Azure Activity Log -> provides insights into subscription-level events. Retention period of 90 days
Benefit of connecting Activity Log to Log Analytics
consolidate the activity logs of multi subscriptions in one place for analysis.
Store Activity Log enteries for more than 90 days.
Correlate Activity Log data with Azure Monitor data.
Use Log queries for complex analysis and get deep insight on Activity log.
Note Each subscription has only one Activity Log. Each Activity Log can be connected to only one Log Analytics Workspace. One Log Analytics Workspace can be connected to the Activity Log of multiple subscription in a same tenant.
Connect an Activity Log to a Log Analytics workspace
Variante 1 (form log analytics blade) Go to the Log Analytics Workspace > Select one of the created workspaces > From the blade > Azure Activity Log > Select one Subscription > Connect | Disconnect
Variante 2 (from activity log blade) Select a resource > Select Logs / Diagnostic settings menu > Select a Log Analytics Workspace.
In the Cost Management + Billing service blade > Cost analysis > there’s a possibility for filter after tag and if the environment like dev, Prod has been considered as tag. We can filter here.
Azure Monitor: this codument go through the important aspects of it.
Azure Security Center
Azure Sentinel
Monitoring concepts
Each project need a holistic monitor strategy.
Scenario: A financial organization is moving its systems to Azure, with a mixture of IaaS and PaaS services. In its previous environment, the organization had several instances where systems failed or issues arose. There was an extended delay to engage resources and resolve the issues. This situation affected customers’ ability to access their accounts, and it influenced satisfaction. The organization wants to design a monitoring strategy that encompasses all the solutions that it uses. There should also be insights and alerting into the accumulated log data. The organization wants to quickly identify and minimize the impact if systems fail in the future.
Continuous monitoring strategy
it can improve the ability to identify issues within application
it can help to improve customer experience
to monitor performance of infrustructure and application
monitor security risks and suspicious activity
collect information on issues and analyse and then respond
in long run, your organization will become more productive, cost-effective, secure, and competitive.
why monitor applications
to improve application health
configure alert and automated response to deal with issues
to improve the development lifecycle, we can use monitoring, therefore we would be ready when we go to production
why monitor infrustructures
because of issues that could render the entire infrastructure unavailable
because of threats to security (these can have impact on productivity, financial loss, damage organization reputation )
risk of suspicious user account
malicious ip addresses
create automated response to alerts with playbooks and webhook.
learn from issues, strengthen protection, build an improved infrastructure
even in development phase monitoring can help developers
Azure Monitor agents
Azure Diagnostics Extension
An agent in azure monitor
Collects monitoring data from guest operating systems of azure compute resources include virtual machines.
We don’t pay for the extension but we pay for data ingestion
Data destination is azure storage account or other data sinks (additional destinations).
Scenarios
Collect guest metrics into azure monitor metrics (collect logs from middle-tier/vm and transfer to azure monitor)
Send guest logs and metrics to azure storage for archiving
Send guest logs and metrics to azure event hubs to send outside of azure
A proactive notificaion when an important notification found in monitoring (response to incidents).
Alert is raised before customer identifies and addresses an issue.
Unified alerts are managed by log analytics and application insights.
The previous type of alert are classic alerts.
Alerts are raised for matrics and logs. Ex. Metric values, Log search queries, Activity log event, Health of the underlying azure platform, test for website availability.
Alert states
Alert state
Description
New
Issue has been detected but has not been reviewed.
Acknowlaged
Administrator has reviewed the alert and started working on it.
Closed
Issue has been resolved.
NOTE : The state changes are stored in alert’s history.
Alert states are independent of Monitor condition (fired or resolved).
Different type of reaction to an incident
Alerts & alert rules & action group
Classic alerts
Metric alerts
Log alerts
Activity log alerts
common alert schema
Smart groups (aggregation of lalerts base on machine learning algorithms)
Auto scale
Change analysis
Permission and privilages
We can use the Role-based access control (RBAC) at different levels
Subscription Level
Resource Level
The RBACs which are available for Azure Monitor service are the following:
Monitoring Contributor
Monitoring Metrics Publisher
Monitoring Reader
Ex. A user with the Monitoring contributor access for VM1 can only consume and mange the alert that have been generated for VM1.
Add new Alert
Alerts are defined via Azure Minitor Service blade.
Go to Azure portal > Monitor service> Go to Alerts section > Use add alert rule button.
According to the seleced resource there’s different signals available.
Signal types
Metrics
Activity logs
The alert configuration is different respectively. But without considering the signal types always we need the following items for creating an alert rule in Azure Monitor Service.
Resource (For the scope of Alert Rule)
The scope of alert is specified in this step. – Subscription level – Resource Group level – Region – A specific resource – One Alert Rule for multiple resources with the same Resource Type is available.
By preventing to write the secrets in source code and save the secrets in aconfig file, we must be careful not to push & commit the code to the repository.
Support modern authentication protocols. (e.g. WS-FED, SAML Federation, OpenID Connect, OAuth)
Azure AD will come with SDKs like ADAL and MSAL.
Azure AD supports the scenarios like B2C, B2B, B2E (employee) and Software As a Service (SaaS) applications.
Hybrid Active Directory (On-Prem & Cloud)
The on-premises identities can be synced to the Cloud via Azure AD Connect Tool.
Even Multiple forests can be synced.
The authentication can be federated to the on-premises with (ADFS).
The identity can be manged in Azure AD but authentication can be done by on-prem AD server.
The on-prem group policies can be synced in Azure AD.
Azure AD Connect has demonstrated in Azure Active Directory’s blade overview part
Hybrid identities
Create a new active directory on Azure
Organization name: where we want to reference e.g. <MY_ORG>.local
Initial domain: <MY_ORG>.onmicrosoft.com
name, country, region
Add e.g. <MY_DOMAIN_NAME>.com as a new domain name for the <MY_ORG>.onmicrosoft.com
Verify the ownership of the domain name by adding a TXT record to the DNS Server
Add UPN suffix to the on-prem forest. Server > Tools > Active Directory Domain and trusts > Right click Active Directory Domains > Properties > Alternative UPN Suffix > Add <MY_DOMAIN_NAME>.com
Go to users on on-prem AD and change the domain to alternative domain or using powershell via Get-ADUser and Set-ADUser commands.
For hybrid identities we use Azure AD Connect.
We need a Global Admin Account in AAD.
Download and install Azure AD Connect on the on-prem AD Server.
Provisioning a Azure Active Directory
Create Azure Active Directory (Azure Portal > All Services > Create button > the following image)
Azure Active Directory’s blade overview
Users
Groups
Enterprise applications: add new SaaS applications like Box, Dropbox,…
Devices: to mange devices.
App registration: Register application to machine to machine communication / client credential flow [more].
Application proxy: for exposing on-premises.
Azure AD Connect: for sync with on-prem Active Directory to AAD for hybrid identity.
App registration
App registration blade features are:
New Registration
Endpoints
Troubleshooting
Listing the registered applications ( All Applications | Owned Applications)
Native is like mobile app, desktop application or javascript single-page application. Redirect URL is where Azure AD directs the authenticated user’s details.
After the app registration, the following items can be important for developers. They are always available on the registered app blade.
Application or client ID via Overview blade
Redirect URL after successful authentication via Authentication blade
Logout URL via Authentication blade
How to go the registered app blade
AAD > App registration> select & click the registered
Application/ Client ID
Redirect URL after successful authentication
Logout URL
App Registration usages
For developing the Client Credential Flow / Machine to Machine communication
For login to Azure API Management’s Developer Portal with AAD/ AAD B2C identity
The conditional access policy uses the Sign-in Risk value (it’s a probability). But it’s not the only value. Based on the policies different probability values have to be calculated [more]. Based on how conditions are configured different values are calculated and used.
In Grants either you block the users who have the conditions or you grant then if one of the checkboxes is available. Multi-factor is available only in the following licenses but with some differences [more]:
Microsoft 365 Business Premium and EMS or Microsoft 365 E3 and E5
Report-only mode is a new Conditional Access policy state that allows administrators to evaluate the impact of Conditional Access policies before enabling them in their environment. With the release of report-only mode:
Conditional Access policies can be enabled in report-only mode.
During sign-in, policies in report-only mode are evaluated but not enforced.
Results are logged in the Conditional Access and Report-only tabs of the Sign-in log details.
Customers with an Azure Monitor subscription can monitor the impact of their Conditional Access policies using the Conditional Access insights workbook.
Disadvantage of Active Directory If a company has use the Active Directory of the authentication and the personals are allowed to do home office, therefore they need to use VPN Connection to authenticate to the company’s Active Directory. This isn’t so secure.
Manage and authentication for mobile and modern devices
Classic active directory cannot manage modern devices with the following features:
Group policies
Kerberos or NTLM (works poorly)
Session based security
What can help us to manage the modern devices:
Mobile device management
OpenID connect and OAuth
Access token and refresh token
Forms-based Authentication
Protocols
WS-Federation
It’s a redírect-based flow. we go to a site and site says we are anonymous, and it redirects us to a authentication provider.
The user can pick an authentication provider and we provide the credential and then we get SAML post back.
SAML looks like XML and it contains what they call a SAML assertion and that establish your identity.
SAMLp
More flexible and supports more structured way to do SAML, more attributes.
OpenID Connect
OpenID Connect & OAuth are not synonymous.
OAuth is about a delegation protocol. For example I say, I’m allowing you to access my application if you match certain criteria. In this case I don’t know about the identity but if you have brown eyes and brown hairs, you are allowed to work with my software.
OpenID Connect says that you have to have minimum set of protocols that also establish your identity. OpenID is not only for web / mobile application. It can be applied to anything.
The following figure demonstrates the OpenID Connect usage for Web Application.
Insert photo here!
Single Page Application
Single Page Application is typically written in JavaScript (OAuth 2.0 Implicit Flow). Using OAuth 2.0 implicit flow and Single Page Application don’t have a secure way of storing long-lasting refresh token.
In OAuth 2.0 implicit flow, we assume that with closing the browser the user is logged out. Therefore OAuth 2.0 is suitable for Single Page Application.
Native Application
Like the applications running on a Mac OS, Linux OS or Windows OS, we use the Authorization Code Grant Flow. Here we have capability of storing long-lasting refresh tokens in a secure, encrypted manner offline.
Azure AD Authorization features
Azure AD V1 endpoint
Authorization Code Grant Flow It has used authorization code grant flow for mobile apps and desktop applications as well.
Azure AD V2 endpoint
Authorization Code Grant Flow It prefers not to use authorization code grant flow for mobile app but only for desktop applications. Proof of key exchange (PKCE) flow It’s for mobile application.
In practice’s Scenarios
Web Browser talks to Web App It can be developed with WS-Federation, SAMLP, OpenID Connect.
Sigle Page Application talks to Web API It can be developed with OAuth to implicit flow, so ADAL.JS, MSAL.JS.
Native App talks to Wen API
Web Application talks to Web API It uses user credential delegated credentials, or using application’s identity.
Daemon If there’s no authentication opportunity. Daemon can call API registered in Azure AD.
Create a MVC Project with the following PowerShell code
Perform authentication
Create a .Net core MVC project via the PowerShell.
# Create .NetCore MVC Project
$ProjectName="DotNetCorePipeline"
cd C:\YOUR PATH\AuthenticationForDevelopers
new-item -Name $ProjectName -ItemType directory
cd C:\YOUR PATH\AuthenticationForDevelopers\$ProjectName
dotnet new mvc --auth SingleOrg --client-id YOUR CLAINT ID --tenant-id YOUR TENANT ID --domain YOUR DOMAIN NAME --no-https
After creating the project go to project folder and open the project file in Visual Studio and run the project. [More Info about ID Tokens]
Business to Consumer (B2C)
for scenarios, in which the external users are the focus.
Identities not known ahead time
Social login may be required ( can be simple username, password authentication, with/without MFA) -> other identity provider like social accounts
Custome user experience and brand promotion is important -> via collecting information from market
Keep evrything secure and standard compliance.
In Practice
Create a B2C Directory (it has two steps. First create a new one. Second assing to Subscription.)
Register and configure an application
Create an application that uses Azure AD B2C
Token-based authentication to SQL resources
SQL resources are the following SQL database, SQL warehouse and SQL server. The authentication is possible via AD.
It’s via power shell and API management Rest API possible.
Export API definition for developers
The developers can export the API definition in OpenAPI JSON format and WADL from API Management Developer Portal.
And the developers can use these files to generate client-side code by using the tools, which is adequate for them such Swagger codegen or Postman to start calling the API in a short time.
Azure Portal > API Management > Select the API Management Instance > APIs > Developer Portal Button > APIs Tab in Developer Portal > Select an API > We see the list of APIs Actions/Operations > Select an Action > API definition button -> Download the OpenAPI 3/ 2 JSON or YAML format or WADL.
API definition button to download the definition for Swagger or Postman
Multi Cloud Solutions 