Protect your web apps from modern threats with Microsoft Defender for Cloud

In this era of AI-driven competition, enterprises of all sizes have prioritized the value of migrating their app development from on-premises to the cloud. As developers rapidly publish new cloud applications, bad actors are equally relentless in seeking new ways to exploit misconfigured resources. One question that comes up for enterprise cloud architects is, how can you best protect your cloud deployments from attacks? More importantly, how do you incorporate security practices for cloud systems that may be different from on-premises systems and different between cloud service providers?

That’s where the power of a managed platform as a service (PaaS) with integrated cloud security comes in. Azure App Service provides native security integration with Defender for App Service in Microsoft Defender for Cloud to help protect multicloud and hybrid environments with comprehensive security across the full lifecycle, from development to runtime. In this blog, we will explore another well-kept secret: how seamless and worry-free it can be to safeguard your web applications using the integration with Defender for App Service.

Native security integration with a Zero Trust approach

Defender for App Service is a Microsoft first-party solution that uses the scale of the cloud to identify attacks targeting applications running in Azure App Service, providing more robust security when you migrate from your on-premises web apps. With this migration to App Service, you receive automatic platform maintenance and security patching so you’re always running the latest versions of the operating system, language frameworks, and runtime software.  

By enabling Defender for App Service, you get an extra layer of protection for your App Service plan that assesses the resources and generates security recommendations based on its findings. Since it seamlessly integrates with Azure App Service, it minimizes the need for deployment and onboarding overhead on your end and requires no alterations to your apps to detect threats.  

Attackers routinely probe web applications to find and exploit weaknesses. Before being routed to specific environments, requests to applications running in Azure go through several gateways, where they’re inspected and logged. Our Zero Trust approach collects signals from your organization’s cloud app usage without any reconfiguration, with Azure Web Application Firewall optionally safeguarding data transmission between your environment and these applications. Defender for App Service then works to detect harmful exploits and malicious behavioral patterns in web apps and web app runtime activity. 

You can use the detailed instructions in these recommendations to harden your App Service resources, meaning your team will also have complete behind-the-scenes visibility into potential threats and misconfiguration. With Defender for App Service integrated with your Azure App Service deployment and managed by Microsoft, your web apps are assured of the latest security protection without necessarily requiring you to first become a hands-on Zero Trust expert.

Enhanced detection and response capabilities at scale 

Security in the cloud provides scalable defenses that are constantly updated and expertly managed. By enabling Defender for App Service in Defender for Cloud, you can implement robust security practices early in the software development process, secure code management environments, and gain valuable insights into your development environment’s security posture.  

Defender for Cloud provides a centralized view of security alerts across all your Azure resources, including App Service. It generates cloud-centric security recommendations after assessing these resources, based on the Microsoft cloud security benchmark. You can then use the detailed instructions in these recommendations to harden your App Service resources. 

Our customers have found that using security benchmarks can help you quickly secure cloud deployments. A comprehensive security best practice framework from cloud service providers can give you a starting point for selecting specific security configuration settings in your cloud environment, across multiple service providers and allow you to monitor these configurations using a single pane of glass.  

These recommendations include two key aspects: 

 

◉ Security controls: These recommendations are generally applicable across your cloud workloads. Each recommendation identifies a list of stakeholders that are typically involved in the planning, approval, or implementation of the benchmark. 

◉ Service baselines: These apply the controls to individual cloud services to provide recommendations on that specific service’s security configuration.  

Defender for App Service provides tools to help you investigate and respond to security incidents, and because it is natively integrated with Azure App Service, it’s easy to enable with just a few clicks. By utilizing the two services together, Your IT team will be able to quickly identify and fix the root cause of an attack, so that your apps can be brought back online as quickly as possible. 

A playbook for staying ahead of digital threats 

Defender for App Service maps threats according to the MITRE ATT&CK framework. The MITRE ATT&CK framework is a comprehensive list of ways that cyber attackers can try to break into and exploit computer systems. The framework helps cybersecurity experts understand and defend against these attacks by giving them a clear idea of what tactics and techniques bad actors might use.  

Defender for Cloud can also detect ongoing attacks, even if it is deployed after a web app has been exploited. This is because it can analyze log data and infrastructure data together to identify suspicious activity, such as new attacks circulating in the wild or compromises in customer applications. 

Improve the security posture of your web apps running on App Service 

Migrating apps to Azure App Service can help improve security posture in several ways. To recap some of the benefits: 

• A secure and hardened platform: Actively monitored and updated by Microsoft, you don’t have to worry about managing the underlying infrastructure, network, or software components. 
• HTTPS and TLS encryption: Supported for all communication, both inbound and outbound. You can also enforce HTTPS and disable outdated protocols to prevent unencrypted or insecure connections. 
• Restricted app access based on IP addresses, client certificates, or user identities: You can also use the App Service authentication feature to integrate with various identity providers, such as Microsoft Entra ID (formerly Azure Active Directory), Facebook, Google, or OpenID Connect providers. 
• Managed identities: Securely access other Azure resources, such as SQL Database or Storage, without storing any secrets in your code or configuration files. You can also store sensitive app settings and connection strings as secrets in Azure Key Vault, and then monitor your Key Vault using Defender for Key Vault. 
• Integrated with additional security products: App Service works with industry-leading features and tools that can help you detect and mitigate threats, such as web application firewall (WAF), Microsoft Defender for Cloud, and Azure Sentinel. 

Enable Defender for App Service in your App Service plan today 

Defender for App Service provides continuous security assessment and recommendations to help you harden your Azure App Service resources and improve your secure score. It detects and alerts you of various attacks, such as user-agent injection, web shell activity, and dangling DNS. You can also view the attack details and mitigation steps in the Azure portal or use Azure Sentinel to investigate and respond to incidents. 

Since Defender for App Service is natively integrated with App Service, you don’t have to install or configure anything. Simply enable it on your App Service subscription and refer to the pricing options to customize your plan.

Source: microsoft.com

Continue reading

Modernize and monetize your network investments with Microsoft Azure Operator Nexus

Azure Operator Nexus is now generally available  

Earlier this year at MWC Barcelona, Microsoft announced the public preview of Azure Operator Nexus, a carrier-grade and hybrid platform, built to empower telecom operators to modernize and transform their networks. Operator Nexus enables operators to use cloud technology to modernize and monetize their network investments—lowering total cost of ownership (TCO), driving operational efficiency and resiliency with advanced AI and automation, and improving the security of highly distributed, software-based networks. Today, we announce that Operator Nexus is now generally available (GA). 

Since MWC, we’ve incorporated additional features based on insightful feedback from customers. With the latest release of Operator Nexus, some of the new features include: 

◉ Network Fabric Automation—enables operators to build, operate, and manage carrier-grade network fabric from Azure. It performs several functions like bootstrapping and configuration, application of network policies, lifecycle management, creation of tenant workload network, and providing observability of the network devices. Network Fabric Automation provides a single point of control and visibility across the entire network fabric for the Operator Nexus platform and host tenant workloads.  

◉ Network Packet Broker—allows operators to efficiently capture, aggregate, filter, and monitor traffic. It enables operators to monitor large complex networks and provide network-level visibility to aid with service planning and troubleshooting of service problems. It also plays a vital role in enhancing troubleshooting capabilities, meeting regulatory requirements, and enabling organizations to maintain the optimal performance and security of their networks.  

◉ Enhanced Azure Kubernetes Service (AKS)—for on-premises use. Operator Nexus contains specific extensions to optimize the automated creation of containers to host tenant network function workloads. This new extension improves resilience and the availability of the cluster; it also enables operators to isolate and manage the performance of specific workloads. 

◉ Azure Lockbox—provides operators with an additional layer of operational control over access to their data stored in the Azure cloud platform. This feature allows operators to approve or deny access to their data by Microsoft support engineers who may require access for troubleshooting or maintenance purposes. In those rare circumstances where such access is required, Azure Lockbox provides an interface for customers to review and approve or reject customer data access requests. 

◉ Placement control of network functions—this feature gives more control to the operators on workloads deployment placement within a cluster. The operators can use this feature for improved performance, efficiency, and resiliency of the workloads. 

◉ For observability, Operator Nexus has native integration with Azure Monitor—operators can send data to either Azure Operator Insights, Log Analytics Workspace (LAW), or Azure Data Explorer (ADX) cluster. Log Analytics Workspace offers a wide range of built-in capabilities, including log analytics, visualization, alerting, and more. Alternatively, operators can view the logging data using ADX cluster, which provides a low-cost alternative to LAW. If the main purpose is to retain the observability data for Retention and Information Management (RIM) compliance, operators can choose to send the data to a storage account. 

◉ As part of the Azure AIOPs offers, Azure Operator Service Manager (AOSM)—transforms the operator service management experience into a modern cloud service. It simplifies the management of complex, multi-part, multi-vendor service deployments across thousands of hybrid cloud sites, including Azure regions, edge platforms, and Azure Arc-connected infrastructure. AOSM offers benefits like a single management experience for Microsoft and third-party network functions, automation enriched with Azure’s industry-leading cognitive services, and strict software distribution security enforcement, ensuring that what is published is what gets deployed. 

AT&T deployment successfully reaches new milestone 

AT&T continues to work closely with Microsoft on Operator Nexus from early access and into GA.  AT&T has begun deploying Network Function workloads in its labs, with the intent to deploy them into production environments. 

“Operator Nexus GA is an important milestone in our journey with Microsoft and ecosystem collaborators on Telco Grade cloud for Mobility 5G Core. We are excited to see our vision of Telco grade cloud powered by Microsoft Azure and AI technologies deployed in AT&T data centers and operated by AT&T. This will help deliver simplified operations, lower total cost of ownership, and improved time to market so we can continue to forge ahead with building the world’s best 5G service.” 

—Igal Elbaz, Senior Vice President, Network CTO, AT&T

The expanding Operator Nexus ecosystem 

Network function vendors have had the opportunity to experience early access to Operator Nexus through the Ready program, which certifies that the ecosystem of cloud-native network functions (CNFs), virtual network functions (VNFs), and other software interoperate with Operator Nexus. The close collaboration between Microsoft and its many software vendors has enabled each partner to use real-world workloads to prioritize and build on platform features.  

For example, Nokia successfully executed an end-to-end 5G Standalone (SA) call, using its 5G core CNFs running on Operator Nexus. The company also established a reference design guide for its 5G core on Nexus. In another example, Ericsson, building on the success of working with AT&T, is now ready to begin trialing its cloud-native 5G Core with operators on Operator Nexus.  

This early, positive feedback helps to ensure the success of our lighthouse customer, AT&T. Of equal significance, partners are now familiar with the process of what it entails to bring updated or additional network functions to this platform in the future. Continued relationships with partners through the program will allow for a robust, trusted collection of network functions that are deployment-ready for Operator Nexus. 

“We are pleased to expand our strategic collaboration with Microsoft, focusing on cloud-based network solutions within their Operator Nexus architecture. This alliance includes various capabilities, from PCC (policy, charging, and control) to end-to-end service orchestration, driving network automation for agility and enhanced monetization. By integrating Amdocs’ network functions into the Operator Nexus framework, we accelerate operators’ network transformations, reaffirming our commitment to technological innovation on the cloud.” 

—Anthony Goonetilleke, Group President of Technology and Head of Strategy, Amdocs

 

“Our validation efforts with Microsoft have reached a watershed moment where operators are now able to test our 5G Core applications and orchestration suite on Operator Nexus and address their design goals for efficiency, security, and reliability.”

—Monica Zethzon, Vice President and Head of Solution Area Core Networks, Ericsson

 

“We look forward to building on our support of Operator Nexus with the onboarding of HPE’s network functions in order to give operators the opportunity to drive their next generation of core networks.”

—David Stark, VP Product & Portfolio Management, Hewlett Packard Enterprise

 

“Together with Microsoft, we established and achieved key milestones that give operators confidence to run our cloud-native 5G Core on Operator Nexus, enabling our customers to pursue vital network modernization goals and exciting monetization opportunities.“

—Fran Heeran, SVP, Core Networks, Nokia Cloud and Network Services, Nokia

What’s next: Preview for future releases

Building on the experience that comes from running Operator Nexus for a fully deployed, tier 1 operator network, in the future, we are looking forward to: 

◉ Continuing to expand the Operator Nexus Ready ecosystem to include additional network function providers and new containerized and virtualized network functions, supporting RAN, Packet Core, Transport, and Enterprise services.

◉ Releasing a smaller form factor deployment of Operator Nexus, optimized at both the hardware and software layers, to support the unique needs of the RAN for features such as in-line and look-aside network acceleration. 

◉ Expanding AIOps functionality, integrating the power of Generative AI to improve how networks are designed, deployed, and operated.

Source: microsoft.com

Continue reading

Enhanced Azure Arc integration with Datadog simplifies hybrid and multicloud observability

Businesses today are managing complex, distributed environments and need a ubiquitous computing platform for all workloads that can meet them where they are. We’ve seen an increasing need for customers to not only deploy, manage, and operate across on-premises and one or more clouds, but also to have better visibility and insights across all IT investments spanning cloud to edge.

Today, we’re delivering improved observability and management with the general availability of our enhanced Microsoft Azure Arc integration with Datadog. Building on our established collaboration, we are natively integrating Datadog with Azure Arc to meet customers where they are and provide rich insights from Azure Arc–enabled resources directly into Datadog dashboards. Customers can monitor real-time data during cloud migrations and performance of applications running both in the public cloud and in hybrid or multicloud environments.

Benefits of Azure Arc integration with Datadog

With the Azure Arc integration with Datadog, customers can:

◉ Monitor the connection status and agent version of Azure Arc–enabled servers, wherever they are running.

◉ Automatically add Azure tags to associated hosts in Datadog for additional context.

◉ Identify which Azure Arc–enabled servers have the Datadog Agent installed.

◉ Deploy the Datadog Agent onto your Azure Arc–enabled servers as an extension.

◉ Get unified billing for the Datadog service through Azure subscription invoicing.

Datadog is a cloud-scale monitoring and security platform for large-scale applications that aggregates data across your entire stack with more than 600 integrations for centralized visibility and faster troubleshooting on dynamic architectures. This provides developers and operations teams observability into every layer of their applications on Azure, so they diagnose performance issues quickly.

When Datadog first became an Azure Native ISV Service, it allowed customers to streamline their experience for purchasing, configuring, and managing Datadog directly inside the Azure portal. It reduced the learning curve for using Datadog to monitor the health and performance of your applications in Azure and sets customers up for a successful cloud migration or modernization.

For many customers, hybrid deployments are a durable and long-term strategy due to factors such as latency and compliance requirements, and we are committed to meeting customers wherever they are. With Azure Arc, we provide a consistent set of tools and services for customers to extend cloud technology across your distributed infrastructure. More than 12,000 customers are using Azure Arc, double the number a year ago. By partnering with organizations like Datadog, we are unlocking even more innovation and bringing Azure services into the tools our customers are already using.

Enhanced Azure Arc integration features

Features available with today’s general availability include:

Monitor the Arc connection status and agent version

Customers can easily identify any Azure Arc–enabled resources that are not in a connected state. You can also set up Datadog monitors to alert you immediately if the connection is unhealthy. Before this new integration, Azure Arc resources would look like any other virtual machine on-premises or in Azure. Now, you can access critical metadata to ensure your Azure Arc–enabled Windows and Linux servers, SQL servers, and Kubernetes clusters are secured and connected. IT operators will be able to troubleshoot much faster if a resource is disconnected and can quickly restore the connectivity to Azure Arc.

Datadog can also show which hosts are running an older version of Azure Arc. It then becomes easy to update the agent using Azure Update Management and utilize Azure Automation for latest updates to the Azure Arc agent whenever there is a new version.

Automatically add Azure tags for easy management and compliance tracking

A popular benefit of Azure Arc is using tags in Azure Resource Manager. Many organizations tag on-premises resources by cost center or datacenter server groups that are subject to specific regulations or requirements. Tags also create an audit trail to help trace the history of a particular resource and identify potential security issues when performing audits.

With the Azure Arc integration, Datadog can build rich visualizations and actionable alerts using the tags you have already created for Azure Arc–enabled resources. Now, when you perform patching or updates for Azure Arc–enabled servers, you get much richer insights to help validate software patches and troubleshoot application issues.

Easily identify which Azure Arc–enabled servers have the Datadog Agent

Azure Arc brings your hybrid and multicloud servers, Kubernetes clusters, and data services into a single dashboard for seamless management between environments. Aside from grouping resources with Azure Resource Manager, Azure Arc–enabled resources benefit from Azure role-based access control (RBAC), so different IT and developer teams can easily delegate access to their applications. For a centralized IT monitoring team, you can now ensure your Azure Arc–enabled resources have the Datadog Agent by cross-referencing these servers with agent data to get a real-time view of which Arc resources have Datadog Agent reporting.

Source: microsoft.com

Continue reading

Power hybrid and multicloud environments with Azure Arc data solutions

We know we are in the middle of a transformative time. At the heart of this transformation is the digitization of data. Data is the most strategic asset for organizations across all industries, and a new level of data agility is required to deal with dynamic changes in our world. Organizations that have embraced their data as a strategic asset are at a competitive advantage. In fact, a recent Gartner® Predict report estimates that 90 percent of data management tools and platforms that fail to support multicloud and hybrid capabilities will be set for decommissioning through 2026.

But for all the powerful capabilities the cloud offers to help organizations on their transformation journey, not all data is created equal. The myriad of regulations to navigate, the need for data sovereignty, the low tolerance for any form of disruption keeps data from living in a single public cloud, expanding your data estate and complexity. Managing the vast amounts of data that exists across siloed, disparate systems, applications, and locations, while also getting the most from existing investments is not a balance many solutions can achieve.

This is why, back in November 2019, we debuted Azure Arc, a set of technologies that extends Azure innovations and cloud benefits to any infrastructure. Cloud-native databases like Azure SQL and PostgreSQL have been enabled by Azure Arc, delivering the much-needed consistency and cloud automation for all data workloads. We want you to focus less on managing data, and more on creating value and unlocking insights. Because true innovation starts at the data layer.

Innovate anywhere with Azure Arc

With Azure Arc-enabled data services, we can bring cloud data management to any infrastructure, across customer on-premises data centers, other third-party clouds, and the edge. Here’s how Azure Arc is delivering on that promise:

1. Always up to date with full automation. Benefit from an evergreen SQL with the latest features using automated updates so there is no more end-of-support. Those in-place, rolling updates ensure close to zero downtime, so you can maximize efficiencies and minimize disruptions

2. Get industry-leading, multi-layered security with built-in capabilities. With comprehensive encryption including Transparent Data Encryption and Always Encrypted, as well as Azure Role-Based Access Control and Policy, your data is protected both at the powerful database engine-level and by Azure Security capabilities from the cloud.

3. With elastic scale, you can scale up or down based on your resource needs without application downtime to optimize performance. You can also realize cost efficiencies by paying only for what you use without the need to overprovision.

4. Deliver a vastly simplified DevOps experience through full automation with built-in capabilities like rapid deploy, high availability, and disaster recovery. You can deploy a 3 replica SQL MI with full high availability (HA) in two minutes with a single command, and gain a unified view into your query performance, storage capacity, and error logs using dashboards directly from the built-in monitoring. Use the tools you are already familiar with.

All these capabilities can run in any environment regardless of the connectivity to Azure. You can run Arc-enabled data services without a connection to Azure. If you can be fully connected to Azure, the user experience is richer and in real-time, but it is not required, data services can keep running even without a connection to Azure. Azure portal deployment and other value-added management services are fully integrated under direct connection.

Built for mission-critical

And now, we’re making that solution available in an even more powerful way. We are excited to announce the general availability of Azure Arc-enabled data services Business Critical (BC) tier, designed to support the most demanding mission-critical data workloads.

◉ With feature parity with SQL Server Enterprise Edition, it delivers all the proven capabilities customers have trusted for decades. It runs online transaction processing (OLTP) and hybrid transaction/analytics processing (HTAP) with record-setting performance, advanced high availability, and top-rated security.

◉ It meets the most demanding business continuity requirements using Always On Availability Groups, so your app will have close to zero downtime in case of an automated failover.

◉ Failover to another instance within the same Kubernetes cluster for local high availability, or to a different cluster in a different datacenter or even a public cloud, delivering “cloud-level redundancy”.

◉ We also provide a free passive instance to run in your disaster recovery for even greater value

◉ Choose the configuration that best suits your workloads, with no set limits on CPU and memory configuration. To further maximize the performance, we provide one free read-scale replica to offload any read-heavy workloads.

Our partner, Dell Technologies, conducted a series of OLTP benchmarks, using Intel technology, which took a closer look at the kind of performance possible with this new service tier. The results were remarkable. Arc-enabled SQL Managed Instance was proven to provide the same performance as SQL Server on Windows Server, so customers can run their workloads with confidence. The speed of provisioning and deprovisioning will massively speed up your continuous integration (CI) test runs. SQL instances can now be deployed very easily via automation and be available in 60 seconds, and Business Critical cuts multi-replica HA deployment time from hours or days to minutes with a single command! Those out-of-the-box experiences allow you to realize time efficiencies and redirect resources to where they matter most.

Broad partner ecosystem

Our ambition to help you digitally transform your business with the cloud and edge is boundless, we know we can’t do it alone. No single cloud provider can deliver all the infrastructure and as-a-service solutions you’ll need. That’s why we’re building an ecosystem of partners across service providers, platform providers including OS and Container platforms, and independent software vendors (ISVs) to help you envision, plan, and deploy the full stack of hybrid and multicloud solutions. Our history in both productivity and the datacenter is unique among cloud providers. Microsoft is at our best when our platforms fuel the growth of others, and I’m thrilled to see how energized the ecosystem is to evolve with us.

Source: microsoft.com

Continue reading

Bring cloud experiences to data workloads anywhere with Azure SQL enabled by Azure Arc

From edge to cloud, companies are eager to find innovative solutions that meet them where they are. Today’s business environment is increasingly complex, and customers tell us they need solutions that are multi-cloud, platform-agnostic, and offer integrated apps and services that are always up to date. We’ve seen firsthand the best solution combines a company’s existing infrastructure with the simple, distributed computing power of the cloud. Our unique approach to hybrid gives businesses choice and flexibility in managing their entire data estate while complying with data sovereignty, regulation, and latency requirements.

Read More: AZ-600: Configuring and Operating a Hybrid Cloud with Microsoft Azure Stack

Tune in to the Azure Hybrid and Multi-cloud Digital Event from 9:00 – 11:00 AM Pacific Time to learn more about the latest announcements about Azure Arc-enabled data services. And today, we’re announcing the general availability of Azure SQL enabled by Azure Arc to help customers manage their data and databases simply and efficiently. Customers can deploy cloud services on-premises and in multi-cloud environments—effectively modernizing in place by running Azure SQL on any infrastructure.

Cloud solutions that simplify the most complex hybrid data scenarios

Deploying cloud-based solutions to on-premises and multi-cloud environments helps deliver consistent, portable, and unified management across a company’s entire data estate. Our customers are seeing improved productivity and operating efficiency by using hybrid technology to manage their data and app development at scale.

For example, SKF provides reliable rotation to industries all over the world, offering products and services around the rotating shaft including bearings, seals, lubrication management, artificial intelligence, and wireless condition monitoring. SKF has been on a journey to digitally transform the company’s backbone through harnessing the power of technology, interconnecting processes, streamlining operations, and delivering industry-leading digital products and services for customers. SKF uses Azure Arc, along with Azure Stack HCI and Azure SQL Edge, to scale solutions and standardize processes across their 91 manufacturing sites, resulting in 40 percent savings on hardware costs and 30 percent savings in OT-related machine downtime.

“SKF’s focus is on digitalizing all segments of the value chain and interconnecting them to unlock the full potential of digital ways of working for our business and customers. Azure Arc-enabled SQL Managed Instance is providing us worry-free and always up-to-date SQL operations. These types of services provide us a tremendous jumpstart into digitalization.”—Sven Vollbehr, Head of Digital Manufacturing, SKF

The “anywhere” solution for hybrid cloud applications

Beginning July 30, 2021, the general-purpose tier of Azure Arc-enabled SQL Managed Instance will be generally available, providing database-as-a-service (DBaaS) functionality on any infrastructure. Businesses will be able to deploy Azure SQL databases on any infrastructure and on any Kubernetes to:

◉ Stay current with automated updates and deploy evergreen feature and security updates to on-prem databases with no end-of-support.

◉ Automate routine database administrator (DBA) tasks at scale with built-in management capabilities including high availability, backup, and restore.

◉ Optimize data workload performance by bringing cloud elasticity on-premises for existing infrastructure, using only the resources needed to dynamically scale up, down, without application downtime.

◉ Access Azure industry-leading security and governance capabilities for your on-premises data workloads using to protect your data.

New product features and capabilities will be rolled out on a continuous basis, and customers will be able to opt-in to preview additional Azure Arc-enabled services, such as PostgreSQL, and easily integrate as they become generally available. Additionally, customers will have the opportunity to test out future road map preview features and provide early feedback.

Develop breakthrough applications with our network of trusted partners

In support of Azure Arc-enabled data services' general availability, we are announcing an expanded network of trusted partners and validated solutions to help customers get started.

Our team works closely with technology providers to validate popular platforms to work with Azure Arc, and our many service providers are here to provide customers with the latest innovations for hybrid data solutions on-premises or in multi-cloud environments.

Whether you are just getting started with migration and modernization efforts or in the middle of a multi-year digital transformation, our consulting services partners can help you choose the validated infrastructures and applications that are specifically configured and tested to work with Azure Arc.

Source: microsoft.com

Continue reading

New Azure capabilities to simplify deployment and management

Customers around the world take advantage of Microsoft Azure to build, deploy, and manage business-critical applications at scale. We continuously innovate to help customers simplify their app deployment and management experience so they can spend more time building great solutions.

Simplify your declarative deployment experience in Azure with Bicep

With developers depending heavily on cloud infrastructure to run the apps they create, we continuously strive to simplify the infrastructure setup experience so they can stay focused on the actual innovation and experiences they are crafting within their apps. Azure Resource Manager (ARM) templates are extremely powerful; however, they can be complex. Bicep, an open-source, domain-specific language (DSL), further simplifies developers’ declarative deployment experience in Azure. Bicep makes it much easier to both read and write infrastructure-as-code in Azure.

More Info: MB-500: Microsoft Dynamics 365 - Finance and Operations Apps Developer

Bicep allows customers to deploy Azure resources with many of the conveniences of modern programming languages—now indispensable to any app developer’s workflow. It supports first-class tooling with Visual Studio Code integration and has features such as type safety, modularity, and concise, readable syntax. Bicep is a transparent abstraction over ARM templates, which means everything you can do in ARM templates, you can do in Bicep. It also means that all Azure resource types are supported as soon as they are released, and there are no state files required. Since its v0.3 release in March, Bicep has been production-ready and supported by Microsoft Support plans.

With Bicep v0.4 available June 2, 2021, developers can enjoy better day-to-day authoring as well as overall quality and improved stability, with the following additional capabilities:

◉ A Bicep linter to catch a customizable set of authoring best practices. The linter is designed to be extensible so new rules can continue to be added over time by either the Bicep team or the community.

◉ Integration of new resource snippets as well as a “resource scaffolding” capability. Scaffolding will insert all required properties of any resource type to help you declare resources faster—even from scratch.

◉ Transition all our Bicep examples to the ARM Template QuickStart GitHub repo, giving us a richer testing suite to ensure Bicep examples are of the highest possible quality.

Save time by using Elastic natively, right in the Azure portal

Our customers run large-scale mission-critical workloads with Linux and open source services on Azure. However, for these organizations’ developers, it is important to prioritize their focus on building amazing apps, not infrastructure management and maintenance—which can require technical knowledge and expertise in both specific services and Azure infrastructure overall. That’s why we partnered with Elastic, the company behind Elasticsearch, Kibana and Logstash, to reduce operational complexity by rolling out a native Azure experience.

Now in preview, you can find, deploy, and manage Elastic from within the Azure portal and start connecting your app and the Azure services you use with just a few clicks. The integration allows you to add powerful search and visualization capabilities to find information, monitor applications and workloads, and protect it all within your own Azure environment—while being able to gain the technical support from Elastic to help you troubleshoot. Additionally, billing management is also simplified and integrated with your Azure bill.

Increase efficiency and onboard more easily with additional Azure Monitor capabilities

Many customers use Azure Monitor to track the health of their applications, diagnose issues, optimize performance, and create an efficient environment from coding to shipping. The following capabilities in Azure Monitor provide customers with greater flexibility, improved sharing, and end-to-end diagnostics to make managing Azure resources easier across the board:

◉ Azure Monitor Agent and data collection rules, in preview, greatly simplify the customer experience as well as improving flexibility when collecting logs and metrics from managed resources. In addition, as part of the agent, there is multi-homing on Linux and Windows and event filtering. And coming soon are new capabilities, part of general availability, that includes support for private links and direct proxies for advance networking scenarios.

◉ The ability to create and share query packs of log analytics queries within your organization, now in preview, allows for easier collaboration between teams.

◉ Enhanced out-of-the-box observability for your cloud resources, with auto instrumentation of more app types, is now in preview. You can now automatically onboard Java apps on both Linux and Windows App Services to application insights without making any code changes, providing easy access to application performance monitoring for app diagnostics and optimization.

Source: microsoft.com

Continue reading

Microsoft acquires Kinvolk to accelerate container-optimized innovation

The ability to run Kubernetes anywhere, whether in the cloud or on-premises, has been a high priority for Azure customers looking to rapidly innovate, with increasing customer focus on the benefits of container-optimized workloads and operating systems, lean application modernization, easier operations, and platform resiliency.

To support this rapid evolution, we’re announcing that Microsoft has acquired Kinvolk GmbH.

Kinvolk’s founding mission statement is “to build and promote an enterprise-grade open cloud-native stack”—we think this fits perfectly with our growing customer needs and our ongoing investments in open source and Kubernetes.

Kinvolk has a rich, innovative history in open source cloud-native distributed computing, including Kubernetes, eBPF, community building, and container-optimized Linux, as well as critical early work with CoreOS (the company) on the rkt container runtime. Kinvolk ultimately went on to create Flatcar Container Linux, a popular alternative to CoreOS Container Linux, as well as the Lokomotive and Inspektor Gadget projects.

Microsoft is excited to bring the expertise of the Kinvolk team to Azure, where they will be key contributors to the engineering development of Azure Kubernetes Service (AKS), Azure Arc, and future projects that will expand Azure’s hybrid container platform capabilities and increase Microsoft’s upstream open source contributions in the Kubernetes and container space. Stay tuned for more technical details soon.

Building with open source communities

In addition, Microsoft respects and wants to learn from the Kinvolk team’s great track record in starting, building, and nurturing open source community projects, and Microsoft is committed to maintaining and building upon Kinvolk’s open source culture. The Kinvolk team will remain active in their existing open source projects and will be essential to driving further collaboration between Azure engineering teams and the larger open source container community.

Flatcar Container Linux has a sizeable community of users on Azure, as well as other clouds, and on-premises. We know the CoreOS community has been on a winding journey over the years—we want to assure the Flatcar community that Microsoft and the Kinvolk team will continue to collaborate with the larger Flatcar community on the evolution of Flatcar Container Linux. Microsoft is committed to Flatcar Container Linux community development and will invest in working with the Flatcar community to create a growth path forward together. We’ll have our first meeting with the community within the coming weeks and invite anyone interested to attend and join the conversation.

We’re excited to bring the Kinvolk team and their technologies to Microsoft and look forward to the contributions they bring to Azure, our customers, and the open source community.

Source: microsoft.com

Continue reading

Future-proof your network with Azure for Operators

Increasing competition and ever-growing demand for mobile, always-on services challenges operators to find new strategies to grow profits and gain a competitive edge. To succeed, operators also need to embrace three critical trends:

◉ Changing the economics of their service model.

◉ Finding new revenue and shareholder value with 5G.

◉ Driving digital transformation, consolidation, and automation.

To address these trends, operators are actively seeking ways to transform their infrastructure, embrace 5G, and evolve their business.

To support operators in capitalizing on this opportunity, we launched the Azure for Operators initiative in September 2020, acting as a trusted partner to provide cloud and edge computing technology and solutions. We are building a platform on the foundation of a carrier-grade cloud and enhanced networking to bring the power of Microsoft's technology to the operator's edge. When these capabilities are combined with our broad developer ecosystem and deep business-to-business partnership programs, the result is a unique environment that will help operators accelerate their ability to monetize their network capabilities. 

The advent of 5G technology offers network operators unprecedented opportunities to expand their scale and range of services to enterprise customers in particular. Beyond faster data services for smartphones and 5G networks, other emerging technologies will deliver capabilities that can support critical business operations while enabling high-speed, low-latency communications, and connectivity for intelligent devices. Successfully seizing this opportunity requires operators to complement their networks with cloud and edge computing.

Microsoft can uniquely provide operators with technology and cloud solutions to realize the opportunities of a new service model, adoption of 5G, and digital transformation.

Our guiding principles

Azure for Operators is built on six fundamental principles:

1. We are bringing the power of cloud to future-proof your network, driving down costs and opening new revenue streams.

2. We will partner—you own your customers, brand, ideation, and experiences.

3. We remain a platform business—our focus is on moving workloads to a carrier-grade cloud.

4. We will meet you where you are—on-premises, at the edge, or in the cloud.

5. Support the ecosystem—we will work closely with providers of radio access network (RAN), core, cloud-native functions (CNFs), and operations support systems (OSS) or business support systems (BSS) to integrate and innovate.

6. It is a journey—we will act as a trusted partner to help you transform at a pace that makes sense for your business.

We join operators on a shared journey, meeting them wherever they are on their digital transformation path. Together, we can unlock the potential of 5G, enabling operators to offer a range of new services such as highly reliable low-latency connectivity, network slicing, and scalable applications to transform industries and communities. Indeed, our partnering with operators is key to connecting the intelligent edge with the intelligent cloud and to creating new transformative experiences for people and organizations everywhere, across every industry.

How 5G will transform experiences and services

We see a convergence of the virtual and physical world as modern networking capabilities are combined with cloud technologies. We will help enable operators to deliver pervasive compute, real-time action, and infinite customer experiences.

There are a myriad of opportunities for innovation across industries, most notably in manufacturing, agriculture, healthcare, transportation, workplace productivity, and retail. Scenarios for 5G include:

◉ Maximizing the value of the edge.

◉ Deploying and optimizing next-gen networks.

◉ Monetizing the capabilities of 5G.

◉ Maximizing existing investments while minimizing operating expenses.

◉ Streamlining business support systems.

◉ Transforming customer experiences.

To bring these scenarios to life, Microsoft has an established and experienced developer community that is well-versed in building solutions in the Azure environment and the experience that comes from processing more than five billion cognitive services transactions per month, supporting over six billion IoT devices, and supporting more than one million machine learning experiments monthly. Microsoft is actively working with the application community to ensure a thriving ecosystem for edge applications and network application programming interfaces (APIs). 

New technology capabilities

The industry standardization of service-based architecture exemplifies how 5G will be more “cloudified” than any previous mobile technology generation. Beyond running 5G network functions in the cloud, there are more significant opportunities when networks are integrated with hyper-scale cloud services such as artifcal intelligence (AI), machine learning, security, analytics, and IoT processing. When combined with ubiquitous compute and opened to a large community of application developers, new capabilities for enterprises and end-customer experiences will emerge. Azure for Operators makes real the promise of analyzing and acting in near-real-time―a true fusion of the physical and virtual worlds.

Low-latency compute through Azure Edge Zones

We have established local extensions of Azure to provide compute, containers, and services closer to customers. Azure Edge Zones allow local, low-latency access to Azure services for immediate data ingestion and strong processing power. Operators can connect to a fast, global backbone as all data transit between the Edge Zones and Azure regions remain on the Microsoft global network. Additionally, operators can provision and manage these edge services and workloads through the Azure portal.

Direct application access to the programmable network

With Azure for Operators, Microsoft is partnering with operators worldwide to create an ecosystem of application-aware, edge solutions.  Developers can boost application performance and provide the best and most secure user experience when they access critical data from the network.  Additionally, fast and scalable applications for mobile subscriber services and connected devices can run across Azure and operator networks. We have established a single pane of glass to provision and manage Azure services at the edge, further enhancing the ease of management and scalability for application access.

Private cellular networks with the power of the cloud

By fusing cloud compute with multi-access edge computing (MEC), Arc-enabled Azure Edge Zones are our architecture to accomplish improved latency, speed, and security. Leveraging a private cellular network, industrially focused solutions such as robotics and IoT can enjoy the best of the cloud with the required network privacy. Customers can deploy Virtualized Network Functions such as routers, firewalls, and software-defined wide area network (SD-WAN) gateways across Azure Edge Zones and regions. This architecture has broad industry support from a rich ecosystem of implementation and integrated technology partners already available for collaboration.

Meeting the needs of operators

Microsoft recognizes that operators have unique requirements for reliability, resiliency, security, observability, and performance to deliver real-time communications services. Operators need control over critical network functions and want the ability to expose programmable interfaces to application developers. By adopting Azure for Operators, they are enabled to create new revenue-generating services and move existing services to the cloud to reduce costs and extend service life with a trusted cloud partner.

Azure for Operators service stack

Azure for Operators is available as a service stack, including global transport, edge platforms, network functions, business intelligence, and cloud solutions. Elements can also be selected individually and include products and solutions from Microsoft and our ecosystem partners. We are committed to supporting the ecosystem by working closely with RAN, Core, CNF, and OSS or BSS providers to integrate and innovate.

Moving forward in our journey together

Ultimately, Azure for Operators is about your customer, your service, powered by our technology. We are combining our understanding of networking and compute with our partner ecosystem to enable endless opportunities. With Microsoft, you can achieve scale, operate hybrid seamlessly, monetize with new business models and do all of this with a trusted partner.

With our hybrid cloud platform, a broad selection of cloud services, and ecosystem of partners plus application developers, we help operators generate new revenue streams from their significant investments in 5G networks while extending the useful lifespan of existing services. Working together in partnership, Microsoft and operators can combine the best of both the cloud and Telco worlds to seize the 5G opportunity and address the many challenges of today's operator business. We will act as a trusted partner to help you transform at a pace that makes sense for your business.

Source: microsoft.com

Continue reading

Hybrid and multicloud strategies for financial services organizations

A need for hybrid and multicloud strategies for financial services

The financial services industry is a dynamic space that is constantly testing and pushing novel use cases of information technology. Many of its members must balance immense demands—from the pressures to unlock continuous innovation in a landscape with cloud-native entrants, to responding to unexpected surges in demand and extend services to new regions—all while managing risk and combatting financial crime.

At the same time, financial regulations are also constantly evolving. In the face of the current pandemic, we have seen our customers accelerate in their adoption of new technologies, including public cloud services, to keep up with evolving regulations and industry demands. Hand in hand with growing cloud adoption, we’ve also seen growing regulatory concerns over concentration risk (check out our recent whitepaper on this), which have resulted in new recommendations for customers to increase their overall operational resiliency, address vendor lock-in risks and require effective exit plans.

Further complicating matters, many financial services firms oversee portfolios of services that include legacy apps that have been in use for many years. These apps often cannot support the implementation newer capabilities that can accommodate mobile application support, business intelligence, and other new service capabilities, and suffer from shortcomings that adversely affect their resiliency, such as having outdated and manual processes for governance, updates, and security processes. These legacy applications also have high vendor lock-in because they lack modern interoperability and portability. Furthermore, the blunt force approach of leveraging legacy technology as a means for protecting against financial crime is an unsustainable strategy with diminishing returns—with big banks spending over $1 billion per year maintaining legacy infrastructure and seeing a rise in false positive rates as financial crime evolves in sophistication.

As a means to address the demands of modernization, competition, and compliance, financial services organizations have turned to public cloud, hybrid cloud and multi-cloud strategies. A hybrid model enables existing applications—which originally exist on-premises—to be extended by connecting to the public cloud. This infrastructure framework unleashes the benefits of the public cloud—such as scale, speed, and elastic compute, without requiring organizations to rearchitect entire applications. This approach provides organizations the flexibility to decide what parts of an application should reside in an existing datacenter versus in the public cloud, as such providing them with a consistent and flexible approach to developing a modernization strategy.

Additional benefits of successful hybrid cloud strategies include:

◉ A unified, consistent approach for infrastructure management: Consistently manage, secure and govern IT resources across on-premises, multicloud and the edge, delivering a consistent experience across locations.

◉ Extending geographic reach and openings new markets: Meet the growing global demand and extend into new markets by extending the capabilities of datacenters to new locations – while also meeting data localization requirements from local markets

◉ Managing security and increasing regulatory compliance: Hybrid and multicloud are great alternatives for strictly on-premises strategies due to cloud benefits around service security, availability, resiliency, data protection and data portability. These strategies are often referenced as a preferred way of reducing risk and addressing regulatory compliance challenges.

◉ Increasing Elasticity: Customers can respond with agility to surges in demand or transaction by provisioning and de-provisioning capacity as needed. A hybrid strategy allows organizations to seamlessly scale their capacity beyond their datacenter during high-compute scenarios, such as risk computations and complex risk modeling, without over exhausting servers or slowing down customer interactions.

◉ Reducing CapEx Expenses: The cloud makes the need for such a large capital outlay for managing on-premises infrastructure unnecessary. Through the benefits of elastic capacity in hybrid scenarios, companies can avoid the costs of unused digital capacity, paying only for the resources that are consumed.

◉ Accelerate time to market: A hybrid strategy provides a bridge that connects on-premises data to new cloud-based capabilities across AI and advanced analytics, allowing customers to modernize their services and unlock innovation. With virtualized environments, they can accelerate testing and evaluations cycles and enable deployment seamlessly across different locations.

A multicloud strategy enables customers to leverage services that span different cloud platforms, enabling them to select the services best suited to the workloads or apps they are managing.

Commonly cited benefits of a multicloud strategy include:

◉ Flexibility: Customers wish to have the flexibility to optimize their architectures leveraging the cloud services best suited to their specific needs, including the flexibility to select services based on features or costs

◉ Avoiding vendor lock-in: A common requirement customers often state, customers often seek design multi-cloud deployments to achieve short term flexibility and long-term agility by designing systems across multiple clouds.

Microsoft hybrid and multicloud edge for financial services organizations

Azure hybrid capabilities uniquely address some of the main barriers customers face around hybrid and multicloud strategies. Managing multiple environments is an endeavor that introduces inherent complexity and risk for firms, faced with an expanding data estate that spans diverse on-premises, public cloud(s), and edge environments. Optimizing for productivity without sacrificing security and compliance can be daunting. Azure provides a seamless environment for developing, deploying and managing data and applications across all distributed locations.

For one, Azure uniquely supports the full range of hybrid capabilities across DevOps, Identity, Security, Management, and Data. Given that customer IT estates involve much more than containers, many of our cloud benefits are also available to server-based workloads. Azure enables customers to manage both Windows and Linux servers across their data estate and customers can also manage access and user authentication with hybrid identity services. The Azure Stack portfolio extends Azure services and capabilities to your environment of choice—from the datacenter to edge locations and remote offices and disconnected environments. Customers can run machine learning models on the edge, in order to get quick results before data is sent to the cloud. Furthermore, with capabilities such a Azure Stack Hub, our portfolio enables organizations to operate in offline environments that block data from being sent to the public cloud, especially if required for regulatory compliance.

Second, Azure simplifies the experience of managing a complex data estate by providing a unified, consistent approach for managing and monitoring their hybrid or multicloud environments. With capabilities such as Azure Arc, can manage their data estate with a single management plane—including the capability to monitor non-Microsoft clouds. Customers can also take a similarly simplified approach to managing security across their estate with services such as Azure Sentinel, which provides a consistent threat detection and security analytics view across on-premises, cloud and edge devices. In combination with services such as Azure Security Center, Azure policy, and Azure advisor, customers can also design, deploy, and oversee security and compliance of their deployments across their hybrid and multicloud environments.

Azure leadership in hybrid and multicloud offerings is also rooted in our extensive collaborations with hardware partners (OEMs), which whom we have partnered and co-engineered solutions to deliver a well-defined variety of supporting devices. Partner solutions have been designed with the aim in mind to increase resiliency and expand the reach of virtual data centers. With the new rugged series of Azure Stack Edge for instance, we provide cloud capabilities in the harshest environment conditions supporting scenarios such as tactical edge, humanitarian and emergency response efforts.

The Azure commitment to financial services customers stems from Microsoft industry-leading work with regulators around the world. Our customers require their cloud partners to support transparency, regulatory right to audit, and self-reporting. To enable this, we have a dedicated and comprehensive FSI compliance program available to customers and help customers manage their compliance by enabling choices around data location, transparency and notification of subcontractors, providing commitments on exit planning (see our recent blog here), as well as tools to aid in risk assessments.

Customer spotlights

We’ve seen many of our financial services customers begin to realize the benefits of hybrid and multicloud strategies already. In a recent Total Economic Impact study commissioned with Forrester on the impact of shifting from on-premises to Azure IaaS (including to hybrid environments), over a three year period, organizations avoided 90 percent of on-premises infrastructure costs (valued at over $7 million), as well as associated employee costs. Organizations were able to reallocate their IT staff to higher level business initiatives, including ventures of expansion into new markets, which resulted in altogether new streams of income for the companies.

One example of a company that took a hybrid approach was Banco de Crédito e Inversiones (BCI). Their portfolio supported 20 million transactions a month and required a hybrid approach in order to keep apps and resources on-premises for regulatory and performance reasons. With Azure Stack Hub, they were able to improve the performance and reliability of their systems, and even rolled out new products quickly. They were able to switch from outsourced IT management to in-house management.

“We’ve found the whole Azure platform to be very reliable and stable, and it gets better with each release. In fact, we have statistics showing that when we enabled Azure Stack Hub, customer satisfaction went up. It’s very clear. We’re delivering a better experience for our customers through the reliability and performance of Azure Stack Hub and the new functionality our team is building on top of it.”—German Matosas, Head of Architecture and Cloud Platform, BCI

Another example is Volkswagen Financial Services, a branch of VW that manages approximately 80 web apps across ten countries—a complex IT estate by any measure. They needed to modernize their apps and development approach and leveraged Azure Stack Hub to bring cloud speed and scale to their DevOps practices. This strategy also allowed them to maintain components of their highly customized apps on-premises (such as core databases and SAP systems), due to privacy and compliance requirements. This also enabled them to add new services without needing to rework their existing applications.

What about full or single cloud?

While the focus of this blogpost has been hybrid and multicloud strategies, it is also worth briefly touching on the value of partnering with a single cloud provider to provide end-to-end solutions. This is referred to as a “full cloud” or "single cloud” strategy and serves the long-term objective of shutting down all on-premises data centers and moving all workloads to a single cloud provider. This strategy also has its merits and in fact may offer benefits over both hybrid and multicloud solutions, such as offering simplified management, less complexity, and lower total cost of ownership (TCO). Partnering with a highly resilient CSP, such as Microsoft, for a full cloud strategy, has been the solution of choice for several financial institutions. The unique benefits of a full cloud strategy need to be weighed against potential downsides, but in principle, this approach is allowed by regulators in most global jurisdictions.

Deciding on a hybrid or multicloud strategy

Many organizations commence their journey from a fully on-premises baseline. We’ve seen that as they start to consume public cloud services, questions arise around what the most appropriate deployment strategy could be—whether they should take a full cloud, hybrid cloud, or multicloud approach.

If you respond positively to one or more of the questions below you are likely in a good position for using hybrid or multicloud strategies:

1. Does your organization’s digital strategy enable your organization to easily adopt new and emerging technologies and deploy them to on-premises or legacy apps? 

2. Does your organization have a digital strategy that welcomes innovation but is not ready to fully commit to a public cloud?

3. Do you find it challenging to meet capacity demands in your IT infrastructure and meet unexpected surges in demand or maintain performance levels?

4. Does your IT department struggle to manage different technologies from different providers and keep oversight across multiple environments?

5. Does your organization face pressure from regulators or risk departments to maintain certain processes on-premise, or within specific geographic regions (data residency)?

6. Is your organization considering expanding into new geographies or new markets?

Source: microsoft.com

Continue reading