[{"categories":["Microsoft Azure"],"content":"Azure VMware Solution - The Azure Experience Azure VMware Solution (AVS) bridges the gap between traditional VMware environments and modern Azure services, allowing customers to easily migrate, run, manage, and secure VMware workloads natively on Azure.\nIn the context of AVS, exploring Azure and VMware vSphere is like examining a coin—each side complements the other. In this blog, I’ll focus on the Azure side of the coin, diving into how AVS integrates with Azure experience. In a future blog, I’ll flip the coin to reveal the VMware side.\nInfo\nI am going to call Azure VMware Solution – \u0026ldquo;AVS\u0026rdquo; – for simplicity. However, it is not an official acronym\nAVS as an Azure Resource AVS is represented as a resource provider within Azure Microsoft.AVS. You must register this provider in your Azure subscription before provisioning AVS. This step parallels other Azure services, ensuring subscription readiness for specific services. If not registered, you cannot deploy AVS private cloud resources; users may see an error at deployment even if they have quota allocation. When an instance is deployed it is represented as microsoft.avs/privateclouds.\nAVS Resource Provider\nQuota Requests When you set up an Azure subscription, you begin with zero quota, unlike other Azure services where a default allocation may exists (e.g., compute cores for Virtual Machines). To deploy an AVS private cloud, customers must explicitly request a minimum quota of three hosts . This minimum is required to support vSAN fault tolerance and data redundancy, ensuring resilience during host failures. For example, a cluster with three nodes can handle one node\u0026rsquo;s failure without data loss. It is important to mention here that customers can request additional quota to scale up their existing cluster or provision additional clusters.\nInstructions to request quota\nExploring the Azure Portal for AVS The Azure Portal provides an intuitive experience for managing AVS. Here’s a breakdown of key sections in the service (resource) menu :\nOverview Under Overview you will find few key things you need to be aware of:\nAVS blade in Azure Portal\nJSON View Displays AVS resource properties in plain JSON format. You can select the latest API version and review key resource attributes. Most of these properties are available when browsing the service menu views in the AVS blade in Azure Portal. You may use the the JSON view to get certain information (e.g. find the IP address of vCenter).\nJSON View\nEssentials Essentials section provides some high-level information about the AVS private cloud resource, including: Resource Group, Status, Location (Azure region), Subscription, Tags, Management address block, Availability Zone within the region.\nInfo\nNetwork Address Blocks: AVS private cloud management components requires a minimum of a /22 network address block. Additionally, a /24 address block may be needed for Multipath Input/Output (MPIO) when adding external storage services that use iSCSI technology. A /23 address block might also be required for deploying additional clusters of the AV64 SKU, an Azure fleet SKU. The key consideration when selecting these network address blocks is ensuring they do not overlap with other networks, such as on-premises networks, Azure Virtual Networks (vNet), or Azure Virtual WAN (vWAN) hubs which may be connected to your AVS private cloud resource.\nGet started and Tutorials At the button of the page you will find two sections for Get started and Tutorials which provide helpful links to get you started learning about the service.\nGetting started\nActivity Logs Activity Logs provide an audit trail of changes and operations on the AVS private cloud, ensuring traceability. This is similar to other Azure Resources.\nActivity Logs\nAccess Control (IAM) Similar to other Azure resources, AVS provides Access Control (IAM), where you can assign various levels of access, such as Owner, Contributor, Reader, or custom roles.\nInfo\nIt’s important to note that these permissions apply only to the Azure resource itself and are used to manage properties exposed through Azure APIs. They do not affect workloads within the VMware vSphere environment, such as VMs, network segments, or other vSphere resources. Permissions for those resources are managed separately through vCenter (vSphere Client) and NSX Manager.\nDiagnose and Solve Problems This section offers troubleshooting tools and common problem resolutions. You can also see the most recent Azure health events if any. You can configure service health alerts rules, notifying relevant personnel of Azure health events related to AVS. This is similar to other Azure Resources.\nHealth events\nLocks Similar to other Azure services, the Lock feature can be found under Settings. This feature helps prevent users from accidentally deleting or modifying resource properties by making them read-only.\nDelete Lock: Prevents deletion of AVS private cloud instance regardless of the user roles and RBAC permissions. Read-only Lock: Prevents unintended changes to resource properties to avoid unplanned interruptions. Info\nEnabling locks is a best practice for production environments. Keep in mind that only the Owner or User Access Administrator built-in roles can create or delete management locks.\nUnique Features of AVS in Azure Portal The AVS blade includes service-specific management sections:\nManage This section allows you to manage AVS private cloud specific configurations.\nConnectivity AVS offers multiple connectivity options to integrate with the Azure ecosystem and on-premises environments to enable hybrid cloud or full data center evacuation:\nAzure vNet Connect: This helps connecting the AVS private cloud to an Azure Virtual Network (vNet) through an internal ExpressRoute connection. This is just a shortcut method, see the next bullet for configuring the same connectivity manually. As a cost advantage there are no charges for the internal ExpressRoute connectivity.\nExpressRoute Authorization: Provides the ability to request an Authorization Key, required to establish an ExpressRoute connection with the AVS-provided ExpressRoute circuit. This section also allows you to retrieve the ExpressRoute Circuit ID and Private Peering ID for configurating connectivity to Azure vNet or vWAN hub.\nExpressRoute Authorization Keys\nExpressRoute Global Reach: This option is ideal for customers with existing ExpressRoute connectivity to Azure and do not have complicated network inspection requirements. Where it enables connectivity between the private peerings of two ExpressRoute circuits, such as:\nOn-premises to Azure. AVS private cloud. This can also be helpful for connecting multiple AVS private cloud instances located in different regions. But be mindful that Global Reach is not available in all Azure regions.\nClusters This sections enables you to manage AVS clusters:\nAdd or remove hosts (nodes) in existing clusters (e.g. add AV64 clusters for capacity expansion.) Deploy new clusters (minimum of three hosts in each). Delete existing clusters if no longer used. Here are couple considerations to keep in mind:\nCurrently, AVS private cloud needs to have the first (aka seed or initial) cluster of AV36 or AV36P, and expand capacity by adding AV64 clusters (recommended). Leveraging AV64 is the only time you can mix SKUs in the same AVS private cloud deployment. For AV64, an additional management address block need to be configured under Extended address block accessible from the Clusters section.\nTo add additional hosts, make sure you have enough quota. You may need to request additional quota when you expect to add capacity. Hosts will be added to an existing cluster in parallel, it takes about 30 minutes.\nAdding 2 nodes to existing cluster\nAdding a new cluster of 3 nodes\nEncryption That is where you can configure AVS private cloud to use a customer managed key (CMK) stored in Azure Key Vault for encrypting (wrapping) vSAN Key Encryption Key (KEK). It worth noting that for regulated industries you can use Azure Key Vault HSM protected keys or Azure Managed HSM which can provide FIPS 140-2 Level 2 or 3 protection.\nVMware Credentials That is were you can access the CloudAdmin credentials for vSphere client (vCenter Server) and NSX Manager. You can also rotate the passwords for those credentials. It worth mentioning that rotation can be automated. For example, you can use Azure Logic App to achieve that.\nFrom this section you can also you can grab the Web Client URI for both of vCenter Server and NSX Manager, and since these URI are TLS (SSL) encrypted, you can check the Certificate thumbprint if needed.\nAVS VMware Credentials\nIdentity That is where the user can enable system-assigned managed identity for the AVS private cloud. The main use case for this today is to grant AVS instance access to an Azure Key Vault when enabling Customer Managed Keys (CMK) for vSAN KEK encryption.\nEnable Azure System Assigned Managed Identity\nStorage That is where you can attach additional datastores to the AVS private cloud instance. Today, through this section you can attach pre-provisioned Azure NetApp Files or Azure Elastic SAN volumes.\nThe benefit of doing this is to allow expanding the AVS private cloud storage without adding additional hosts just for meeting storage requirements.\nIt worth noting that Pure Storage has an integration with AVS as a datastore as well that can be enabled separately.\nExpanding storage with additional datastores from other providers\nPlacement Policies That is where you can define VM placement policies, i.e. specifying where the VM need to be or not, such as:\nVM-Host Affinity/Anti-affinity VM-VM Affinity/Anti-affinity These policies can optimize licensing costs (e.g., SQL Server, Oracle).\nAzure Hybrid Benefit This is where you can create VM-Host affinity policy to take advantage of an already paid Software Assurance-enabled SQL server license applying it to AVS host/s.\nAdd-ons That is were you can start configuring three main solutions for AVS including:\nAdd-ons overview\nVMware HCX which is the primary solution used for migrating workloads to AVS. The license for HCX is include in AVS. Access a click-through demo to experiment migrating VMs using VMware HCX to AVS Deploy VMware HCX for an AVS Private Cloud\nVMware SRM (which is being re-branded to VMware Live Site Recovery) which is an easy to enable disaster recovery solution for AVS. But you will need to purchase license from Broadcom. Access a click-through demo to experiment protecting VMs with VMware SRM and AVS Azure Arc which is an Azure native service, when enabled for AVS it helps managing and operating VMs on vSphere making the experience very similar to native Azure VMs. It enables Create, Read, Update and Delete (CRUD) operations via the Azure APIs (including Azure Portal).\nvCenter Server Inventory This is only enabled if the AVS private cloud is Arc-enabled. Through this section, you can view existing VM deployed on AVS vSphere, you can also create or delete VMs. You can also Arc-enable these VMs, and take all advantages of Arc-enabled Servers including integration with Azure Monitor, Azure Update Manager, Windows Admin Center, Run Command, Defender for Cloud, etc. Also, you can view and Azure-enable Resource Pools/clusters/hosts, Networks, Templates, and Datastores.\nAccess a click-through demo to experiment the capabilities of Arc-enables AVS Azure Arc-enabled Servers\nWorkload Networks This is where you can manage some of the NSX configurations:\nSegments: These are the NSX segments. Generally speaking, if you are coming from an Azure networking background, these are very similar to Virtual Network subnet. You will be able to create new ones, update or delete existing ones.\nAdding a new NSX Segment\nDHCP: You can configure NSX tier-1 gateway DHCP configurations from here. DHCP is an NSX managed feature. You can create a DHCP server or relay. You will need DHCP configurations when you create a segment, so you can assign IPs automatically to VMs in that segment.\nDNS: Similar to DHCP, its a managed feature in NSX. You will be able to create or configure DNS zones, and eventually configure the managed DNS service.\nInternet connectivity: This provides mutually exclusive options for Internet connectivity:\nDo not connect or connect using default route from Azure: If not default route for quad-zero (i.e. 0.0.0.0/0) is advertised from an Azure vNet or Azure vWAN, then there will be no connectivity to Internet (as if Internet connectivity is disabled). Connect using SNAT: This is the most simple way to configure outbound Internet connectivity through a managed SNAT service. You may use it in a testing environment, or ,less commonly, if you have no requirements for Internet traffic inspection. Connecting using Public IP down to NSX Edge: With this option you can leverage provisioning a IP address block of Azure Public IP addresses assigned to NSX tier-1 gateway, where you can configure SNAT and DNAT for outbound and inbound Internet connectivity. Internet connectivity options\nOperations That is where you can verify if Azure Arc is configured properly. You can also find Run Commands. Run Command is feature that you may see in other Azure resources such as VMs, it lets you perform operations that would normally require elevated privileges through a collection of PowerShell modules and cmdlets. These privileged operations are not part of what the default CloudAdmin role can perform. For example, you can configure Storage Policies, integration with External Identity Providers (LDAPS), Restart HCX Manager, Provision DR solutions like JetStream, Zerto, and other operations. Last part here is Maintenance section, which allows the you to configure service health alerts, find out any future upgrades or changes to the VMware components, and potentially reschedule a scheduled maintenance operation to avoid any interruptions.\nAVS available Run Commands\nMonitoring and Diagnostics Similar to other Azure resources, you will notice the following sections:\nMetrics: Track and monitor things like CPU, memory, datastore, etc. utilization. AVS Metrics\nAlerts: Configure Alert rules and Action groups based on certain Metrics, Logs, Resource Health, etc. Diagnostic Settings: Export syslog and metrics to destinations like Azure Log Analytics, Azure Storage, etc. Export Diagnostic Settings to Azure Log Analytics\nAdvisor recommendations: There is more to be added here, but currently the most popular recommendation you may get here is “New HCX version is available for upgrade”, as it is a best practice to keep HCX up to date (at both sites). Keep in mind that it is your responsibility to manage HCX upgrades. Example for Advisor Recommendation to upgrade HCX version\nHelp Last but not least, under Help, you will find Resource health where you can monitor the health of the whole service. And most importantly, you will find Support + Troubleshooting this is the section where you can open support ticket if you are running into any issues with the service. Since AVS is a Microsoft first-party service, you contact Microsoft for any support related to AVS components.\nFinal Thoughts AVS combines the familiarity of VMware with the scalability of Azure, offering a seamless private cloud experience. While it integrates tightly with Azure’s ecosystem, its unique requirements, such as quotas, network planning, and specialized management options, make it crucial for administrators to understand the AVS lifecycle. Beside the Azure Portal experience, there are other ways to manage AVS including:\nAzure CLI with vmware extension PowerShell with Az.VMware module REST API for AVS Next blog post will present the VMware experience of Azure VMware Solution. Stay tuned!\nJoin AVSPros if you\u0026rsquo;re not a member yet!\n","permalink":"https://cloudclue.blog/posts/avs-for-azure-expert/","tags":["AVS","VMware","Azure","Azure Champ","Level 200"],"title":"Azure VMware Solution for Azure Experts"},{"categories":null,"content":"Husam Hilal is a Partner Solution Architect at Microsoft, where he is part of the Global Partner Solution (GPS) organization. With over 6 years at Microsoft and 15 years in the IT industry, Husam has accumulated a wealth of experience in various roles. His expertise is particularly strong in Azure Infrastructure innovation, especially around Azure VMware Solution (AVS).\nIn his current role, Husam focuses on empowering partners by designing and implementing Microsoft Azure solutions that drive customer success. He is deeply committed to solving business challenges with technical solutions, aiming for exceptional outcomes for both customers and partners.\nHusam is an active contributor to several technical communities. He leads initiatives such as the AVS Pros community on LinkedIn and leads contribute to AVS Labs , a set of scripts to build AVS labs. He is also involved in contributing to AVS Hub, offering valuable resources to the community. You can connect with him on LinkedIn or check out his content on YouTube ","permalink":"https://cloudclue.blog/about/","tags":null,"title":"About"},{"categories":["Microsoft Azure"],"content":"Background In many occasions you will face the need to connect to an Azure Storage Account from an Azure VM (or VM Scale Set).\nProblem It can be through using some PowerShell script to connect to an Azure Storage Account to store or retrieve some data such as a blob within a container. At the same time, you would like to store blobs securely and avoid having public accessible blobs. You are more likely want to avoid the need to create Shared Access Signatures (SAS tokens), or even expose and manage the Storage Account Access Keys.\nSolution Well! The solution to that is through authenticating to the Storage Account using Azure Managed Identities.\nThere are two two types of Azure Managed Identities: an Azure artifact that is backed with autonomous Azure EntraID Service Principal that is employing self-managed credentials:\nSystem assigned managed identity: It\u0026rsquo;s a mapped identity to the resource (1-1 relationship), where the lifecycle of the identity is tied to the lifecycle of the Azure resource itself, it\u0026rsquo;s an Azure responsibility. User assigned managed identity: It\u0026rsquo;s an independent identity that can be assigned to multiple Azure resources (1-∞ relationship), making it flexible. However, the lifecycle of the identity is managed separately from the resources, it\u0026rsquo;s a Customer responsibility. In this post, I will demonstrate using user assigned managed identity as it has various implementation scenarios. Before you start make sure that you have created a User assigned managed identity and assigned it to a VM in Azure.\nYou\u0026rsquo;ll notice the following in the example script snipper below:\nThe following are the PowerShell modules needed to run the used cmdlets. Make sure to install them wherever you are running the script:\nAz.Accounts : Connect-AzAccount\nAz.Storage : New-AzStorageContext, New-AzStorageContainer, Set-AzStorageBlobContent\nAz.ManagedServiceIdentity : Get-AzUserAssignedIdentity\nUsing parameter -Identity in Connect-AzAccount is the secret that allows us to leverage managed identities. Providing the other parameter -AccountId is necessary only when there are more than one Managed Identity linked to the Azure resource, to solve the confusion. Otherwise the first managed identity in the list will be selected by default. In other words, it\u0026rsquo;s not necessary if you are using only one user assigned managed identity or if you are using system assigned managed identity.\nThe cmdlet Get-AzUserAssignedIdentity was used to retrieve the ClientId of the managed identity. If you provide that value directly, then this line won\u0026rsquo;t be necessary. Also, you would need to assign the managed identity Reader access over the resource group it belongs to.\nWhen creating the Storage Account context, we needed to use the parameter –UseConnectedAccount to authenticate using OAuth Protocol. After creating the context, then you will continue interacting with Azure Storage Container similar as you do typically.\nThe permissions required to allow the managed identity to create a container and store a blob inside is Storage Blob Data Contributor.\n$resourceGroupName = \u0026#39;\u0026lt;resourceGroupName\u0026gt;\u0026#39; $managedIdentityName = \u0026#39;\u0026lt;managedIdentityName\u0026gt;\u0026#39; $storageAccountName = \u0026#39;\u0026lt;storageAccountName\u0026gt;\u0026#39; $newContainerName = \u0026#39;\u0026lt;newContainerName\u0026gt;\u0026#39; $uploadFilePath = \u0026#39;\u0026lt;uploadFilePath i.e. c:\\temp\\image.png\u0026gt;\u0026#39; $fileName = $uploadFilePath.Split(\u0026#39;\\\u0026#39;)[-1] #the following couple lines are optional if you are providing the ClientID directly Connect-AzAccount -Identity $managedIdentity = Get-AzUserAssignedIdentity -ResourceGroupName $resourceGroupName -Name $managedIdentityName #using -AccountId is only necessary when you have multiple managed identities linked to the Azure resource (i.e. Storage Account) Connect-AzAccount -Identity -AccountId $managedIdentity.ClientId $storageAccount = New-AzStorageContext -StorageAccountName $storageAccountName –UseConnectedAccount $container = New-AzStorageContainer -Name $newContainerName -Context $storageAccount.Context -Permission blob Set-AzStorageBlobContent -File $uploadFilePath -Container $container.Name -Blob $fileName -Context $storageAccount.Context As you noticed from the script-snippet above that there was no credentials, passwords, passphrases, secrets, keys or certificates exposed. That\u0026rsquo;s a big advantage of using managed identities, especially when storing scripts in code repository 😉 Think about it as the password-less infrastructure experience. That\u0026rsquo;s the beauty of Azure Managed Identity!\nNote: The same approach is achievable through Azure CLI. You\u0026rsquo;ll just need to use the equivalent commands.\nI hope this was a help introduction to start leveraging managed identities in your scripts.\n","permalink":"https://cloudclue.blog/posts/azure-managed-identity-storage-access/","tags":["Storage Account","PowerShell","Managed Identity","Security","Azure Champ","Entra ID","Azure"],"title":"Using Azure Managed Identity to access Azure Storage Account using PowerShell"},{"categories":null,"content":"","permalink":"https://cloudclue.blog/manifest.json","tags":null,"title":""},{"categories":null,"content":"","permalink":"https://cloudclue.blog/search/_index.de/","tags":null,"title":""},{"categories":null,"content":"","permalink":"https://cloudclue.blog/search/_index.fr/","tags":null,"title":""},{"categories":null,"content":"","permalink":"https://cloudclue.blog/search/_index.hi/","tags":null,"title":""},{"categories":null,"content":"","permalink":"https://cloudclue.blog/search/_index.jp/","tags":null,"title":""},{"categories":null,"content":"","permalink":"https://cloudclue.blog/search/_index.nl/","tags":null,"title":""},{"categories":null,"content":"","permalink":"https://cloudclue.blog/search/_index.pl/","tags":null,"title":""},{"categories":null,"content":"","permalink":"https://cloudclue.blog/search/_index.ru/","tags":null,"title":""},{"categories":null,"content":"","permalink":"https://cloudclue.blog/search/_index.zh-cn/","tags":null,"title":""},{"categories":null,"content":"","permalink":"https://cloudclue.blog/tags/custom/custom/","tags":null,"title":"CustomTag"},{"categories":null,"content":"Husam Hilal es un Partner Solution Architect en Microsoft, donde forma parte de la organización Global Partner Solution (GPS). Con más de 6 años en Microsoft y 15 años en la industria de TI, Husam ha acumulado una gran experiencia en diversos roles. Su experiencia es especialmente destacada en la innovación de infraestructura en Azure, particularmente en Azure VMware Solution (AVS).\nEn su rol actual, Husam se enfoca en empoderar a los socios mediante el diseño e implementación de soluciones de Microsoft Azure que impulsen el éxito de los clientes. Está profundamente comprometido con resolver los desafíos empresariales mediante soluciones técnicas, con el objetivo de lograr resultados excepcionales tanto para los clientes como para los socios.\nHusam es un contribuidor activo en varias comunidades técnicas. Lidera iniciativas como la comunidad AVS Pros en LinkedIn y contribuye al desarrollo de AVS Labs , un conjunto de scripts para crear laboratorios AVS. También participa en AVS Hub, ofreciendo valiosos recursos a la comunidad. Puedes conectar con él en LinkedIn o revisar su contenido en YouTube ","permalink":"https://cloudclue.blog/es/about/","tags":null,"title":"Sabre"}]