G'day, Cloud Gurus, and welcome back.
In this lesson, we're going to take an introductory look
at Azure Arc, which has to be one of my favorite
new Azure services.
Let's take a look at what we're going to cover.
First up, we'll answer the question, what is Azure Arc?
Then we'll take a look at the onboarding requirements,
we'll take a look at the onboarding methods,
and then we'll onboard a server into Azure Arc.
Let's get started.
So what exactly is Azure Arc?
Well, we all know that we have our on-premises servers,
including our physical servers and our virtual machines,
and in a hybrid environment we also have
our Azure Virtual Machines.
And on-premises, we deploy and manage our servers
with a range of different tools,
including Windows Admin Center,
the Microsoft Management Console,
and command-line tools like PowerShell.
And in Azure, we deploy and manage
our Azure Virtual Machines with some similar tools
and some completely different tools.
And in Azure, we get ARM templates in Bicep,
Azure PowerShell, and the Azure CLI.
And this is kind of annoying, right?
We have a wide variety of tools to deal with
to manage both our cloud and our on-premises environment.
And some of the tools might overlap,
but the way in which we use them doesn't.
In Azure, the platform that enables all of the deployment
and management tools is known
as the Azure Resource Manager or ARM.
And ARM is used to manage everything in Azure,
including deploying through the tools,
management and visibility through Azure Monitor,
and security through Azure RBAC
and Microsoft Defender, and Governance through Azure Policy.
Azure Arc allows you to extend all of the important features
of Azure Resource Manager, outside of Azure,
to your on-premises resources and those in other clouds.
Your on-premises servers
become Azure Arc Connected Machines.
And all of this allows you to use a single set of tools
and services across all of your servers.
In this lesson, we'll explore Azure Arc for servers,
but just be aware that Azure Arc doesn't stop at servers.
It also provides hybrid management capabilities
for containers, app services, and data services.
Let's take a look at the Azure Arc onboarding requirements.
Your service outside of Azure will require
at least Windows Server 2008 R2,
they'll will require the Windows Management Framework 5.1,
.NET 4.6 or later,
and you'll need local administrative privileges
on that computer, and outbound HTTPS access to Azure.
And in Azure, you'll need an existing resource group,
to onboard Azure Arc Connected Machines,
you'll need to be a member of the Azure
Connected Machine Onboarding role
or the Contributor role on the resource group,
and to read, modify, or delete
an Azure Arc Connected Machine,
you'll need to be a member of the Azure Connected Machine
Resource Administrator role for the resource group.
And one special requirement when you're onboarding
your servers: to select a resource group
from the dropdown list when you're generating
an onboarding script, at a minimum,
you'll need to be a member of the Reader role
for that resource group.
Now there are a few options
for onboarding servers into Azure Arc.
You can easily onboard individual servers from the portal
if you have the required access by generating a script
and using your own credentials to onboard the server.
It's as simple as providing a few details for the script,
and then you download and run the script
on your connected machine.
You can also onboard multiple servers
by creating a service principal,
and a service principal is used to authenticate
against Azure without requiring any user input
like usernames and passwords.
You created the service principal,
at least to the Azure Connected Machine Onboarding role,
and ideally only that role,
and then you can execute the script
against multiple targets and onboard them all.
And there are more onboarding options available,
including onboarding directly from Azure Update Management
or using Azure Migrate if you're already using
either of those services.
All right, let's take a look at a demo
of configuring Azure Arc for Windows VMs.
In this demo, I will generate the onboarding script
from the Azure portal,
and then I will onboard the on-premises server
into Azure Arc by running the script on that computer,
and then I will review the Azure Arc Connected Machine.
Let's take a look at the demo.
All right, so here we are on the Azure portal.
Let's go ahead and onboard an on-premises virtual machine
into Azure using Azure Arc.
First, we're going to navigate to Azure Arc in the portal,
and then we're going to navigate
to Servers under Infrastructure,
and then we're going to go ahead and click Add.
Now just note here, you can onboard multiple servers
using your service principal,
and you can grant that service principal
the Azure Connected Machine Onboarding role.
And that will only allow that service principal
to onboard machines into Azure Arc.
And also, as we discussed in the lesson,
you can onboard machines using Update Management
and Azure Migrate.
For our purposes, though,
we just want to onboard one virtual machine,
so I'm going to go ahead and select Generate Script
under Add a single server.
And it's got a list of the requirements here.
We're aware of those,
so we're going to go ahead and click Next,
and then we'll go ahead and select our resource group.
And our region is fine.
Our operating system is Windows.
And it's important to point out here that you can
actually use a private endpoint or a proxy server
to connect if required.
For our purposes, though, we have direct internet access,
so I'm going to go ahead and click Next.
Now you can can tag your on-premises virtual machine,
which will help with knowing where it is
and who is responsible for it.
I'm not going to do this in the demo,
but I highly recommend you do this
in a production environment.
Let's go ahead and click Next.
All right, now here's the script that we need to run
on our on-premises machine to onboard that machine
into Azure Arc.
So I'm going to go ahead and copy the script,
and then we'll jump over to our on-premises virtual machine,
and we'll just paste that in here,
and we can go ahead and run that.
This will just take a moment to install,
so we'll come back when this is done.
All right, now it's asking us to authorize
that machine to be onboarded,
so let's go ahead and grab the URL from here,
and we'll paste that into our browser.
And then we'll jump back and grab the code.
Paste that in as well.
And then we'll need to log on
with our user account to onboard this machine.
All right, we've successfully onboarded this server.
Let's go and take a look in the portal.
So we'll navigate back to the Azure portal,
and then we'll navigate back to Azure Arc.
We've got selected Servers under Infrastructure,
so we'll just go ahead and refresh this.
And there's our new Azure Arc Virtual Machine,
and it's connected successfully.
We'll go ahead and click on that.
Collapse this left pane.
All right, and now we can see some of those capabilities
we talked about in this lesson.
Now it might not look like much now,
but we'll have a look at these in more detail
in later lessons in this course.
But that concludes the demo for now.
Let's wrap up with a bit of a summary
of what we've covered in this lesson.
All right, so what have we covered?
Azure Arc extends the Azure management capabilities
outside of the Azure public cloud.
And to onboard Azure Arc Connected Machines,
you require the Azure Connected Machine Onboarding role
or a more privileged role.
And to modify the connected machines,
you require the Azure Connected Machine
Resource Administrator role.
And you can also use a service principal
to onboard multiple servers without requiring
logging onto each of those servers
and onboarding them manually.
All right, thanks for being with me in this lesson.
I hope you found it useful,
and I look forward to seeing you in the next lesson.