Scalable management of virtualized RAN with Kubernetes

Among the many important reasons why telecommunication companies should be attracted to Microsoft Azure are our network and system management tools. Azure has invested many intellectual and engineering cycles in the development of a sophisticated, robust framework that manages millions of servers and several hundred thousand network elements distributed in over one hundred and forty countries around the world. We have built tools and expertise to maintain these systems, use AI to predict problem areas and solve them before they become issues, and provide transparency in the performance and efficiency of a very large and complicated system.

At Microsoft, we believe these tools and expertise can be repurposed to manage and optimize telecommunication infrastructure as well. This is because the evolving infrastructure for telecommunication operators includes elements of edge and cloud computing that lend themselves well to global management. In this article, I will describe some of the more interesting technologies that fit into the management of a cloud-based telecommunications infrastructure.

Up and running in just a few clicks

If you want to set up a 5G cellular site, there are a few key requirements. After gathering and interconnecting your hardware (servers, network switches, cables, power supplies, and other components), you then plug in your edge server machines to power and networking outlets. Each machine will be accessible via a standards-based board management controller (BMC) that usually runs a lightweight operating system, Linux, for example, to remotely manage the machine via the network.

When powered up, the BMC will obtain an IP address, most likely from a networked DHCP server. Next, an Azure VPN Gateway will be instantiated—this is a Microsoft Azure-managed service that is deployed into an Azure Virtual Network (VNet), and provides the endpoint for VPN connectivity for point-to-site VPNs, site-to-site VPNs, and Azure ExpressRoute. This gateway is the connection point into Azure from either the on-premises network (site-to-site) or the client machine (point-to-site). Using private VNet peering allows Azure to talk to the BMC on each machine.

Once this is working, the network operator can enable scripts that talk to the BMC via Azure to run automatically and can install the basic input/output system (BIOS) and proper software operating system (OS) images on the machine. Once these edge machines have an OS, a Kubernetes (K8s) cluster can be created, encompassing multiple machines by using tools such as Kubeadm. The K8s cluster is connected to Microsoft Azure Arc so that workloads can be scheduled onto the cluster using Azure APIs.

Management via Azure Arc

Microsoft Azure Arc is a set of technologies that extend Azure management to any infrastructure, enabling the deployment of Azure data services anywhere. Specifically, Azure management can be extended to Linux and Windows physical and virtual servers, and to K8s clusters so Azure data services can run on any K8s infrastructure. In this way, Azure Arc provides a unified management experience across the entire telecommunications infrastructure estate, whether it’s on-premises, in a public cloud, or in multiple public clouds.

This creates a single pane view and automation control plane of its heterogeneous environments, as well as the ability to govern and manage all these resources in a consistent way. Microsoft Azure portal, role-based access control, resource groups, search, and services like Azure Monitor and Microsoft Sentinel are also enabled. Security for next-generation networks, like the ones telecommunications operators are lighting up, is a topic I recently wrote about.

For developers, this unified framework delivers the freedom to use the tools they are familiar with while focusing more on the business logic in their applications. Microsoft Arc along with other existing and new Microsoft technologies and services forms the basis of our Azure Operator Distributed Services which will bring a carrier-grade hybrid cloud service to the market.

However, running radio access network (RAN) functions on a vanilla Arc-connected Kubernetes cluster is difficult. It requires manual and vendor-specific tuning, resource management, and monitoring capabilities, making it difficult to deploy across servers with different specs and to scale as more virtual RAN (vRAN) deployments come up. Therefore, in addition to Microsoft Azure Arc and Azure Operator Distributed Services, we have developed the Kubernetes for Operator RAN (KfOR) framework, which provides extensions that are installed on top of vanilla K8s clusters to specifically enhance the deployment, management, and monitoring of RAN workloads on the cluster. These are the essential components necessary for lighting up the automatic management and self-healing properties of next-generation telecommunication cloud networks, creating an edge platform that turns the vRAN into yet another cloud-managed application.

Kubernetes for Operator RAN (KfOR) extensions for virtualized RAN

To optimally utilize edge server resources and provide reliability, telecommunication RAN network functions (NFs) typically run in containers within a server cluster, utilizing K8s for container orchestration. Although Kubernetes allows us to take advantage of a rich ecosystem of components, there are several challenges related to running high service-level agreements, high-performance, and latency-sensitive RAN NFs in edge datacenters.

For example, RAN NFs run close to the cell tower in the far-edge, which in many cases is owned by the telecommunications operator. Performance requirements for high availability, high performance, and low latency needed by vRAN necessitate the use of single root I/O virtualization(SR-IOV) working with a data plane development kit (DPDK), programmable switches, accelerators, and custom workload lifecycle controllers. This is well beyond what standard K8s offer.

To address these challenges, we have developed KfOR, which patches this hole and enables end-to-end deployment, RAN management, monitoring, and analytics experience through Azure.

The figure shows how the various components of Azure and Kubernetes (blue) and those developed by the Azure for Operators team (green) fit together. Specifically, it shows the use of an Azure Resource Provider (RP) and an Azure Managed App, which allows the spin-up of a Management Azure Kubernetes Service (AKS) cluster on Azure. This control-plane management cluster can then utilize open source and in-house developed components to deploy and manage the edge cluster (the Azure Arc–enabled Kubernetes workload cluster).

The control plane manages both the provisioning of the bare-metal nodes on the workload cluster, as well as the Kubernetes components running on these nodes. Within the workload cluster, KfOR provides custom Kubernetes extensions to simplify the development, deployment, management, and monitoring of multi-vendor NFs. KfOR utilizes extension points available in Kubernetes such as custom controllers, DaemonSets, mutating webhooks, and custom runtime hooks. Here are some examples of its capabilities:

◉ Container suspension capability. KfOR can create pods that have containers that start in a suspended state but can be automatically activated in the future. This capability can be used for creating "warm standbys," which means these pods can immediately replace active pods that unfortunately fail, reducing downtime from several seconds to under one. In addition, this feature can also be used to ensure that pods launch in a predetermined order by specifying pod dependencies. vRAN workloads have some pods that require another pod to have reached a particular state prior to launching.

◉ Advanced Kubernetes networking stack. KfOR provides an advanced networking library using DPDK and a method to auto-inject this library into any pod using a sidecar container. KfOR also provides a mechanism to autoload this library ahead of the standard sockets library. This allows for code written using standard User Datagram Protocol sockets to achieve microsecond latency using DPDK underneath, without modifying a single line of code.

◉ Cloud-native user-space eBPF codelets. Extended Berkeley packet filter (eBPF) is used to extend the capabilities of the kernel safely and efficiently without requiring changing the kernel source code or loading kernel modules. KfOR provides a mechanism to submit user-space eBPF codelets to the K8s cluster, as well as a method for insertion of these codelets by using K8s pod annotations. The codelets attach dynamically to hook points in running code in the network functions and can be used for monitoring and analytics.

◉ Advanced scheduling and management of cluster resources. KfOR provides a K8s device plugin that allows for the scheduling and usage of isolated CPU cores as a resource separate from standard CPU cores. This enables RAN workloads to run on a K8s cluster with no manual configuration, such as pinning threads to predefined cores. KfOR also provides a custom runtime hook to isolate resources so containers cannot use CPUs, network interface controllers, or accelerators that have not been assigned to them.

With these capabilities, we have accomplished one-click deployment of RAN workloads as well as real-time workload migration and defragmentation. As a result, KfOR is able to shut off unused nodes to save energy. KfOR is also able to properly configure programmable switches that are used to route traffic from one server to the next. Furthermore, with KfOR, we can deliver fine-grain RAN analytics, which will be discussed in a future blog.

KfOR goes beyond simple automation. It turns the far-edge into a true platform that treats the vRAN as yet another app that you can install, uninstall, and swap easily with a simple click of a button. It provides APIs and abstractions that allow vRAN vendors to fine-tune their functions for real-time performance without needing to know the details of the bare metal. This is in contrast to existing vRAN solutions that even though virtualized, still treat the vRAN as an appliance, which needs to be manually tuned and is not easily portable across servers with even slightly different configurations.

Deployment of KfOR extensions is completed by using the management cluster to launch the add-ons on the workload cluster. KfOR capabilities can be used by any K8s deployment by simply adding annotations to the workload manifest.

Robust stress-free RAN management

What I have described here is how the full power of preexisting cloud management tools along with the new KfOR technology can be put together to manage, monitor, automate, and orchestrate the near-edge and far-edge machines and software deployed within the emerging telecommunications infrastructure. Once the hardware and network are available, these capabilities can light up a cell site impressively quickly, without any pain, and without requiring deep expertise. KfOR, developed specifically for virtual RAN management, has significant built-in value for our customers. It enables Azure to plug in artificial intelligence for sophisticated automation along with tried-and-true technologies needed for self-managing and self-healing networks. Overall, it creates a differentiation of our offering in the telecommunications and enterprise markets.

Source: microsoft.com

Continue reading

Find the clarity and guidance you need to realize cloud value

A modernized cloud workload offers significant benefits—including cost savings, optimized security and management, and opportunities for ongoing innovation. But the process of migrating and modernizing workloads can be challenging. That’s why it’s essential to prepare and plan ahead—and to ensure that your organization finds continued value in the cloud.

Whether you’re just starting your move to the cloud or are looking for ways to optimize your current cloud workloads, my team and I are committed to helping you maximize your cloud investments, overcome technical barriers, adopt new business processes, develop your team’s skills, and achieve sustainable innovation in the cloud. That’s why we invite you to watch sessions from Realizing Success in the Cloud—now available on-demand.

At this digital event, attendees learned about the key components of a successful cloud adoption journey. They heard Microsoft leaders, industry experts, and Azure customers discuss ways to drive value with migration and modernization. They also discovered best practices for boosting adoption across organizations and enabling sustainable innovation in the long term.

Check out these session highlights, which cover three critical areas of the cloud journey:

1. Optimize your business value in the cloud

In the early phases of any new cloud project, it’s essential that you define strategy, understand motivations, and identify business outcomes. Maybe you’re looking to optimize your cost investment and reduce technical debt. Or maybe adoption might enable your team to build new technical capabilities and products. Whether you’re looking to migrate, modernize, or innovate in the cloud, you’ll want to build a business case that sets your organization up for success—and we’ll show you how to put one together.

With the help of Jeremy Winter, Azure VP of Program Management, you’ll explore the process using key technical and financial guidelines. In this session, you’ll discover templates, assessments, and tools for estimating your cloud costs, managing spending, and maximizing the overall value you get from Azure. You’ll also hear how the cloud experts at Insight, a Microsoft technology partner, use Azure enablement resources to help their clients realize savings.

2. Customize your Azure journey

Your organization’s business, security, and industry requirements are unique, which is why you’ll need to develop a tailored plan that will help you successfully execute your vision—and ensure that your deployment and operations needs are being met. That’s why it’s important to understand when to adhere to the best practices of your cloud vendor—and when to customize your journey—with guidance from the experts.

In the session led by Uli Homann, Microsoft VP of Cloud and AI, you’ll learn how to set up scalable, modular cloud environments using Azure landing zones. As you prepare for post-deployment, you’ll find out how to evaluate the cost efficiency, performance, reliability, and security of your workload performance using recommendations from the Azure Well-Architected Framework and Azure Advisor. Uli also speaks with NHS Digital, the technology partner for the UK’s public healthcare system, to discuss how they built a responsive system architecture that could scale and perform under unprecedented demand.

3. Accelerate success with Azure skills training

Whether you’re migrating to the cloud or building a cloud-native app, the skills of your team are key to enabling successful business outcomes. Azure skills training fosters a growth mindset and helps your team develop expertise that impacts your entire organization, from individual career advancement to sustainable, long-term innovation.

In a fireside chat between Sandeep Bhanot, Microsoft VP of Global Technical Learning, and Cushing Anderson, VP of IT Education and Certification at IDC, you’ll hear about key learnings from research that highlight the business value of skills training for accelerating success. You’ll also explore how to use these findings to build a compelling business case for developing skills training programs in your organization.

Watch this event on-demand to:

◉ Get an overview of the cloud enablement tools, programs, and frameworks available to help you realize your goals on Azure.

◉ See these resources in action. Hear success stories from customers like KPMG who have used Azure enablement resources to build, optimize, and achieve ongoing value in the cloud.

◉ Hear insights from Microsoft product experts as they answer questions from the Azure community during the Q and A.

The live event may be over, but you still have the chance to learn and explore at your own pace, on your own time. Discover how to quickly access and use the right set of Azure enablement tools for your specific needs—and pave the way for ongoing success in the cloud. 

Watch now.

Source: azure.microsoft.com

Continue reading

How Microsoft Azure Cross-region Load Balancer helps create region redundancy and low latency

In this blog, we’ll walk through Microsoft Azure Cross-region Load Balancer (also known as the Global tier of Standard Load Balancer) through a case study with a retail customer. By incorporating Azure Cross-region Load Balancer into their end-to-end architecture, the customer was able to achieve region redundancy, high availability, and low latency for their end applications with a quick turnaround time for scaling events while retaining their IPs for TCP and UDP connections. DNS-based global load balancing solution was considered but not adopted due to long failover time caused by time-to-live not being honored.

Low latency with geo-proximity-based routing algorithm

Figure 1: With Azure Load Balancer all traffic will be routed to a random backend server based on 5-tuple hash.

Figure 2: With Cross-region Load Balancer traffic will be routed to the closest regional deployment.

With the previous setup, all traffic regardless of source IP location will be first forwarded to the load balancer’s region. This could take several hops across data centers which could introduce additional latency to network requests. With Azure Cross-region Load Balancer’s geo-proximity-based routing, end customers are being routed to the closest regional deployment which dramatically improves latency.

Automatic failover for disaster recovery

Figure 3: With Standard SKU Load Balancer, when the only regional deployment or the Load Balancer goes down, all traffic can be impacted.

Figure 4: Cross-region Load Balancer ensures seamless failover for disaster recovery.

Even though Standard Load Balancer offers zone redundancy, it is a regional resource. If a regional outage occurs causing the Load Balancer or all the backend servers to go unavailable, traffic will not be able to be forwarded as it arrives at the Load Balancer frontend. As a result, the website will be unavailable to the end customers. By adding a Cross-region Load Balancer on top of several existing regional deployments, the customer is now armed with region redundancy which ensures high availability of their end application. If web server one goes down, the end customer's traffic will be re-routed to web server two to ensure no packet gets dropped.

Scale up and down with no downtime

Figure 5: Easy scaling when using Microsoft Azure Virtual Machine Scale Sets (VMSS) combined with Cross-region Load Balancer.

Like many other industries, the retail industry faces frequent changes in traffic volume due to seasonality and other spontaneous trends. As a result, the customer’s top concern is to scale up and down in real-time. There are two ways to achieve this today with a Cross-region Load Balancer. One way is to directly add or remove a regional Public Load Balancer behind the Cross-region Load Balancer. Another way is to use Microsoft Azure Virtual Machine Scale Sets with a pre-configured autoscaling policy.

Zero friction for adoption

Azure Load Balancer has been an important part of the customer’s end-to-end architecture for stable connectivity and smart load balancing. By leaving the existing network architecture as is and simply adding a Cross-region Load Balancer on top of the existing load balancer set up, the customer is saved from any additional overhead or friction due to the addition of a Cross-region Load Balancer.

Client IP preservation

Cross-region load balancer is a Layer-4 pass-through network load balancer, which ensures that the Load Balancer preserves the original IP address of the network packet. IP preservation allows you to apply logic in the backend server that is specific to the original client IP address.

Source: microsoft.com

Continue reading

Azure Health Data Services: Engineering product for partners

The healthcare industry has come a long way from putting pen to paper on a pharmacy script or clinical SOAP note to now, being able to deliver primary care in the emerging hospital at home. My career in the healthcare and life sciences (HLS) industry has spanned different roles including: a military clinician, life science entrepreneur, clinical research application scientist, and business leader. Currently, I head the Partner Alliances team for Microsoft’s global health and Life sciences Cloud and Data engineering and product group. Today, I consider myself an HLS generalist bridging the gap between engineering and the application of it in the wild. I look forward to continuing to listen to the needs, implement solutions, and partner with others to bring forward meaningful change in healthcare.

Last month, we launched Azure Health Data Services, a platform as a service (PaaS) offering designed exclusively to support Protected Health Information (PHI) in the cloud, built on the global open standards Fast Healthcare Interoperability Resources (FHIR)® and Digital Imaging Communications in Medicine (DICOM). Watching the team work to develop this product, I feel compelled to share how intentional our product team is at building healthcare technologies for an industry that is currently experiencing historically unprecedented transformation. We are deploying technology that can ingest, transform, and persist data, allowing our customers to use their data to span workflows from discovery research to clinical end points. The underlying technology enables our customers to engage in activities ranging from novel biomarker identification to virtual clinical decision support. For example, today our customers can combine cellular assay data, pathology data, molecular imaging, genomics, handwritten, voice, and text derived notes. With so much data, the goal is to enable our customers to derive insights from a single system of record, so that they can optimize the user experience for patient,  research and clinical workflows so that adherence to treatment increases, scientists gain faster contextual evidence to support their early discoveries and clinicians can spend more time focused on delivering healthcare without experiencing burnout and information overload. The bottom line is, when you can bring these data sets together in a meaningful way, you inherently increase your signal to noise ratio since you are no longer looking for a needle in a haystack; you are looking for a book in a library.

Five years ago, under the leadership of Peter Lee, Microsoft made a purposeful decision that enabled us to lead the way in cloud, data, AI, and innovation. In 2020, Microsoft won the Frost and Sullivan Best Practice Award for our commitment to global AI for healthcare IT growth, and our innovation and leadership in the industry. The Microsoft executive health leadership team realized that we needed a common standards-based platform for healthcare and life sciences data and a secure compliant environment for the industry to build on. To accomplish this, we would need to contribute to the interoperability momentum for FHIR® standard. We also knew we had to lead with partners that know the space better than we do.  We are now focused on building the most trusted, health data platform designed with security and compliance in mind, that is ready to ingest a variety of data types and standards, workflow accelerators, and scenario-specific features. Our hope is that this will enable our ecosystem of partners to push the last mile of innovation for our shared customers in provider, pharmaceutical, payor, and life sciences.

With our partners as the foundation of our business, we will maintain competitive velocity in such transformational times.

Our approach to building Azure Health Data Services has been to support our partners by building and managing the underlying cloud technology so they can remain focused on the front-line industry scenarios. We appreciate the intimate business propriety required to remain innovative and competitive. For this model to work, we must begin and end with the question “are we going to build, buy, or partner for this given product, feature, or capability?” These decisions are rigorous and informed by key industry opinion leaders, the partner ecosystem, and our leadership teams.

Taking inspiration from industry leaders

To support this thesis, we built Health Data Services Partner Alliances team. Our charter is to listen to industry leaders like Tom Arneman at EPAM, BJ Moore at Providence, and the broader trusted advisors across the Microsoft health and life sciences partnership ecosystem. This industry driven feedback challenged us to deliver interoperable, FHIR enabled services and partner led solutions. Partners like Redox, Onyx, 3Cloud, EPAM, SAS, Efferent, Teladoc and ZS Services have been instrumental in providing direct user feedback.

These solutions are coming to life with our mutual customers across the provider, payer and pharma industries. Together we are delivering diversified solutions across the HLS continuum that includes users like translational oncology clinical trial coordinators to care providers remotely accessing their patients. We have worked closely to evolve features with early movers that have deep expertise in multi-modal interoperability deployments, FHIR resource creation, MedTech eventing features for remote patient monitoring, and DICOM for imaging. Now we are scaling these managed services with global partners, their large enterprise HLS practices and industry leading ISV solutions. We are deploying a breadth motion and application toolset that will make it simpler for our partners to build new transactional and analytic SMART on FHIR and other applications on top of Azure Health Data Services.

These partners are the cornerstone of building solutions for the greatest challenges we see today and foresee in years to come. At Microsoft we focus on aligning with them on a defined customer and business opportunity, we then commit resources and appropriate enablement to deliver timely and measurable business value. When we execute in this way, our likelihood of optimized collaboration, product; market fit, market adoption, and long-term partnership is much greater.

Azure Health Data Services is built with the goal of enabling our customers to be able to do more with their health data. We want our partners to be able to provide them solutions to do so—solutions optimized for Azure, Microsoft Cloud for Healthcare and Azure Health Data Services which can help them transform patient experience, discover new insights, and accelerate innovation.

Source: microsoft.com

Continue reading

Unlock cloud savings on the fly with autoscale on Azure

Unused cloud resources can put an unnecessary drain on your computing budget, and unlike legacy on-premises architectures, there is no need to over-provision compute resources for times of heavy usage.

Autoscaling is one of the value levers that can help unlock cost savings for your Azure workloads by automatically scaling up and down the resources in use to better align capacity to demand. This practice can greatly reduce wasted spend for those dynamic workloads with inherently “peaky” demand.

In some cases, workloads with occasionally high peak demand have extremely low average utilization, making them ill-suited for other cost optimization practices, such as rightsizing and reservations.

For periods when an app puts a heavier demand on cloud resources, autoscaling adds resources to handle the load and satisfy service-level agreements for performance and availability. And for those times when the load demand decreases (nights, weekends, holidays), autoscaling can remove idle resources to reduce costs. Autoscaling automatically scales between the minimum and maximum number of instances and will run, add, or remove VMs automatically based on a set of rules.

Autoscaling is near real-time cost optimization. Think of it this way: Rather than build an addition to your house with extra bedrooms that will go unused most of the year, you have an agreement with a nearby hotel. Your guests can check-in, at any time and at the last minute, and the hotel will automatically charge you for the days when they visit.

Not only does it utilize cloud elasticity by paying for capacity only when you need it, you can also reduce the need for an operator to continually monitor the performance of a system and make decisions about adding or removing resources.

What services can you autoscale?

Azure provides built-in autoscaling using Azure Monitor autoscale for most compute options, including:

◉ Azure Virtual Machines Scale Sets

◉ Service Fabric

◉ Azure App Service

◉ Azure Cloud Services has built-in autoscaling at the role level. 

Azure Functions differs from the previous compute options because you don't need to configure any autoscale rules. The hosting plan you choose dictates how your function app is scaled:

◉ With a consumption plan, your functions app will scale automatically, and you will only pay for compute resources when your functions are running.

◉ With a premium plan, your app will automatically scale based on demand using pre-warmed workers that run applications with no delay after being idle.

◉ With a dedicated plan, you will run your functions within an App Service plan at regular App Service plan rates.

Azure Monitor autoscale provides a common set of autoscaling functionality for virtual machine scale sets, Azure App Service, and Azure Cloud Service. Scaling can be performed on a schedule, or based on a runtime metric, such as CPU or memory usage.

Use the built-in autoscaling features of the platform if they meet your requirements. If not, carefully consider whether you really need more complex scaling features. Examples of additional requirements may include more granularity of control, different ways to detect trigger events for scaling, scaling across subscriptions, and scaling other types of resources.

Note that application design can impact how that app handles scale as a load increases. To review design considerations for scalable applications, including choosing the right data storage and VM size, and more, check out Design scalable Azure applications—Microsoft Azure Well-Architected Framework.

Also know that, in general, it is better to scale up than to scale down. Scaling down usually involves deprovisioning or downtime. So, choose smaller instances when a workload is highly variable and scale out to get the required level of performance.

You can set up autoscale in the Azure portal, PowerShell, Azure CLI, or Azure Monitor REST API.

Source: microsoft.com

Continue reading

Optimize your cloud investment with Azure Reservations

Continuous cost optimization can take place at all stages of an Azure workload’s lifecycle, but your Azure subscription provides a very effective benefit to further optimize your investment when you are ready to deploy that workload.

For cloud workloads with consistent resource usage, you can buy reserved instances at a significant discount and reduce your workload costs by up to 72 percent compared to pay-as-you-go prices. Azure Reservations can be obtained by committing to one-year or three-year plans for virtual machines, Azure Blob storage or Azure Data Lake Storage Gen2, SQL Database compute capacity, Azure Cosmos DB throughput, and other Azure resources.

When you can predict and commit to needed capacity, it gives us visibility into your resource requirements in advance, allowing us to be more efficient in our operations. We can then pass the savings on to you. This benefit applies to both Windows and Linux virtual machines (VMs).

In addition, you now can combine the cost savings of reserved instances with the added Azure Hybrid Benefit when running on-premises and Azure workloads to save up to 80 percent over pay-as-you-go pricing.

How to get your reservation

A reservation discount only applies to resources associated with Enterprise Agreement, Microsoft Customer Agreement, Cloud Solution Provider (CSP), or subscriptions with pay-as-you-go rates. These are billing discounts (paid upfront or monthly) and do not affect the runtime state of your resources. And do not worry, you will not pay any extra fees when you choose to pay monthly.

To determine which reservation to purchase, analyze your usage data in the Azure portal, or use reservation recommendations available in Azure Advisor (VMs only), the Cost Manage Power BI app, or the Reservation Recommendations REST API.

Reservation purchase recommendations are calculated by analyzing your hourly usage data over the last seven, 30, and 60 days.

Simple and flexible

You can purchase Azure Reserved VM Instances in three easy steps—just specify your Azure region, virtual machine type, and term (one year or three years)—that's it.

Here is how it works: Discounts are generally applied to the resource usage matching the attributes you select when you buy the reservation. Attributes include the scope where the matching VMs, SQL databases, Azure Cosmos DB, or other resources run. Attributes include the SKU, regions (where applicable), and scope. Reservation scope selects where the reservation savings apply. You can scope a reservation to a subscription or resource group. When you scope the reservation to a resource group, reservation discounts apply only to the resource group—not the entire subscription.

You can manage reservations for Azure resources including updating the scope to apply reservations to a different subscription, changing who can manage the reservation, splitting a reservation into smaller parts, or changing instance size. Enhanced data for reservation costs and usage is available for Enterprise Agreement (EA) and Microsoft Customer Agreement (MCA) usage in Azure Cost Management and Billing. Those same customers can view amortized cost data for reservations and use that data to chargeback the monetary value for a subscription, resource group, or resource.

Capacity on demand

The ability for you to access compute capacity with service-level agreements, and ahead of actual VM deployments, is important to ensure the availability of mission-critical applications running on Azure. On-demand capacity reservations, now in preview, enable you to reserve compute capacity for one or more virtual machine size(s) in an Azure region or availability zone for any length of time. You can create and cancel an on-demand capacity reservation at any time, no commitment is required.

You also can exchange a reservation for another reservation of the same type or refund a reservation, up to $50,000 USD in a 12-month rolling window if you no longer need it, or cancel a reserved instance at any time and return the remaining months to Microsoft.

Source: microsoft.com

Continue reading

Enhance your data visualizations with Azure Managed Grafana—now in preview

Organizations are transforming their digital environments to increase agility and to operate more efficiently. We see this transformation in how customers migrate to the cloud and adopt cloud-native technologies and practices in their own environments. As their digital estates become increasingly more complex and critical to their business operations, it becomes even more important to effectively manage and monitor their applications and infrastructure.   

Grafana is a popular open-source analytics visualization tool that allows users to bring together logs, traces, metrics, and other disparate data from across an organization, regardless of where they are stored. Last year, we announced our strategic partnership with Grafana Labs to develop a Microsoft Azure managed service that lets customers run Grafana natively within the Azure cloud platform. Today, we are announcing that Azure Managed Grafana is available in preview. With Azure Managed Grafana, the Grafana dashboards our customers are familiar with are now integrated seamlessly with the services and security of Azure.

Seamless connection across Azure data sources and beyond

The Grafana application lets users easily visualize all their telemetry data in a single user interface. With Grafana's extensible architecture, users can visualize and correlate multiple data sources across on-premises, Azure, and multi-cloud environments. Azure Managed Grafana particularly optimizes this experience for Azure-native data stores such as Azure Monitor and Data Explorer thus making it easy for customers to connect to any resource in their subscription and view all resulting telemetry in a familiar Grafana dashboard.

Customers can preserve existing charts in the Azure portal that are used for monitoring. Through service-to-service integration, our customers can bring any chart in the Azure portal over to their Azure Managed Grafana instance with a one-click “pin to” operation thus automating the entire migration process. 

Azure Managed Grafana also provides a rich set of built-in dashboards for various Azure Monitor features to help customers easily build new visualizations. For example, some features with built-in dashboards include Azure Monitor application insights, Azure Monitor container insights, Azure Monitor virtual machines insights, and Azure Monitor alerts.

Secured access and sharing of Grafana dashboards with Azure Active Directory

In Azure Managed Grafana, customers can customize user permissions with specific roles and assignments stored in Azure Active Directory. These definitions are mapped transparently to Grafana’s internal roles, which enforces the actual access control. This integration enables both simplicity and consistency by allowing customers to manage users in their teams and authorize their use of a Grafana instance centrally through Azure Active Directory.

On the backend, Azure Managed Grafana can be configured to access Azure Monitor through a managed identity that was set up as part of the Grafana instance creation. Using this option, customers do not need to deal with another credential separately—though that is still possible if preferred.

Source: microsoft.com

Continue reading

New Azure for Operators solutions and services built for the future of telecommunications

After years of laying the foundation for the rollout of 5G and network cloudification, we are now seeing tremendous possibilities for how consumers and organizations will interact with technology for work, play, and connecting with communities. Around the world and across industries, 5G, augmented and virtual reality, AI, IoT, and edge computing are creating opportunities for rapid digital transformation. This is compelling operators to move away from legacy systems to accelerate network transformation and begin monetizing their investments in 5G and edge technologies.

Imagine the benefits to communities and organizations that have access to improved bandwidth, reliability, and reduced latency, while leveraging the rich capabilities of cloud-to-edge technology without compromise to security, critical services, or key workloads.

With the most complete offerings for the telecommunications industry, Microsoft is the ideal cloud provider to help operators with their digital transformation journey and enable them to deliver these innovative services to their consumer, enterprise, and public sector customers.

Azure for Operators

With Azure for Operators, we’re empowering operators to unlock the power of 5G by bringing cloud and edge closer together to modernize their networks so that they can streamline and optimize their business operations and deliver new services faster with greater reach and lower cost. With solutions that run on-premises, at the edge, or in the cloud but are always managed and secured by Azure, Microsoft meets you where you are, offering flexibility to transform on your terms and timelines. We are committed to partnering with you, not competing against you. Your consumer, enterprise, and government customers will benefit from a cloud platform with industry-leading security and governance built-in, and with an unmatched partner and developer ecosystem to maximize the value of the cloud at the edge. We’re applying Microsoft technology and developer ecosystem capabilities to offer the next-generation Azure for Operators portfolio—carrier-grade hybrid cloud platform, voice core, mobile core, and multi-access edge compute.

Introducing the new Azure for Operators solutions and services

In September 2020, we unveiled the Azure for Operators initiative to help operators evolve their own networks, and for partners to assist enterprises to maximize their industry 4.0 opportunities. In June of 2021, we introduced a new category, Azure private multi-access edge compute (MEC), which empowers operators and system integrators to unlock the enterprise 5G opportunity. Today, we’re announcing the next wave of Azure for Operators solutions and services.

The hybrid cloud platform built for the future of telecommunications

Operators are continually looking toward digital transformation to improve competitiveness, deliver new services, and yield positive financial results through both innovation and growth. We believe telecom digital transformation starts with the modernization of network core systems and operations.

In June 2021, Microsoft acquired the AT&T Network Cloud 2.7 Software technology, an industry-first collaboration. The AT&T Network Cloud supports AT&T's 5G core and FirstNet today, representing seven years of experience developing on-premises cloud for network workloads. We’ve taken the acquisition of this technology, moved the engineering and program organization from AT&T’s Network Cloud organization into Azure for Operators, and directly integrated the intellectual property into a new Azure offering. We continue to make significant enhancements to the acquired technology itself, including security across AT&T’s entire Network Cloud deployment.

Today we are announcing the next-generation hybrid cloud platform for operators—Azure Operator Distributed Services—which combines the enhanced version of the acquired AT&T technology with the best of Azure, including our industry-leading security, monitoring, analytics, AI, machine learning, and so much more.

Built from the ground up and proven to run network-intensive workloads and mission-critical applications, Azure Operator Distributed Services meets the security, resiliency, observability, manageability, and performance needs required by operators to achieve meaningful results from digital transformation. It will enable operators to run all their workloads (such as core, RAN, mobile and voice core, OSS, and BSS) on a single carrier-grade hybrid platform. With Azure Operator Distributed Services, business operations can be streamlined, providing operators with simplified management, policy, and automation delivered through unified cloud management using Azure Services, Azure Arc management, Azure Security, and platform as a service with Azure. Azure Operator Distributed Services provides the flexibility and scalability to support customer deployments at the edge of the cloud, the edge of the network, or the enterprise edge. Now, operators can effectively create new services to monetize their network, all while gaining robust network and customer insights that are necessary to facilitate proactive decision-making, critical action, and the creation of real value.

With Azure Operator Distributed Services, we are delivering a carrier-grade hybrid cloud service to the market and AT&T where it can run at AT&T on-premises or on Azure public cloud. Azure Operator Distributed Services is designed to support the AT&T mobile core network that today spans more than 60 containerized network functions (CNFs) and virtual network functions (VNFs) from 15 different vendors, which currently are deployed and running on the AT&T Network Cloud platform. AT&T will continue to select and manage VNFs and CNFs and their configurations to deliver mobility services to AT&T customers. AT&T and Microsoft are closely collaborating on the deployment of Azure Operator Distributed Services with initial testing stages planned for later this year.

“AT&T's 5G network is built on an agile, future-ready mobile core that's designed to boost innovation, resiliency, and security for our customers. Our 5G mobility core is fully cloud-based, integrating Network Functions from multiple vendors that today are hosted on Network Cloud infrastructure based on a cloud software stack that Microsoft acquired from AT&T last year. We are pleased with Microsoft’s plan to evolve Network Cloud and integrate it with Azure technologies to create hybrid telco-grade Azure Operator Distributed Services. This will enable AT&T and other operators to host Network Functions on clouds spanning telco premises and public cloud and will help us realize the many benefits of the cloud-native approach and Azure innovation including additional speed, resiliency, security, cost, and operational improvements.“—Andre Fuetsch, Executive Vice President and CTO Network Services, AT&T

We designed the Azure Operator Distributed Services for use by all operators while maintaining security and without losing differentiation. In terms of security and privacy, we want to make clear that operators using Azure Operator Distributed Services continue to hold access to their customer data, Microsoft cannot access or see it. With this product, we want to enable operators to deliver new services faster and more flexibly across Azure public cloud and on-premises with common tooling and services, reducing time-to-market with a cloud-native approach. True to our mission of empowering everyone to achieve more, we are collaborating with the broader partner ecosystem, including Ericsson and Nokia, to build on our next-gen hybrid cloud platform for operators.

“Combined with cloud capabilities, 5G has the potential to accelerate the digital transformation of virtually any sector of industry or society. The combination of Azure Operator Distributed Services and Ericsson’s market-leading cloud-native network functions and orchestration suite promise significant benefits for customers. Microsoft and Ericsson are jointly exploring enterprise 5G use cases in conjunction with leading operators.”—Jan Karlsson, Senior Vice President and Head of Business Area Digital Services, Ericsson

“Open collaboration is key to the development of new and innovative high value 5G use cases that will equip our customers with the tools they need for digital transformation. This is part of Nokia’s continued commitment to leading an open mobile future, making it simple for our customers to take advantage of the 5G world, helping to drive it forward. We are enthusiastic to work closely with Microsoft to integrate our Cloud RAN technology with Microsoft Azure, offer Microsoft Azure IoT Edge Services allowing industries to realize new capabilities at the edge, and bring Nokia’s new SaaS-based NetGuard Cybersecurity Dome as well as other Cloud and Network Services software to Azure.”—Chris D. Jones, Vice President Strategic Partnerships, Strategy and Technology, Nokia

Next-generation packet core services

Today, we are also announcing the private preview of the Azure Operator 5G Core and public preview of the Azure Private 5G Core. The Azure Operator 5G Core deploys on the Azure Operator Distributed Services to meet the needs of operators seeking automated, operational efficiency in a mobile network that can scale hundreds of millions of subscribers and devices. Azure Private 5G Core is available as part of the Azure private MEC solution, enabling operators and system integrators to provide a simple, scalable, and secure deployment of private 4G and 5G networks at the enterprise edge. Both services are deployed and managed through Azure.

Azure Operator 5G Core

Microsoft Azure Operator 5G Core is an Azure service that enables operators to build, deploy, and manage scalable mobile networks. Operator networks need to handle unprecedented amounts of data as 5G unleashes a broad set of low-latency, high throughput consumer, industry 4.0, IoT, and massive machine-type communications. Using Azure Operator 5G Core, operators can seamlessly deploy network workloads on Azure and manage their networks at scale with agility and cost efficiency while keeping up with the evolving demands of 5G.

Azure Operator 5G Core is built on a distributed architecture and includes cloud management, service automation, life cycle management, network slicing, and integrated analytics. This allows operators to provide an enhanced and customized user experience and leverage open APIs to easily integrate with their existing environments. Azure Operator 5G Core and Microsoft’s vast ecosystem of first and third-party tools enable operators to achieve greater enterprise value by creating new vertical solutions (such as gaming, energy, smart cities, autonomous vehicles, agriculture, etc.). We are working with a select number of partners and customers during the private preview and are excited to make this available to all operators soon.

Azure Private 5G Core

This packet core as-a-service offer allows operators and system integrators to rapidly deploy enterprise private mobile networks and low latency applications on Azure Arc-connected edge platforms, such as Azure Stack Edge. Through Azure, partners can unify the cloud management of multiple, globally distributed private wireless networks, with the flexibility to also choose and integrate components from technology and solution partners, including a wide range of 4G and 5G Standalone RAN and SIM providers.

We are enabling a growing list of global partners to deliver next-generation private wireless solutions. Operators developing solutions using Azure private MEC include AT&T, Etisalat, Swisscom, and Telefonica. Our list of global system integrator partners continues to expand, with Accenture, Amdocs, ATOS, Capgemini, Cognizant, Harman, HCL, Intelsat, Lockheed Martin, Northrop Grumman, Tampnet, TCS, and Tech Mahindra. Azure Private 5G Core is also validated with technology partners to speed up integration with RAN partners including ASOCS, AirSpan, CommScope, Fujitsu, Parallel Wireless, and Qualcomm.

Partners are actively working with enterprise customers on proof of concepts and trials:

◉ AT&T is looking to bring private 4G and 5G wireless networks as an integrated platform with connectivity and applications to enable low-latency services at the edge. Target customers include businesses, universities, and the public sector. Currently under development with Microsoft, the AT&T Private 5G Edge service is using Microsoft’s Azure private MEC and Azure Private 5G Core.

◉ Lockheed Martin is collaborating with Microsoft on 5G.MIL®solutions. Lockheed Martin 5G.MIL integrates 5G technologies into military communication networks for resilient and secure next-generation connectivity in highly dynamic environments. Using Azure Private 5G Core in 5G.MIL solutions will enable high performance in a small footprint and the ability to support, secure, and scale interconnection between 5G wireless and military networks. “Lockheed Martin’s strategic collaboration with Microsoft unlocks new capabilities that will provide a decisive edge for military personnel across all domains,” said Dan Rice, Vice President of 5G.MIL® Programs at Lockheed Martin. “Leveraging Microsoft’s expertise in cloud computing and distributed system orchestration, we are accelerating the scale and speed of critical military communications, which will be necessary in increasingly contested environments.”

◉ HARMAN Digital Transformation Solutions (DTS) has employed Azure private MEC to successfully advance digital transformation at one of the largest airports in the United States. The solution improved operational efficiencies for the airport’s manual cargo handling process. "Advances in technologies like 5G yield significant opportunity to accelerate innovation across nearly every industry—from transportation and healthcare to manufacturing and education,” said David Owens, Senior Vice President and General Manager, Digital Transformation Solutions, HARMAN. “HARMAN's deep knowledge and experience in the communications domain and Azure private MEC offers a comprehensive solution to enterprises planning to deploy private networks and cloud computing applications. We are glad to join hands with Microsoft in re-shaping the future by elevating experiences for our customers and end consumers."

◉ "Northrop Grumman’s advanced battle management technologies allow military forces to effectively communicate and securely share mission-critical data across all domains. With the integration of the Azure private MEC platform, we are leveraging Microsoft’s commercial-edge computing capabilities to inform tactical mobile ad hoc networks for the U.S. Navy’s Information Warfare Research Project.”—Tom Pieronek, Chief Technology Officer, Aeronautics Systems, Northrop Grumman

◉ "As a pioneer in digital transformation, Fujitsu is committed to helping enterprises and telcos accelerate adoption of 5G. Our market-leading O-RAN solutions and managed services offerings, combined with the power of Microsoft’s Azure private MEC offering, will play an important role in delivering 5G solutions to market, enabling rich customer experiences at the convergence of 5G, digital, and the edge.”—Shingo Mizuno, Corporate Executive Officer, Fujitsu Limited

◉ "We are entering a new era of enterprise digital transformation that will be fueled by private networks, edge computing, secure access service edge, and amplification of industry-specific applications. Along with Microsoft, we are making it easy for enterprises to order, provision, and consume full suite of infrastructure capabilities and applications—the cloud way"—Manish Mangal, Global Head of 5G and Network Services, Tech Mahindra

Delivering the value of cloud to the edge for enterprises with MEC solutions

In June 2021, we announced a new category, the Azure private MEC. Today we extend this MEC category with the introduction of Azure public MEC solution. An evolution of Azure Edge Zones with an operator, the Azure public MEC solution integrates Azure compute and services with mobile operator 5G connectivity, elevating application performance at the operator edge. Through the Azure private and public MEC solutions, we are collaborating and co-innovating with operators and system integrators, as well as bringing the broader technology and developer ecosystem to deliver innovative solutions that meet enterprise needs at the edge.

Azure public MEC

With Azure public MEC, we are collaborating with strategic operators to enable enterprises and developers to deliver innovative high-performance, low-latency applications at the operator edge, using operators’ public 5G network connectivity. Applications that run on Azure public MEC offer customers the unique ability to analyze data closer to where it is being captured from users and edge-enabled devices (such as industrial IoT devices, cars, and smartphones). The resulting timely, detailed insights pave the way for proactive responses to and solutions for real-world enterprise problems.

With Azure public MEC, enterprises and developers can select the low-latency components they need from the cloud to deliver at the edge while managing everything else in the cloud. This level of flexibility allows customers to rapidly deploy innovative MEC solutions, increasing efficiency, and optimizing costs by reducing the need for on-premises servers and the amount of traffic to the public cloud.

We are co-innovating with global strategic operators and independent software vendors (ISVs) to deliver public MEC solutions across the globe. We recently announced Azure public MEC with AT&T and Azure public MEC with Singtel, and others to follow. We are also working with many ISV partners to offer innovative networking, security, and low-latency applications that meet enterprise needs. Check out demos with Check Point, Couchbase, Game Cloud, Summit Tech, and VMware to learn how these partners are delivering innovative solutions at the edge with Azure public MEC.

Our partners in their own words

Partners are at the heart of what we do at Microsoft. Through strategic collaborations and scale ecosystem engagements, we are working with operators, system integrators, technology partners, and solutions partners to build innovative solutions that enable the telecommunications industry transformation. Read and watch what some of our partners are saying about working with Microsoft to deliver innovative solutions to capitalize on the promise of 5G for next-generation business outcomes.

“Combining the high bandwidth and low latency of 5G with cloud and edge compute capabilities opens an entirely new world of opportunities for businesses and other organizations to serve their customers in new ways. This will enable entirely new use cases in manufacturing, retail, health care, automotive, touching virtually every industry vertical. AT&T’s collaboration with Microsoft is about enabling organizations to harness the power of 5G, cloud and edge quickly with the ability to scale on demand.”—Rasesh Patel, Executive Vice President, and Chief Product and Platform Officer, AT&T

“This unique solution by Singtel and Microsoft leverages the strength and performance of Singtel's innovative edge cloud platform to deliver assured low latency, high throughput, intelligent connectivity, data analytics, and AI services to enterprises. This enables enterprises to accelerate their digital transformation journeys through adopting advanced technologies such as autonomous robots, vehicles, and drones, as well as Metaverse applications, into their enterprise operations through a single unified platform.”—Bill Chang, CEO, Group Enterprise, Singtel

Telstra announced customer trials of Australia’s first 5G-enabled edge compute solution for enterprises (Branch Offload) through a collaboration with Microsoft and Ericsson that will use technologies including Telstra’s 5G and fixed connectivity, Azure Stack Edge, Secure Edge, SD-WAN and service orchestration, and will be delivered as a managed service by Telstra Purple. Nikos Katinakis, Telstra’s Group Executive for Networks and IT said, “Telstra’s collaboration with our major strategic partners, Microsoft and Ericsson, continues to enable us to break new ground, leveraging new technologies and our smarter network to standardize solutions and that will help Australian businesses adapt for the digital future.”

“Technical trials demonstrated how Azure public MEC and AT&T’s 5G mobile network-enabled Summit Tech’s Odience 360 8K live streaming platform with built-in e-commerce to bring immersive and interactive experiences to use cases such as shopping, live concerts, sports stadiums, and eSports. MEC video processing yielded up to 80 percent bandwidth reduction, imperceptible motion-to-photon delay, and impressive glass-to-glass low latency for true two-way interactivity.

"As the requirements of modern applications continue to evolve, Couchbase is collaborating with Microsoft and Azure public MEC to bring the cloud and the edge closer together for customers. Azure public MEC and Couchbase’s modern database enables developers to build next-gen edge use cases."—Matt McDonough, SVP Business Development and Strategy, Couchbase

Watch this ISV testimonial to hear from Citrix, Spirent, Game Cloud, VMware, and Fortinet about how they are working with Microsoft to build and deliver public MEC solutions.

Source: microsoft.com

Continue reading

Improve your security defenses for ransomware attacks with Azure Firewall

To ensure customers running on Azure are protected against ransomware attacks, Microsoft has invested heavily in Azure security and has provided customers with the security controls needed to protect their Azure cloud workloads.

A comprehensive overview of best practices and recommendations can be found in the "Azure Defenses for Ransomware Attack" e-book.

Here, we would like to zoom into network security and understand how Azure Firewall can assist you with protecting against ransomware.

Ransomware is basically a type of malicious software designed to block access to your computer system until a sum of money is paid. The attacker usually exploits an existing vulnerability in your system to penetrate your network and execute the malicious software on the target host.

Ransomware is often spread through phishing emails that contain malicious attachments or through drive-by downloading. Drive-by downloading occurs when a user unknowingly visits an infected website and then malware is downloaded and installed without the user’s knowledge.

Here Azure Firewall Premium comes into help. With its intrusion detection and prevention system (IDPS) capability, every packet will be inspected thoroughly, including all its headers and payload to identify malicious activity and to prevent it from penetrating your network. IDPS allows you to monitor your network for malicious activity, log information about this activity, report it, and optionally attempt to block it.

The IDPS signatures are applicable for both application and network-level traffic (Layers 4-7), they are fully managed and contain more than 65,000 signatures in over 50 different categories to keep them up to date with the dynamic ever-changing attack landscape:

1. Azure Firewall is getting early access to vulnerability information from Microsoft Active Protections Program (MAPP) and Microsoft Security Response Center (MSRC).

2. Azure Firewall is releasing 30 to 50 new signatures each day.

Nowadays, modern encryption, such as Secure Sockets Layer (SSL) or Transport Layer Security (TLS), is used globally to secure internet traffic. Attackers are using encryption to carry their malicious software into the victim network. Therefore, customers must inspect their encrypted traffic just like any other traffic.

Azure Firewall Premium IDPS allows you to detect attacks in all ports and protocols for non-encrypted traffic. However, when HTTPS traffic needs to be inspected, Azure Firewall can use its TLS inspection capability to decrypt the traffic and accurately detect malicious activities.

After the ransomware is installed on the target machine, it may try to encrypt the machine’s data, therefore it requires using an encryption key and may use the Command and Control (C&C) to get the encryption key from the C&C server hosted by the attacker. CryptoLocker, WannaCry, TeslaCrypt, Cerber, and Locky are some of the ransomware using C&C to fetch the required encryption keys.

Azure Firewall Premium has hundreds of signatures that are designed to detect C&C connectivity and block it to prevent the attacker from encrypting customers’ data.

Figure 1: Firewall protection against ransomware attack using command and control channel

Taking a comprehensive approach to fend off ransomware attacks

Taking a holistic approach to fend off ransomware attacks is recommended. Azure Firewall operates in a default deny mode and will block access unless explicitly allowed by the administrator. Enabling Threat Intelligence (TI) feature in alert/deny mode will block access to known malicious IPs and domains. Microsoft Threat Intel feed is updated continuously based on new and emerging threats.

Firewall policy can be used for the centralized configuration of firewalls. This helps with responding to threats rapidly. Customers can enable Threat Intel and IDPS across multiple firewalls with just a few clicks. Web categories let administrators allow or deny user access to web categories such as gambling websites, social media websites, and others. URL filtering provides scoped access to external sites and can cut down risk even further. In other words, Azure Firewall has everything necessary for companies to defend comprehensively against malware and ransomware.

Detection is equally important as prevention. Azure Firewall solution for Microsoft Sentinel gets you both detection and prevention in the form of an easy-to-deploy solution. Combining prevention and detection allows you to ensure that you both prevent sophisticated threats when you can, while also maintaining an “assume breach mentality” to detect and quickly respond to cyberattacks.

Source: microsoft.com

Continue reading