,560
and especially on top of the Kubernetes, of course,

141
00:08:29,560 --> 00:08:31,880
there you can run all sorts of different services,

142
00:08:31,880 --> 00:08:36,360
one services that is actually able to deploy

143
00:08:36,360 --> 00:08:41,640
from your support on Azure Local is a SQL Managed Instance.

144
00:08:41,640 --> 00:08:44,600
You have to deploy the Kubernetes cluster,

145
00:08:44,600 --> 00:08:47,400
you have to deploy something called an Arc Data Controller,

146
00:08:47,400 --> 00:08:50,200
but once you have those components on your cluster,

147
00:08:50,200 --> 00:08:54,280
on Azure Local cluster, you can actually deploy in a SQL Managed Instance,

148
00:08:54,280 --> 00:08:59,400
and you get the same look and feel as if you are deploying that service in Azure.

149
00:08:59,400 --> 00:09:03,320
And I do believe that more of these past services

150
00:09:03,320 --> 00:09:05,480
will also come in the future.

151
00:09:05,480 --> 00:09:12,120
One other area that's also very nice and have been there for quite some time now is the

152
00:09:12,120 --> 00:09:15,960
possibility to use Azure Virtual Desktop on Azure Local.

153
00:09:15,960 --> 00:09:19,080
And I have built some of those solutions on Azure Local,

154
00:09:19,080 --> 00:09:22,120
and we use a lot of the components in Azure,

155
00:09:22,120 --> 00:09:25,560
so we actually built our images in Azure.

156
00:09:25,560 --> 00:09:27,720
We have the whole orchestration in Azure,

157
00:09:27,720 --> 00:09:33,480
but we just deploy the session host to the Azure Local cluster instead of the Azure Cloud,

158
00:09:33,480 --> 00:09:35,640
but everything else is actually the same.

159
00:09:35,640 --> 00:09:37,720
So I think that's a huge reinforcement.

160
00:09:37,720 --> 00:09:42,280
I know that as a AVD or Azure Azure Desktop can now be deployed

161
00:09:42,280 --> 00:09:44,280
on the ARGA enabled environments,

162
00:09:44,280 --> 00:09:46,440
so we don't have to use Azure Local.

163
00:09:46,440 --> 00:09:48,760
But the first quite some time that was the case,

164
00:09:48,760 --> 00:09:52,280
you could only want AVD on Azure for Azure Local.

165
00:09:52,280 --> 00:10:03,720
And what are the main workflows or scenarios where Azure Local makes sense?

166
00:10:03,720 --> 00:10:12,280
And if we see a lot of ask for companies wanting to keep that data locally,

167
00:10:14,200 --> 00:10:21,960
and then we have recently got Azure Public Cloud data centers in one part of Denmark.

168
00:10:21,960 --> 00:10:24,520
So some customers may not need that anymore,

169
00:10:24,520 --> 00:10:28,520
but we do have some customers that want the days that locally at their site.

170
00:10:28,520 --> 00:10:34,520
We also have customers that need that one millisecond latency on their network.

171
00:10:34,520 --> 00:10:38,680
They want our need to have that application wanting locally,

172
00:10:38,680 --> 00:10:42,280
but still want all the governance and security features from Azure.

173
00:10:43,320 --> 00:10:51,240
I think on the other hand, we are starting to see customers asking for Azure Local to run AI models.

174
00:10:51,240 --> 00:10:56,600
So you can actually at this point now you can run Azure Foundry or

175
00:10:56,600 --> 00:10:57,960
Foundry Local as it called.

176
00:10:57,960 --> 00:10:59,560
You can run that on Azure Local.

177
00:10:59,560 --> 00:11:05,240
Nothing, that is something we are going to be seeing a lot more asked for in the future

178
00:11:05,240 --> 00:11:11,960
that customers with strict regulations that must keep their data and the AI

179
00:11:11,960 --> 00:11:13,240
solutions locally.

180
00:11:13,240 --> 00:11:20,920
They are going to be spending money on Azure Local hardware because it is actually very easy,

181
00:11:20,920 --> 00:11:27,160
that way to get access to the models and integrate with those on that solution.

182
00:11:27,160 --> 00:11:32,680
And how does it work?

183
00:11:32,680 --> 00:11:40,600
Is it, I don't know, I buy Azure Local like I don't know Windows CD and install it.

184
00:11:40,600 --> 00:11:44,760
How is pricing working?

185
00:11:44,760 --> 00:11:47,240
Yeah, good ask.

186
00:11:47,240 --> 00:11:53,800
Of course you have to buy the hardware unless you can find the local provider that will

187
00:11:53,800 --> 00:11:59,640
list the hardware or in other ways do some posting of the hardware for you, but yeah, of course,

188
00:11:59,640 --> 00:12:05,800
we find the hardware, the Azure Local software is installed on all the nodes and you connect that

189
00:12:06,600 --> 00:12:11,640
because you are deploying the Azure Local cluster into a subscription and Azure, that enables the

190
00:12:11,640 --> 00:12:19,080
billing and is built for physical core and there are some buildings for the virtual machines running

191
00:12:19,080 --> 00:12:20,520
on top depending how you do it.

192
00:12:20,520 --> 00:12:25,960
But you can also use your own, so if you have Windows Server Data Sender licenses with software,

193
00:12:25,960 --> 00:12:32,200
Azure and Zanabel, you can use those and use the hybrid benefit feature in Azure to keep the

194
00:12:32,200 --> 00:12:38,520
cost where we go. There is something about, I've seen some talk about if you're going to be

195
00:12:38,520 --> 00:12:45,400
using the external send for storage. There are some billing requirements there that customers need

196
00:12:45,400 --> 00:12:52,440
to look into because that will cost some additional money to use that. But yeah, that's the

197
00:12:52,440 --> 00:12:59,880
billing. It is mainly built by subscription in Azure.

198
00:12:59,880 --> 00:13:07,720
So, when we think a little bit about, I say we are living in the every thing is moving to the cloud

199
00:13:07,720 --> 00:13:19,560
times. Where does Azure Local sit between traditional on-prem infrastructure and Azure Public Cloud?

200
00:13:19,560 --> 00:13:31,720
Yeah, I think it is mainly around the customers that can see the business case in running

201
00:13:31,720 --> 00:13:37,960
at local or have the straight calculations that they need to keep at local. But I know and acknowledge

202
00:13:37,960 --> 00:13:44,200
that a few years back when hardware didn't cost as much as now, you could purchase the hardware

203
00:13:44,200 --> 00:13:50,840
and you could run Azure Local. If you kept that hardware for extended amount of time, let's say

204
00:13:50,840 --> 00:13:58,760
five or eight years, there could be a business case in that instead of running the virtual machines

205
00:13:58,760 --> 00:14:04,040
or what workload you had to run in Azure. In Azure, you can do a lot of things with reservations

206
00:14:04,040 --> 00:14:09,480
and cost, saving, and that's kind of stuff. But anyway, I feel like at the moment,

207
00:14:09,480 --> 00:14:15,240
hardware is very expensive and I see some customers are hesitating to buy the hardware.

208
00:14:15,240 --> 00:14:20,120
I do expect that at some point the hardware will get cheaper again and I think we will see

209
00:14:20,120 --> 00:14:25,480
that the business case may be in the favor of local hardware again.

210
00:14:25,480 --> 00:14:34,920
Do you see Azure Local primarily as data center technology or increasingly as an edge technology?

211
00:14:36,520 --> 00:14:42,280
Yes, so there is this new feature I haven't got really the chance to dive into in there.

212
00:14:42,280 --> 00:14:49,160
There is new possibility to run, let's call it Azure Local on the edge. So there is a thin image that

213
00:14:49,160 --> 00:14:58,360
you deploy and it's based on Linux distribution. But for most of the customers that is going to be

214
00:14:58,360 --> 00:15:04,360
running that, it sounds like it's more focused around running AI workloads locally.

215
00:15:05,320 --> 00:15:13,160
The normal Azure Local environment that is connected, I really both in the talk to my colleagues

216
00:15:13,160 --> 00:15:20,840
and also if I talk to customers, I do use some time to tell them that it's not just,

217
00:15:20,840 --> 00:15:26,280
they buy true servers, it's not just true servers, you have to pass and keep maintain.

218
00:15:26,280 --> 00:15:31,800
You need to see this as a local dataset, as a local cloud because that whole ecosystem

219
00:15:32,520 --> 00:15:39,240
around the Azure Local is actually quite complex and you need to understand what you're working with

220
00:15:39,240 --> 00:15:44,680
also if something goes wrong, if the patch goes wrong or if the services go down,

221
00:15:44,680 --> 00:15:49,240
you need to know what you're doing and have some experience around it. So I think like

222
00:15:49,240 --> 00:15:57,560
both in-house technician or external consultants from our company and also all companies,

223
00:15:58,200 --> 00:16:03,160
they need to know what they're dealing with. You cannot just put in guys that have never touched

224
00:16:03,160 --> 00:16:08,200
hardware, never touched Windows Server technology and expect them to understand what is going on

225
00:16:08,200 --> 00:16:13,400
because there are so many layers in this way. It is basically a local cloud you are running when

226
00:16:13,400 --> 00:16:21,320
you're using Azure Local. Not let us introduce to a second major part of all this

227
00:16:21,320 --> 00:16:29,240
casual Azure Landings zones for someone who is new to the concept, what problem do

228
00:16:29,240 --> 00:16:32,280
and Azure Landings are involved.

229
00:16:32,280 --> 00:16:39,240
Yeah, I think that is a question I've been asked a lot and of course,

230
00:16:39,240 --> 00:16:47,320
since I work in a team in Phillumon that delivers this Azure Landings zone concept based on

231
00:16:47,320 --> 00:16:55,160
Microsoft's clouded-up and framework concept, it's I think it's for many people that is used to

232
00:16:55,160 --> 00:17:02,600
ask it but not used to that concept, it can be a bit tricky to understand at first. But the

233
00:17:02,600 --> 00:17:10,360
concept is that when you're working with Azure, you need to build structure, you need to build

234
00:17:10,360 --> 00:17:16,200
hardware, you need to ensure that an application owner cannot access your firewall, you need to make

235
00:17:16,200 --> 00:17:25,400
sure that the support consultants cannot go in and modify your logging solution.

236
00:17:25,400 --> 00:17:31,240
So, the whole point of landing zone is that you have the platform landing zones

237
00:17:31,240 --> 00:17:37,560
or the platform subscriptions. That is something like connectivity, so firewalls and routing

238
00:17:37,560 --> 00:17:41,720
that stuff. You can have identity that could be if you're still running the main controllers

239
00:17:41,720 --> 00:17:48,680
that could be that or it could be any identities that kind of stuff. And then you have the landing

240
00:17:48,680 --> 00:17:56,280
zones for the applications and each landing zone should represent a application or solution.

241
00:17:56,280 --> 00:18:05,560
So, if a customer has an application, it could be their ERP system, their final system.

242
00:18:05,560 --> 00:18:10,360
That should live in a landing zone and typically a landing zone exists of multiple environments.

243
00:18:11,000 --> 00:18:17,240
So, in terms of an environment that could be a development environment, a testing environment,

244
00:18:17,240 --> 00:18:25,960
a production environment, it could be a pre-produced environment. Yeah, different kinds of environments

245
00:18:25,960 --> 00:18:35,640
in that landing zone. And the purpose of that is that it is very divided. So, if we go by for that

246
00:18:35,640 --> 00:18:44,520
ERP system, they want to develop and have a development area. That would go into one environment

247
00:18:44,520 --> 00:18:51,160
in the landing zone and one environment is equal a subscription. So, if you say this landing zone

248
00:18:51,160 --> 00:18:57,480
has a demo test and a product, that is actually free subscriptions and the resources would

249
00:18:57,480 --> 00:19:02,520
typically be deployed three times in that demo test and production and subscription.

250
00:19:02,520 --> 00:19:09,720
But it is to keep a very tight and very secure guard well around our applications because

251
00:19:09,720 --> 00:19:17,240
customers that do not use landing zone, they tend to use one subscription, put many applications in,

252
00:19:17,240 --> 00:19:25,400
put a mix of their tests and production systems. They totally lose the overview. They have no idea

253
00:19:25,400 --> 00:19:31,240
is that application running in that database, is that production or is a test or maybe it is a

254
00:19:31,240 --> 00:19:37,880
database that is running both and it is very hard for them to manage, it is hard for them to secure

255
00:19:37,880 --> 00:19:42,600
and it is hard for them to decommission if the application needs to go at some point.

256
00:19:42,600 --> 00:19:50,200
So, that is one of the main things about landing zone is keeping it tight. And when we dig into what

257
00:19:50,200 --> 00:19:56,040
we are using in landing zones, we are using things like asset policy to make governance,

258
00:19:56,040 --> 00:20:01,880
use the attacking solution and asset to check all resources within the subscriptions in the landing

259
00:20:01,880 --> 00:20:09,720
zone. So, again, that is some of the mechanisms we can use to have that governance for those landing

260
00:20:09,720 --> 00:20:21,000
zones. Okay, there was a good architect, overview of the VM, there are a lot of topics. Let us start

261
00:20:22,760 --> 00:20:27,720
with management groups, what do they fit into the design?

262
00:20:27,720 --> 00:20:36,200
Yes, so management group, that is the illusical separation that is used when you are building

263
00:20:36,200 --> 00:20:43,480
the landing zone concept. So, at the top, we have a, let's call it a parent or a main management group,

264
00:20:43,480 --> 00:20:49,640
and below that, you typically have the platform management group and below that, that is where all the

265
00:20:50,200 --> 00:20:56,120
the platform landing zones live. Then again, you can have a below the main management group,

266
00:20:56,120 --> 00:21:00,440
you can have a management group for the corporate landing zones and the online landing zones,

267
00:21:00,440 --> 00:21:07,720
and also actually for the local landing zone, because quite recently, Microsoft added this local

268
00:21:07,720 --> 00:21:17,160
management group to the management groups overview to have that same feature for a local.

269
00:21:18,440 --> 00:21:23,320
But that is what we use management group. For the management groups have the functionality of we can

270
00:21:23,320 --> 00:21:32,680
assign the policies to them, we can deploy to them, we can use the RBACs, so we can set permissions

271
00:21:32,680 --> 00:21:38,520
on the management group group. So, that's an extra and actually create a layer to

272
00:21:38,520 --> 00:21:46,040
suspend the structure that we use often. And I think when we talk about landing zone, the other

273
00:21:46,040 --> 00:21:55,960
most spoke word is subscriptions. How should organization think about subscriptions?

274
00:21:55,960 --> 00:22:06,040
Yes, so from my point of view, we really should stop things as subscription as a container of

275
00:22:06,040 --> 00:22:12,280
everything we need to see subscription as just environments. If you think of it, like I'm talking

276
00:22:12,280 --> 00:22:19,480
about in the landing zone design, a subscription should only contain a subset of resources. It should

277
00:22:19,480 --> 00:22:26,760
not be a mix of all everything. One subscription should not contain both firewall resources and

278
00:22:26,760 --> 00:22:33,640
logging resources and a scroll databases. That is too many resources for one subscription to live in.

279
00:22:33,640 --> 00:22:41,880
I acknowledge that if you are a very small customer, maybe if you resources, it may be a bit overwhelming

280
00:22:41,880 --> 00:22:48,280
and maybe a more careless, you can say, to use this concept. But for most customers in Azure, they

281
00:22:48,280 --> 00:22:57,320
really need to use this concept. And what role does the Azure policy play?

282
00:22:59,400 --> 00:23:05,880
Azure policy can do several things. So there's the audit mode. We have a lot of

283
00:23:05,880 --> 00:23:13,800
regulations for customers need to apply to. It can be in Europe, we have the GDPR, they can be

284
00:23:13,800 --> 00:23:22,680
software, can be a nist, I think it's called. Most of those policy initiatives I actually build in

285
00:23:22,680 --> 00:23:29,320
from Microsoft and ready to use, we just assigned them. They are mostly auditing. And I know we have

286
00:23:29,320 --> 00:23:34,440
Microsoft Cloud Security Benz, my initiative that it can also do some denying effects.

287
00:23:34,440 --> 00:23:41,080
But if we were just reading the audit mode, a lot of Azure policies can be used to audit

288
00:23:41,080 --> 00:23:48,600
your environment. So say that you have to deploy the storage account and you have used less secure

289
00:23:48,600 --> 00:23:53,960
settings that would trigger one of the policies and then initiative to go in a non-compliant state.

290
00:23:53,960 --> 00:24:00,760
And you can see that in the Azure policy overview and you can see that resource needs to be fixed

291
00:24:00,760 --> 00:24:07,240
to be compliant. That's for the audit part. But we also have the deploy if not exist part. So you

292
00:24:07,240 --> 00:24:13,000
can deploy extensions to machines and you can deploy resources actually. And then you have the

293
00:24:13,000 --> 00:24:20,520
blogging of the deny effect. So the Azure policy is also able to deny things. It could be that

294
00:24:21,240 --> 00:24:27,320
you are only allowing users to deploy in certain regions in Azure. And that could be one of the

295
00:24:27,320 --> 00:24:33,800
policies to use or you could deny that they are deploying storage account with the public access

296
00:24:33,800 --> 00:24:39,000
available. It will use for many things and we use that a lot. We have used both of

297
00:24:39,000 --> 00:24:45,720
a lot of buildings from Microsoft and from third parties and also some custom written policies.

298
00:24:45,720 --> 00:24:53,320
Azure policy is great. It's time consuming and you need to use some time to understand it. But

299
00:24:53,320 --> 00:24:59,480
once you get a grip on it, it can do so many things in Azure. And also, and also local.

300
00:24:59,480 --> 00:25:08,680
And we have to say before about how important are identity and

301
00:25:08,680 --> 00:25:17,000
Arabak and in the learning zone architecture from your perspective. Yes, it's very important.

302
00:25:17,000 --> 00:25:24,120
I think one of the main reasons to use the NISON is to have that strict security,

303
00:25:24,120 --> 00:25:33,640
let's call it the SEA trust configuration setup. And you use the principle of LEADS privilege.

304
00:25:35,160 --> 00:25:40,440
At every scope within the learning zone on the management groups or in every subscription in the

305
00:25:40,440 --> 00:25:47,240
learning zone, you have in 3D groups that you apply to users so they have just the right amount

306
00:25:47,240 --> 00:25:53,960
of permissions but not more than that. And also, since we are working a lot with infrastructure code

307
00:25:53,960 --> 00:26:00,040
and automated deployments, we are going to be using service principles that they need to have

308
00:26:00,040 --> 00:26:08,120
access as well. And again, you can control that in the same way. So I think, yeah, that's a very good

309
00:26:08,120 --> 00:26:14,440
area also to understand when working with Linux. So I said, don't go ahead and put yourself

310
00:26:14,440 --> 00:26:24,920
on everyone else's owner on the top management group. That is very tricky. So you use the features

311
00:26:24,920 --> 00:26:30,920
and the possibilities in the Linux and concept to have that zero trust configuration done.

312
00:26:30,920 --> 00:26:43,960
My Microsoft has these reverence architecture. How deep should organize, follow it and

313
00:26:44,680 --> 00:26:57,400
when make sense, yeah, doing modifications. Yeah, good question. I think in our company,

314
00:26:57,400 --> 00:27:04,920
we actually want customers to follow the best practices as much as possible. And we do have some

315
00:27:04,920 --> 00:27:11,320
discussions sometime with customers that want to do it their own way and maybe there is not a

316
00:27:11,320 --> 00:27:18,680
strictly secure as we want them to, but I feel like for the most part, we get the discussion in

317
00:27:18,680 --> 00:27:26,280
and we get them convinced to do it the proper way. We also, all the time, us to go in and assess

318
00:27:26,280 --> 00:27:34,680
solutions in Azure, built by us or built by us. And again, we also, we always want them to be

319
00:27:34,680 --> 00:27:40,760
as secure as possible and to follow the best practices as much as possible because in the end,

320
00:27:40,760 --> 00:27:48,440
I believe that the best practices that Microsoft has written is a great way to build your environments.

321
00:27:48,440 --> 00:28:02,120
How do the Azure local, the Azure cloud, and Azure landing fits together?

322
00:28:04,360 --> 00:28:14,520
Yeah, so in the past, when we were deploying Azure local, we did not have the possibility to use

323
00:28:14,520 --> 00:28:20,040
multiple subscriptions or multiple research groups. So at first, it was really limited. You

324
00:28:20,040 --> 00:28:25,240
deployed Azure local into one subscription into one research group and everything was just set

325
00:28:25,240 --> 00:28:35,880
there, but there was some time ago, it was, it was changed a lot. So as of right now, we can use

326
00:28:35,880 --> 00:28:42,440
multiple subscriptions and we can use multiple research groups. And that actually enables us to use

327
00:28:42,440 --> 00:28:48,040
the landing zone design when we are deploying Azure local. And I think that's a huge

328
00:28:48,040 --> 00:28:54,360
reason and a great feature at this in that Microsoft did some time ago because when we can deploy the

329
00:28:54,360 --> 00:29:01,720
Azure local cluster itself into one subscription, let's call it a control plane or a management plane

330
00:29:01,720 --> 00:29:09,080
or somewhere like that. And then you can use additional subscriptions to have your workloads in.

331
00:29:09,080 --> 00:29:13,960
That could be if you are traditional customers running at domain controllers, you want them to be

332
00:29:13,960 --> 00:29:20,440
TSO and you want them to be in a separate subscription. That is actually now possible with Azure local.

333
00:29:21,240 --> 00:29:26,920
And again, for for members, which we can have these new tier to your one subscriptions. And if you're

334
00:29:26,920 --> 00:29:33,320
running Azure desktop, I believe they should be considered tier two because they host the end user

335
00:29:33,320 --> 00:29:40,040
activity. So we have now the possibility to use the the tearing model also because we can use

336
00:29:40,040 --> 00:29:45,880
multiple subscription. Everything was that would then sit inside a landing zone. So if you think

337
00:29:45,880 --> 00:29:50,680
of the management group layer, we will have that local management group below that. We will have

338
00:29:50,680 --> 00:29:57,560
another management group that is named after this landing zone. We are going to deploy for this

339
00:29:57,560 --> 00:30:03,080
Azure local cluster. And below that, we will have a minimum of four subscriptions, so the control

340
00:30:03,080 --> 00:30:08,120
plane subscription then then tier zero one and two subscriptions for for the workloads.

341
00:30:08,120 --> 00:30:12,760
And also if you're one and co-genators, you can do addition subscriptions for that as well.

342
00:30:15,480 --> 00:30:24,680
So that's I think that's a great way to design. I know all those other Microsoft MEPs has written a

343
00:30:24,680 --> 00:30:32,120
lot about how to use Azure Arc when you are using Azure Arc on your on-premise servers. And again,

344
00:30:32,120 --> 00:30:38,760
for domain controllers, they should be treated as tier zero. How to keep them secure. That was I

345
00:30:38,760 --> 00:30:45,800
feel like that was a headache before. But now I think Microsoft has solved that and we can we can

346
00:30:45,800 --> 00:30:51,640
deploy a tier zero into their own subscription. And we can really make tight security around that

347
00:30:51,640 --> 00:30:59,400
subscription. So no one without the need can access the servers via Azure because every server,

348
00:30:59,400 --> 00:31:03,480
every virtual machine that you deploy in Azure local will also basically be

349
00:31:03,480 --> 00:31:15,400
ARC enabled. You can manage the server's re-SR. Yeah. Interesting, interesting. And I think in

350
00:31:15,400 --> 00:31:25,240
another topic, it's hard to ignore. Yeah, we can't really discuss Azure local without talking about

351
00:31:25,240 --> 00:31:36,760
Azure Arc. What role does Azure Arc play? Yeah, so I think I think Azure Arc is like the

352
00:31:36,760 --> 00:31:44,200
also would connect that between our on-prem and our cloud Azure Arc and one on almost everything.

353
00:31:44,200 --> 00:31:52,440
I think nowadays it can run on Windows servers and it can run and select Linux distributions.

354
00:31:52,440 --> 00:31:59,320
It can run outside of Azure local. So if you have something running on VMware or Hyper-V or

355
00:31:59,320 --> 00:32:04,200
if you have it running in another data center, it could be a ABS or another hosting provider.

356
00:32:04,200 --> 00:32:14,440
You can you can enable those machines. And by an our enabling UI enabling the features that is

357
00:32:14,440 --> 00:32:19,880
within Azure Cloud. So say things like you can use Microsoft Defender for cloud. You can use

358
00:32:19,880 --> 00:32:28,120
Azure Policy. You can use Azure Update Manager. So I think some of those features are really great.

359
00:32:28,120 --> 00:32:34,040
And there's the whole matrix of what features you can do when you are in the machines. But

360
00:32:34,040 --> 00:32:41,160
the Azure Arc is the connect that is connecting our on-prem to our Azure Cloud.

361
00:32:41,160 --> 00:32:48,680
Okay. So would it be fair to say the Azure Arc is one of the technology make the

362
00:32:48,680 --> 00:32:52,840
boundary between cloud and on-prem is increased the relevant?

363
00:32:52,840 --> 00:33:02,440
Yeah. Yeah. So I do believe that as the Azure Arc is the is the boundary it is what enabled us to

364
00:33:02,440 --> 00:33:10,200
connect almost everything outside of Azure Cloud into Azure Cloud for management governance

365
00:33:10,200 --> 00:33:21,240
security really enabled us to have our daily maintenance task within one day one management

366
00:33:21,240 --> 00:33:27,640
pain. So administrators can go into the Azure Cloud and they can monitor all their workloads

367
00:33:27,640 --> 00:33:31,080
regardless of whether they are running in a physically speeding.

368
00:33:31,080 --> 00:33:34,680
Okay.

369
00:33:39,320 --> 00:33:45,640
How do those other Arc changed the way administrators manage the local infrastructure?

370
00:33:45,640 --> 00:33:58,280
I guess for some people I know I have myself in the past in other companies I worked it.

371
00:33:58,280 --> 00:34:06,760
So you use a lot of different third party solutions to have that monitoring and the management

372
00:34:06,760 --> 00:34:16,120
and the passing and installing security. So I think for most servers and for most companies they are

373
00:34:16,120 --> 00:34:23,000
using a whole lot of different products, third party products to manage the servers. And I do believe

374
00:34:23,000 --> 00:34:32,360
that Microsoft solved that issue by having Azure Arc so you can use one product really to enable

375
00:34:32,360 --> 00:34:37,880
all of those functionalities, the both the monitoring the past and installing security,

376
00:34:37,880 --> 00:34:44,440
keeping it up to date, governed them, use machine configuration to keep them at a correct

377
00:34:44,440 --> 00:34:53,400
configuration level. All those things is enabled by Azure. And also of course I work in a company that

378
00:34:53,400 --> 00:35:00,840
we are deeply connected to Microsoft and we want to provide Microsoft product to our customers.

379
00:35:00,840 --> 00:35:05,960
But for that being said I really truly honestly believe that this product as a

380
00:35:05,960 --> 00:35:12,600
arc and the as a cloud is so good that many customers, if they are not always switching from

381
00:35:12,600 --> 00:35:18,920
some other products to this product, they should be looking very seriously into it because I think

382
00:35:18,920 --> 00:35:23,640
the feature matrix is quite comprehensive. We can do a lot of things with as a arc.

383
00:35:25,000 --> 00:35:36,120
I think another topic, especially when we think about all people speak about infrastructure as a code,

384
00:35:36,120 --> 00:35:42,840
how important is this topic for Azure Local?

385
00:35:47,400 --> 00:35:56,280
Yeah, good question. You can deploy the whole stack and you can deploy workloads,

386
00:35:56,280 --> 00:36:01,240
you can deploy everything actually with infrastructure code. And I have done it before and I have

387
00:36:01,240 --> 00:36:10,120
done it also with customers. I would guess that I was suspect that some customers that is going to

388
00:36:10,120 --> 00:36:17,880
be deploying Azure Local themselves will not use the infrastructure code method to deploy it.

389
00:36:17,880 --> 00:36:25,880
That's totally fair. But I think if you're going to be doing a thing more than once, you should

390
00:36:25,880 --> 00:36:29,480
automate it, you should write code for it and you should use infrastructure code.

391
00:36:29,480 --> 00:36:38,360
Think of an example about Azure Virtual Desktop. Sorry if you're running Azure Virtual Desktop

392
00:36:38,360 --> 00:36:43,320
on Azure Local, there are going to be some maintenance tasks that is going to be recurrent.

393
00:36:43,320 --> 00:36:51,960
They can be automatically handled with infrastructure code and perform very well. So

394
00:36:51,960 --> 00:36:57,560
that is actually a use case where I would recommend customers not to build it from scratch,

395
00:36:57,560 --> 00:37:02,760
everything with infrastructure code because that will, I know it's maybe the time-consuminal for us,

396
00:37:02,760 --> 00:37:11,320
but all the long, all the next few years it will save the IT department. I was that for sure.

397
00:37:11,320 --> 00:37:21,320
Yeah. I have seen in your profile, I used to say, on the byset side of

398
00:37:21,320 --> 00:37:29,560
infrastructure at the code, why byset and why not terraform?

399
00:37:31,640 --> 00:37:38,520
Yeah, I think that's a good question. And I haven't really made that much thought decision about it.

400
00:37:38,520 --> 00:37:46,440
It came quite naturally for me that we were a few years back when I really started working on

401
00:37:46,440 --> 00:37:51,960
infrastructure code. We started on Azure Derops and we started with byset.

402
00:37:51,960 --> 00:37:58,680
I think for some of the guys like myself, I have been writing new housescript for many years.

403
00:37:59,240 --> 00:38:05,400
And I think the transition from using only power cell to using power cell to get

404
00:38:05,400 --> 00:38:12,680
a bit byset. And also nowadays maybe not power cell, that multiple can be where it can work as a,

405
00:38:12,680 --> 00:38:25,000
as an executioner, but we use a lot of risk call also in redeploy. But I think the uses of

406
00:38:25,000 --> 00:38:32,280
power cell together with byset, I would suspect that for many, including myself, it's quite easy to

407
00:38:32,280 --> 00:38:38,920
get started and get used to it. The byset language is easy to understand that if you are writing byset

408
00:38:38,920 --> 00:38:44,840
and we use code for them and have the extensions installed, it's quite helpful and it's going to

409
00:38:44,840 --> 00:38:52,760
tell you all that you cannot just send text or this is wrong again. So it's, I feel it's quite easy

410
00:38:52,760 --> 00:39:01,720
to use and to get working. But I have not spent time with telephones or act actually I cannot say,

411
00:39:01,720 --> 00:39:07,560
it's just because that is much better natural for me and what I've been doing for the past years.

412
00:39:07,560 --> 00:39:19,640
Yeah, I think what also interesting is,

413
00:39:21,160 --> 00:39:30,280
also in actually GitHub GitHub, but yeah, as I love really, I think the Azure DevOps makes, makes sense.

414
00:39:30,280 --> 00:39:37,240
What role does Azure Devop play in your infrastructure deployments?

415
00:39:37,240 --> 00:39:47,320
Listen, actually we use Azure Devos for many things. We use it for our repositories in our

416
00:39:47,320 --> 00:39:53,240
Devos projects, but also we use the service connections to deploy into Azure and into the

417
00:39:53,240 --> 00:39:58,600
deploy into Azure local. It's super easy and Azure DevOps to set up a service connection that hooks

418
00:39:58,600 --> 00:40:03,960
into Azure and if it's connected to Azure, it can connect to Azure local also because

419
00:40:03,960 --> 00:40:11,800
provided by Microsoft and super easy to set up. There are other features than there also,

420
00:40:11,800 --> 00:40:18,280
the board feature and the development tracking if we are learning a project. We also use in that.

421
00:40:18,280 --> 00:40:29,320
Also, I also use GitHub and do that, but in terms of Azure and deploying to Azure Azure,

422
00:40:29,320 --> 00:40:37,000
it's local. For me, it's just very easy to use DevOps because it's so, so fast to set up and

423
00:40:37,000 --> 00:40:43,400
everything is configured by Microsoft. You just have to go a few resources and you have permissions

424
00:40:43,400 --> 00:40:50,840
on the setup. You can even go in and set up a Azure DevOps managed agent pool. If you need to run

425
00:40:50,840 --> 00:40:58,360
your custom scripts and you use your DevOps agents, it's very easy to set up a good start of it.

426
00:41:01,640 --> 00:41:12,760
You run this local. I don't know. I think a little bit. Yeah, but

427
00:41:12,760 --> 00:41:25,880
as a dev ops team, can you a little bit walk us through a typical pipeline from

428
00:41:27,000 --> 00:41:34,200
the developer changing infrastructure code to that infrastructure pre-earing in Azure?

429
00:41:34,200 --> 00:41:44,920
Yeah, let me see if I can answer that question in a good way. It can be just as simple as

430
00:41:44,920 --> 00:41:53,320
writing the bicep template to deploy a certain amount of resources and use a simple pipeline

431
00:41:53,320 --> 00:41:58,120
to the broader insescia. It can also be more extensive where you use

432
00:41:58,120 --> 00:42:05,640
integration tests. If you have maybe a pair of meter files, or some pair of meter things, then

433
00:42:05,640 --> 00:42:08,600
you want to test that they are correctly

434
00:42:08,600 --> 00:42:15,800
containing the correct data. You're going to have certain kind of tests and you can use

435
00:42:15,800 --> 00:42:22,680
different kind of linders also to test. If you want to use pipelines also or to check

436
00:42:22,680 --> 00:42:27,320
if you're secure, so some of the pylons steps could be to check if your code is secure.

437
00:42:27,320 --> 00:42:34,760
That maybe is not common to use for infrastructure code, but I know it is for application code.

438
00:42:34,760 --> 00:42:42,760
And then you deploy your code. Something that can be useful is also to

439
00:42:42,760 --> 00:42:50,760
if you write up what you're expecting to be deployed, you can use that as a pre-deployment check

440
00:42:50,760 --> 00:42:58,600
and have a post deployment check. So, you're writing your recipe. What do you expect to deploy into

441
00:42:58,600 --> 00:43:03,320
asher? When you do the actual deployment in another stage in the pipeline, and then after that,

442
00:43:03,320 --> 00:43:08,040
you do another stage where you check and actually check the resource in asher. Were they correctly

443
00:43:08,040 --> 00:43:14,520
deployed? Were there some errors? Were there some differences? Where are my recipes? Does not

444
00:43:14,520 --> 00:43:22,440
align up with my deployment? That can be can be super useful for if you're wanting a bit more complex

445
00:43:22,440 --> 00:43:32,440
pipeline deployment. I think you prefer you also working on the fellow-mind management platform.

446
00:43:32,440 --> 00:43:43,560
What is the management development management platform? What problem do we try to solve?

447
00:43:44,520 --> 00:43:50,120
Yeah, that's a very good question. I know that fellow-mind will be happy that I spend time telling you

448
00:43:50,120 --> 00:44:00,360
about the fellow-mind management platform. We call it the FMP. So, in the essence, FMP is a turnkey

449
00:44:00,360 --> 00:44:08,200
solution to asher cloud. We are also looking into adding features for as a local as well. But

450
00:44:09,640 --> 00:44:14,920
if you do not want to spend a huge amount of time developing your own landing zone

451
00:44:14,920 --> 00:44:24,200
system and subscription, vending, resource cleanup, deployment of new landing zones, how to manage

452
00:44:24,200 --> 00:44:31,000
your connectivity, how to do logging, everything within that concept is provided by this platform

453
00:44:31,000 --> 00:44:36,680
as a turnkey solution. The customer just signs up. They hand us a permission to go into the tenant and

454
00:44:36,680 --> 00:44:47,960
redeploy everything in this managed method. So, if someone wants to look into it more, there is a

455
00:44:47,960 --> 00:44:55,880
public site called fmp.filomind.com. There is the architectural design and there is the matrix of what

456
00:44:55,880 --> 00:45:03,400
we do versus what the asher landing zone concept does. We have a lot of different features that is

457
00:45:03,400 --> 00:45:11,880
not within the baseline form for the asher landing zone. So, there is a real customers. I know we

458
00:45:11,880 --> 00:45:19,720
have AI nowadays. We could set down and develop them themselves. Agree and acknowledge that.

459
00:45:19,720 --> 00:45:25,880
But still, they would need substantial knowledge about how to design solutions in asher.

460
00:45:25,880 --> 00:45:31,960
Just think of connectivity. We have multiple designs. So, customers want to use the vvn or

461
00:45:31,960 --> 00:45:40,280
they want to use another network to sign, mostly just deploy a firewall and a repaint gateway,

462
00:45:40,280 --> 00:45:46,440
or if they do not need network connectivity at all, all the routing, the private DNS handling

463
00:45:46,440 --> 00:45:51,720
from zones and if they have unpremly need to have an DNS resolver as well deployed,

464
00:45:51,720 --> 00:45:58,120
all of those different components they need to understand and be aware of. So, of course, in the FMP,

465
00:45:58,120 --> 00:46:04,440
we have the deployment of all resources, but we also have quite a substantial amount of documentation.

466
00:46:04,440 --> 00:46:11,000
Available so customers can really dig into and understand what should they do in certain situations.

467
00:46:11,000 --> 00:46:19,080
And besides that, we also give them a portal with a lot of data about the platform. Give it to

468
00:46:19,080 --> 00:46:25,320
them and also for stakeholders that need to do decisions about cost and governance for the asher.

469
00:46:25,320 --> 00:46:32,040
They may not be in the asher portal that much, but we are giving you a lot of data from that portal as well.

470
00:46:32,040 --> 00:46:38,600
I think that for the last part, it's also access to consultants that know a lot about asher

471
00:46:38,600 --> 00:46:44,040
and the different components, the resources that they can deploy, how to design it. So, again,

472
00:46:44,040 --> 00:46:50,040
also if a customer has the FMP, they also have access to consultants that they can have their

473
00:46:50,040 --> 00:46:57,320
discussions with on how to design solutions within asher and also within the FMP once they are

474
00:46:57,320 --> 00:47:04,760
one-border to that. Awesome. But let's jump back to the start of the

475
00:47:04,760 --> 00:47:11,640
lecture to modernization, imagining that the company I say that has five of our traditional

476
00:47:11,640 --> 00:47:14,360
virtual machines. Where do you begin?

477
00:47:17,160 --> 00:47:22,600
The one is to get some access, some really good access because we can use tools like

478
00:47:22,600 --> 00:47:28,600
asher migrate actually to do assessment. That tool has been available for many years by a

479
00:47:28,600 --> 00:47:37,240
manufacturer. Then if you deploy an instance of that in the environment and you have proper permissions,

480
00:47:37,240 --> 00:47:43,800
that asher migrate solution can actually assess all the workloads within that environment.

481
00:47:43,800 --> 00:47:51,720
They can assess things like each version machine or committed or under committed, is it using all

482
00:47:51,720 --> 00:47:58,040
the allocated resources? You can also see things like, does it have as grill show installed? Does it have

483
00:47:58,040 --> 00:48:06,760
web hosting like in the information stores installed? And I think also all the other

484
00:48:06,760 --> 00:48:16,280
application services as well. Then that gives us a good start-up point to know what should we dig into

485
00:48:16,280 --> 00:48:22,520
further because of course as a migrate alone as an assessment tool is great but it's not complete

486
00:48:22,520 --> 00:48:27,880
and it will not tell the customer exactly how to work from there. So the next level is to

487
00:48:27,880 --> 00:48:35,000
assess all the application zeros. So we look at what kind of file zeros that we have. Could we

488
00:48:35,000 --> 00:48:41,240
put some data in SharePoint or put some data in storage account? Could we put some data in

489
00:48:41,240 --> 00:48:49,240
some kind of solution that has to run locally and we can use that as a storage sync service?

490
00:48:49,240 --> 00:48:55,320
That kind of stuff. So just for that, just for the files we need to look into what of those many

491
00:48:55,320 --> 00:49:00,760
new solutions can we use for that? And again, that's the same for the applications and for the

492
00:49:00,760 --> 00:49:08,040
databases if the use remote desktop today can we use AVD instead? All those sorts of things.

493
00:49:08,040 --> 00:49:15,160
It can be quite time consuming to do but yeah, we use things like as a migrate to do some of the

494
00:49:15,160 --> 00:49:22,680
initial assessment and from there we talk with the customer and we advise them on what to do.

495
00:49:22,680 --> 00:49:29,080
We build the faces because if let's say have five hundred zeros, you're typically not migrating

496
00:49:29,080 --> 00:49:36,200
everything to asset once and I know that some companies want to just tell the customers to just migrate

497
00:49:36,200 --> 00:49:44,120
all five hundred zeros and go from there but to be honest, I think everyone working with migration

498
00:49:44,120 --> 00:49:48,520
should be honest about it once the customers in Azure. The customer thinks, okay, I'm an

499
00:49:48,520 --> 00:49:53,480
asset. Good to go. But yeah, you just migrated five hundred zeros from one data center to another.

500
00:49:53,480 --> 00:50:00,280
You have not modernized them yet. So my perspective is always to, if you have hardware locally

501
00:50:00,280 --> 00:50:06,360
and you can keep running there, let's start with looking at the modernization possibilities.

502
00:50:06,360 --> 00:50:11,400
So I do not want to move five hundred zeros to as it is for the front of it. I want to migrate

503
00:50:11,400 --> 00:50:17,080
them to platform solutions wherever possible. I want to decommission zeros. I want to minimize the

504
00:50:17,080 --> 00:50:24,520
number of zeros that customer has. That is always my in-code. Yeah, you're not the biggest lift

505
00:50:24,520 --> 00:50:31,880
in shift vendor. I know, hate lift in shift. And I've done it so much. It's not like I've not done it.

506
00:50:31,880 --> 00:50:38,360
I've done it for plenty of times but it's just, it's not fulfilling to do lift in shift. It's so much

507
00:50:38,360 --> 00:50:44,840
more fun to do the modernization to see that the customer can move from, say, five hundred zeros to

508
00:50:44,840 --> 00:50:50,520
two hundred zeros and the other three hundred workloads were modernized to lose solutions.

509
00:50:50,520 --> 00:50:54,520
And also we always find something that should just be straight up decommissioned because it's

510
00:50:54,520 --> 00:50:57,320
not running anymore. Customers do not know what they have running.

511
00:50:57,320 --> 00:51:05,560
What was, what was, did you think, what's the biggest opportunity organization,

512
00:51:05,560 --> 00:51:15,000
this when they migrate a latency infrastructure? I think it is a combined of many things.

513
00:51:15,000 --> 00:51:22,760
So if they're moving to Azure, of course, use the features for cost savings,

514
00:51:22,760 --> 00:51:27,720
reservations and savings plan and that kind of stuff. You should use that wisely because

515
00:51:27,720 --> 00:51:32,040
that can save a lot of money. And they can also save a lot of if they have windows showers,

516
00:51:32,040 --> 00:51:38,520
they can save one of the licenses as well. I see that a lot that customers just don't make the

517
00:51:38,520 --> 00:51:43,160
decisions and then they end up spending a lot of money on purchasing machine that is going to be

518
00:51:43,160 --> 00:51:49,640
running in Azure for years. That's one thing. And I also see a lot of customers moving their

519
00:51:49,640 --> 00:51:55,080
workloads into Azure, but just keeping the same level of integration that they did before.

520
00:51:55,080 --> 00:52:00,280
Let's say they were on prem or they were at another hosting provider, somebody else.

521
00:52:00,280 --> 00:52:05,800
And they just moved the servers into Azure, but they do not take the time to set up Azure policies

522
00:52:05,800 --> 00:52:10,600
to actually govern and secure them. And they do not use Azure update management to keep

523
00:52:10,600 --> 00:52:15,320
them updated. They still do many of them updating or use some third party software that also paid to.

524
00:52:15,320 --> 00:52:23,240
And yeah, so I think that's some of the things that they do not actually use the features

525
00:52:23,240 --> 00:52:28,440
handed to them once they migrate into Azure because again, as I said before, once they have moved

526
00:52:28,440 --> 00:52:34,040
into Azure, they feel like I'm done now. I'm in Azure, everything is good. But even things like

527
00:52:34,040 --> 00:52:38,920
doing so many, don't see or doing during the day in Azure, you have to set that up, you have to

528
00:52:38,920 --> 00:52:44,120
configure it. It's not just enabled by default by Microsoft. And that's also a thing that I think

529
00:52:44,120 --> 00:52:49,800
a lot of customers is not aware of. And we do, we really try a lot to tell customers about those things.

530
00:52:49,800 --> 00:52:54,600
You need to maybe need to rebuild your servers, maybe you need to configure them in different

531
00:52:54,600 --> 00:53:01,400
way, maybe you need to redesign the applications to use the features available in Azure to keep the

532
00:53:01,400 --> 00:53:06,840
resiliency at the at the spest because we have so many features in Azure around that.

533
00:53:06,840 --> 00:53:18,280
One thing all companies see if all states are getting expensive, they're more expensive.

534
00:53:18,280 --> 00:53:27,880
Did you see also we can, we have the option when we model, we are getting more down infrastructure,

535
00:53:27,880 --> 00:53:38,680
we can also save cost. Yeah, I think, yeah, usually we can. Of course, if you take a thing like a very

536
00:53:38,680 --> 00:53:43,240
small windowsill running in a squirrel database on top and you want to use a squirrel many things,

537
00:53:43,240 --> 00:53:51,400
of course, that will be more expensive, but for the most part, we can save money by removing the

538
00:53:51,400 --> 00:53:57,800
windows servers, removing the windows licenses, using a platform service instead, that is also

539
00:53:57,800 --> 00:54:04,840
provisioned correctly and has the right amount of resources. And typically we can save money by

540
00:54:04,840 --> 00:54:11,320
doing that. And also a thing that customers do not account in when they do the calculation is,

541
00:54:12,040 --> 00:54:16,920
for every server you have, you have a administrative burden, so you have to keep it a patch,

542
00:54:16,920 --> 00:54:23,000
you have to monitor it, you have to fix when the patch grows wrong. And every time you move from an

543
00:54:23,000 --> 00:54:31,080
infrastructure service to a platform service, your amount of remains in this work is getting smaller

544
00:54:31,080 --> 00:54:37,800
because Microsoft will take care of more things than before. And of course, that is not a nice

545
00:54:37,800 --> 00:54:45,400
to customers that are selling managed services because, yeah, of suddenly we have to do less,

546
00:54:45,400 --> 00:54:53,720
but then again, we can do a bit less of the growing part about maintenance and things we can do more

547
00:54:53,720 --> 00:55:01,400
about continuously improving the customers environment, keeping the up-to-date, tuning the environment,

548
00:55:01,400 --> 00:55:06,040
configured it, because that's always the thing you can figure different to keep it more secure.

549
00:55:06,040 --> 00:55:14,520
I don't think we are not doing time in that sense, but the customer can save money, I believe,

550
00:55:14,520 --> 00:55:21,640
if it's designed correctly. Yeah, awesome, I think we're a little bit running out of time,

551
00:55:21,640 --> 00:55:28,600
so I have every session, like, a quick fire round, so five, six questions, you give a fast answer.

552
00:55:29,160 --> 00:55:35,880
So, PowerShell or Azure CLI? Hmm, PowerShell.

553
00:55:35,880 --> 00:55:40,200
Portal or infrastructure is code? Ah, infrastructure is code.

554
00:55:40,200 --> 00:55:45,400
Like, we can outspoken or to work. To work.

555
00:55:45,400 --> 00:55:56,040
Pass or containers? For my bad pass, because I don't know much about containers, but if I do know

556
00:55:56,040 --> 00:56:01,880
containers, I will say containers. So, it's not the end of the day yet to come to you and say,

557
00:56:01,880 --> 00:56:11,720
you get all the money resources to make Azure Local better or develop a feature. What feature will it be?

558
00:56:11,720 --> 00:56:20,280
So, a thing running on top of Azure or Local or a feature that is developed by Azure Local team,

559
00:56:20,280 --> 00:56:29,160
I just need to understand the question. Yeah, you can do, you get all the money resources and

560
00:56:29,160 --> 00:56:36,280
you say, this is what I need to make the best product of the world. Yeah, okay. I know,

561
00:56:36,280 --> 00:56:40,600
I know one answer that me and my colleagues want, so we have this thing called Hydration.

562
00:56:40,600 --> 00:56:47,720
If you backup in restore, if you have to move version machines from one Azure Local cluster to another,

563
00:56:47,720 --> 00:56:53,400
they lose the arc enabled from another team, have to do a lot of car bar tricks to get that running.

564
00:56:53,400 --> 00:56:59,320
So, that Hydration feature will be so good and I know, Microsoft will do it at some point.

565
00:56:59,320 --> 00:57:07,160
I think it's a hard feature to develop, but we really want to have that possibility to move,

566
00:57:07,160 --> 00:57:14,360
workloads between clusters and keep them arc enabled. That is my number one feature,

567
00:57:14,360 --> 00:57:22,120
what really want to have really soon. So, okay, then my final question is Christopher,

568
00:57:22,120 --> 00:57:28,360
imagine I'm responsible for the traditional infrastructure at the mid size enterprise.

569
00:57:28,360 --> 00:57:34,040
I have the amber or hyperview, hundreds of VMs, active directory, I grow an Azure environment,

570
00:57:34,040 --> 00:57:42,680
pleasure from management to modernize. I don't want another isolated infrastructure platform.

571
00:57:42,680 --> 00:57:49,160
How will you approach design and several learnings on strategy G, where Azure Local and Azure Public

572
00:57:49,160 --> 00:57:57,480
Cloud becomes part of one architecture and what should it do first on one day money?

573
00:57:57,480 --> 00:58:04,840
I think number one is I would look into the hardware head already because maybe that hardware could

574
00:58:04,840 --> 00:58:10,680
be upgraded with some other network cards or maybe some other storage adapters and that could actually

575
00:58:10,680 --> 00:58:16,520
use Azure Local. Then next, I would look into what resources could be modernized into Azure to

576
00:58:16,520 --> 00:58:22,600
platform services to keep the amount of virtual servers as low as possible. When ones have done that,

577
00:58:22,600 --> 00:58:28,360
I would look into what servers could be moved into Azure and what servers need to be locally,

578
00:58:28,360 --> 00:58:36,600
either because of latency, regulations or another third option. That would be my set of starting

579
00:58:36,600 --> 00:58:40,760
points to get started with, looking at the signing of it.

580
00:58:40,760 --> 00:58:49,000
I love that network. Who should I invite next at what questions should I ask?

581
00:58:49,000 --> 00:58:53,480
That is a good question.

582
00:58:53,480 --> 00:59:01,320
Of course, since I work with the things that I work with, I find infrastructures code and I find

583
00:59:01,320 --> 00:59:08,280
Azure Local exciting. I think there's a lot of things going on with BICEP at the moment. There's a new

584
00:59:08,280 --> 00:59:16,120
features going to DA. That can't stop. I feel like for myself personally that some of the things I'm

585
00:59:16,120 --> 00:59:21,160
looking very much into right now is what is going on with BICEP because there are new features coming out

586
00:59:21,160 --> 00:59:27,320
and really BICEP is moving forward and adding functionalities within the BICEP deployment.

587
00:59:28,360 --> 00:59:34,600
For me, I cannot pinpoint an exact person right now, but for me personally, I think BICEP is

588
00:59:34,600 --> 00:59:37,720
very nice to look into at the moment for what is going on with that.

589
00:59:37,720 --> 00:59:46,360
Awesome then. Yeah, Kirstoff, thank you for for joining me today. I think one of the important ideas

590
00:59:46,360 --> 00:59:52,840
from this collaboration is that hybrid cloud tool means running to completely separate worlds.

591
00:59:53,480 --> 01:00:00,200
And a local becomes particular interesting when organizations stop thinking about it's purely

592
01:00:00,200 --> 01:00:06,520
as local infrastructure and start considering how it fits in the broader Azure architecture.

593
01:00:06,520 --> 01:00:13,240
So yeah, we have heard a lot. Azure learning zones, Azure art, infrastructure as a code, BICEP,

594
01:00:13,240 --> 01:00:21,640
PowerShell, and so on. Yeah, I think this was really cool overview. I'm very thankful for what a

595
01:00:21,640 --> 01:00:29,240
time you have spent with me and yeah, for the listeners, all the info for Kirstoff, you find on the MC65

596
01:00:29,240 --> 01:00:37,720
podcast page in the show loads. And yeah, you see the work of Kirstoff, you can connect with them

597
01:00:37,720 --> 01:00:43,080
and all the other information. So yeah, thank you very much for staying here with me.

598
01:00:43,080 --> 01:00:48,520
Thank you. Glad to let that you would have me on this podcast. Yeah, so thank you.

599
01:00:48,520 --> 01:00:58,520
[BLANK_AUDIO]