Author: Mike Parker

Exploring Certifications: Microsoft Azure Administrator Associate

December 22, 2023 / Mike Parker / 1 Comment

For many Azure learners, the next logical certification to train for after completing Azure Fundamentals is Azure Administrator Associate. Whereas Fundamentals will provide an overview of cloud concepts and a broad insight into Azure services at a very high level, the Administrator certification is more in the nuts and bolts of popular Azure services covering compute, storage, networking, security, governance and backup.

Let’s look at this certification in more detail.

Who is this certification for?

As the name may suggest, the Azure Administrator certification is for those who want to demonstrate practical skills in using Azure. Moving away from the conceptual view that Azure Fundamentals provides.

A candidate may have been using Azure for some time and wants to validate their skills. Alternatively, if someone is an IT professional working with on premises technology or has existing skills with another cloud provider, then gaining skills on Azure provides them and their organisation with options to move workloads into the cloud or devising a multi cloud strategy.

*A cloud administrator is a hands-on role so practice using the services*

Passing the AZ-104 exam is also one of two exams you need to pass to gain your Microsoft Certified: Azure Solutions Architect Expert and Microsoft Certified: DevOps Engineer Expert badges, once you have also passed the AZ-305 and AZ-400 respectively. Whilst the latter can also be obtained by passing the AZ-204 (Azure Developer) instead, the fact you can unlock two expert level certifications with this one associate level cert, it makes strong choice to give yourself the most future opportunities, depending on your interests.

Exam requirements

To obtain the Microsoft Certified: Azure Administrator Associate certification, you have to pass a single exam, AZ-104: Microsoft Azure Administrator. There are no prerequisite exam or certification but if you haven’t already, why not attempt the AZ-900, Azure Fundamentals exam first? Whilst at a higher level, the fundamental learning path has some crossover and would enhance your understanding.

Microsoft associate level certifications expire after one year, so they will require a yearly renewal assessment which can be completed as soon as six months before expiry. The renewal assessment is free and there is usually some modules Microsoft presents for you to study before taking the assessment. It is recommended to go through the modules as the idea of the certification renewal is to be up to date with your knowledge, and Microsoft shapes the content to cover new features and concepts. Be sure to take the assessment in plenty of time, so if you fail, you can take it again before it expires – you can take it as many times as you need.

Microsoft role-based (associate, speciality and expert, not fundamentals) exams are now open book, meaning you will have access to the Microsoft Lean website for the exam. There isn’t extra time given for using it, which forces the candidate to use it sparingly, but it may help on a question such as help recalling some CLI or PowerShell syntax for a given task.

Topics covered

As well as some perquisite subjects including Azure Resource Manager, ARM Templates, CLI and PowerShell, the five header learning path topics for the Azure Administrator Learning Path are Manage identities and governance in Azure, Implement and manage storage in Azure, Deploy and manage Azure compute resources, Configure and manage virtual networks for Azure administrators and Monitor and back up Azure resources. Let’s look at each section in more detail.

The first topic is Manage identities and governance in Azure which has a big emphasis on Microsoft Entra ID (formally Azure Active Directory). Entra ID is Microsoft’s Directory and Identity Management service in the Azure cloud, part of the wider Entra Identity and Access Management (IAM) solution. Moving into the practical parts of this section, the candidate is expected to know about user and group management, including administrative units there is also a need to understand guest accounts via Entra B2B. The learning path then moves onto Azure subscriptions and covers cost management and resource tagging. To implement guardrails, Azure policy is used to set what is allowed to help with cost and compliance considerations and can be set at management group, subscription or resource group level and are hierarchical. There is a big emphasis on role-based access control (RBAC) which generally is the best practice method of assigning permissions to resources. Lastly for this section there is self-service password reset which allows users to initiate their own password reset to cut down on administrator burden.

Next up is Implement and manage storage in Azure, in which the candidate will need to know about storage accounts and how they are used and secured. The first module in this learning path is configuring storage accounts, having a knowledge of blobs, queues, files and tables and their use cases. An important part in this section is storage replication strategies – it is highly likely to feature in the exam as will public and private network access considerations. Blob storage is a major part in all public cloud offerings so it’s no surprise there’s a whole module in the learning path and another high probability of being in the exam. Being able to understand and implement the different blob access tiers, including using lifecycle management rules is important. This is followed by deploying and managing Azure Files for NFS/SMB file sharing and using Azure File Sync for using as a file cache via prem or cloud-based Windows servers. The major security focus for storage is on Shared Access Signatures (SAS). To conclude the storage path, there’s a section tools and services, namely Azure Storage Explorer, Azure Import/Export service and AZcopy.

Azure Shared Access Signatures — *Creating a Shared Access Signature token in the Azure portal*

A big subject area is the next topic, Deploy and manage Azure compute resources which currently makes up 20-25% of the exam. Beginning with creating and managing a Virtual Machine in the portal and CLI, with an emphasis on ensuring the candidate knows about correctly sizing and choosing the correct storage performance for your requirements. There are sections on availability. This includes availability sets (update domains and fault domains), availability zones, scaling up and out (vertical and horizontal scaling) with a focus on VM scale sets and autoscaling. Moving away from VMs, the learning path includes Azure App Service. On the Microsoft Learn content, it talks about the concept of the App Service Plan – which is the best for your application workload. What is interesting is they list the features and capacity of each of the plans. This may be a tough one to memorise so if there is a question on this, it would be a perfect use of the open book feature of the exam if you got a question for example on what plan gives you the ability to run up to 30 instances and you cannot recall. Other areas in the App Service section are scaling, DevOps best practice including the use of deployment slots, security, custom domains, backing up and restoring, and monitoring your App Service using application insights. The last area covered is Azure Container Instances (ACI) to run Docker images in Azure.

The cornerstone of any cloud project is networking. Whether surfacing an internal application or hosting a publicly accessible website, networking configuration will need to be considered and deployed. Configure and manage virtual networks for Azure administrators is the learning path that covers all things networking. There are many services that fall under the networking umbrella, so there’s a lot to cover in this section. To begin, the virtual network (VNet). The VNet is the focal point for planning many Azure projects. The candidate will need to know about IP addressing and subnetting when building their VNets. Expanding on VNets themselves, virtual network peering is a service to connect virtual networks regionally or globally, even across different Azure tenants. Another area of focus is Network Security Groups (NSGs) which provides IP and port allow and deny rules (OSI layer 3 and 4) at subnet or NIC level. There is a fair amount of DNS items to know about such as DNS zones including private DNS zones to manage and resolve domain names in your virtual network and hosting your domain on Azure DNS. Routing and endpoints are on the skills path, with user defined routes (UDF) and service and private endpoints being essential items to know about as it is highly unlikely one or more of those won’t have at least one question on. To conclude this section, there are two of the Azure load balancing solutions; Azure Load Balancer which works at OSI layer 4 and Azure Application Gateway which is an OSI layer 7 load balancer, making it able to do smart stuff like URL path or multi-site routing and offering the optional Azure Web Application Firewall (WAF) to defend against multiple threats.

*Azure Backup Centre overview – a dashboard to check on backup health*

Monitor and back up Azure resources is the final learning path for this certification. To kick off, Azure backup provides robust, scalable and secure backup solutions for VMs (including SQL and SAP HANA in virtual machines), Azure files, Azure blob storage, Azure managed disks and Azure Database for PostgreSQL server. Azure backup can also backup on premises machines and virtual machines using the Microsoft Azure Recovery Services (MARS) agent. Next, we move to monitoring, and the central hub for monitoring in Azure is Azure Monitor. The candidate is expected to know about logs and metrics that are generated from various Azure services, with a focus on using this data to create alerts when certain thresholds are exceeded. The Log Analytics workspace is generally where the logs and data are stored for Azure monitor. For querying the data, Azure Log Analytics supports the Kusto Query Language (KQL) which is SQL-like and provides fast powerful queries for examining events and exceptions. There are many KQL queries built in to get you started or you can write your own.

Exam hints and tips

This is an associate level exam so it is going to require more detailed knowledge of the subject matter then say a fundamentals exam, which is a broad overview, or expert, which is usually conceptual in nature (think design and planning). As such it going to test your in-depth knowledge on many Azure components. So practice using, or at least watching a demonstration video of the services covered being deployed and administered will give a significant advantage over a mere overview of the product.

Expanding on the previous point, there are often questions regarding putting a set of steps in the correct order, so knowing the sequence in how something is deployed will aid answering this type of question correctly.

Another popular exam format is the case study. A case study section of the exam typically describes the existing and planned status of a fictious organisation’s Azure and wider IT landscape. It will then ask around 4-5 questions that you will look through the information given to determine the correct course of action. Beware, these can burn up time if you aren’t careful. The best way to approach these is skim the info quickly then look at the first question. There is far more detail in the case study then there are questions so looking at the questions soon, you can refer to the most appropriate section to get the answer.

Microsoft exams tend not to ask about detailed facts and figures, such as how much a service costs but there may be questions such as knowing what is the most cost efficient SKU that will unlock a certain feature or level of performance. Sometimes this is hard to train for as it invariably means memorising fine grained details. For this, remember that an associate level exam is open book, allowing you access to the Microsoft Learn website. It could make all the difference to exam success if used correctly – just remember the clock is still ticking down whilst you are looking up and reading content. Expert and specialist exams also are open book – not fundamentals.

At the time of writing, the MS Learn website search isn’t always good at bringing up the best result to the top of the list, so a practice at search terms or learning to swiftly navigate the website via links could be helpful before taking an exam. You cannot go out to an external search engine to help narrow down a page you require – no other websites including other Microsoft website resources are accessible from the exam.

There are more exam hints and tips on the Azure Fundamentals Certification post which also apply to this exam.

Recommended resources

It is a good idea to include Microsoft’s own content for the AZ-104 exam as part of your learning toolkit. Being Microsoft’s official content, they have been careful to cover all areas of the exam skills measured. For some, the official content and some hands-on experience is likely enough to pass the exam, however having a couple of different learning materials broadens coverage and gives the learning process a fresh dynamic.

*John Savill’s Azure training on YouTube is essential viewing*

Becoming a regular mention on the blog, John Savill has an AZ-104 course on YouTube. He knows Azure inside and out and has excellent presentation skills. The study cram itself is incredible and now there is a v2 with updated information. John works for Microsoft and his John Savill’s Technical Training YouTube channel has many useful videos, often organised into playlists for various certifications. This free content is as good if not better than many paid for courses.

Beyond that, there are tons of comprehensive AZ-104 courses on YouTube. It really is incredible what people offer for free and the quality of some of the content. It is worth trying one or two and seeing if you favour a particular presentation style and if it is helping your understanding. When I took the AZ-104 back in 2021, I used a course by Mike Pfeiffer and Tim Warner, which was on Mike’s training website, cloudskills.io but that has since been bought by the training company, INE so I have spent some time looking at what is on offer commercially with a view to knowing something about the provider or presenter. There is a comprehensive course on LinkedIn Learning presented by T Ray Humphrey in conjunction with Microsoft Press. I haven’t done the course, but being a LinkedIn premium subscriber, I have access to LinkedIn Learning and have found the content high quality when studying for other exams. Chase Dov e y presents an AZ-104 course on Pluralsight, which again I haven’t done but I have done other courses with Pluralsight and have consumed learning content with Chase in the past.

Next steps

The Azure Administrator Associate certification is arguably the most useful Azure certification there is. It is heavy on process and the nuts and bolts of using Azure. Therefore, if someone wants to be proficient in creating and maintaining Azure services, this is certainly unbeatable in that respect.

After passing the AZ-104 exam, the candidate could pass just one more exam (AZ-305) to unlock the Microsoft Certified: Azure Solutions Architect Expert certification. Additionally, passing the AZ-400 exam in addition to passing the AZ-104, the candidate will be awarded the Microsoft Certified: DevOps Engineer Expert certification*. These two certifications should therefore be a consideration as a next step.

Beyond that, there are role-based certifications in areas such as Data, Networking, AI and Security which may appeal to those who would like to specialise.

*You can also pass the AZ-204: Developing Solutions for Microsoft Azure exam alongside the AZ-400 to obtain the DevOps Engineer Expert certification instead of the AZ-104.

Spotlight on : Azure Virtual Networks

November 14, 2023 / Mike Parker / 1 Comment

Any major cloud provider will have a strong Networking offering for connecting and securing resources. It is an essential consideration in any cloud deployment, whether using IaaS, PaaS or SaaS services. Depending on the complexity or type of services being used, the administrator’s involvement will range from a general awareness through to a varying amount of planning, deployment and maintenance.

The networking products and services in Azure are vast and one could write a book on the subject – indeed many have. This is a single post so we will focus specifically on a core Azure networking service, the Virtual Network (VNet) and components and services that are specifically for the VNet.

Networking in the cloud is wonderous. Software defined networking abstracts what would-be managed switches, cables and network appliances and allows you to build them with the typing of a few commands or a few clicks of a mouse. Amazing!

Virtual Network (VNet)

The most prevalent part of most Azure architectures is the VNet. Typically deployed to a region where your users or customers are, they provide a base for many Azure services including VMs, Kubernetes clusters, private endpoints for services such as storage accounts, databases and many more. The VNet determines the available IP addresses for your own private network in the cloud. By using different workloads and services within the VNet, you can surface privately and publicly accessible resources to serve your users. A Virtual Network creates a boundary in which you can secure and segregate workloads to suit your requirements.

When a VNet is created, you need to specify at least one RFC1918 private IP range (10.x.x.x / 172.16.x.x / 192.168.x.x) or you can use a public in CIDR format. Whether the address range(s) you create are public or private, the address range is still only reachable only from within the virtual network, from peered VNets, or any on-premises networks that you’ve connected to the virtual network via a site-to-site VPN for example.

You can use IPV6 ranges as well but only in a dual stack setup. You have to have an IPv4 on the Virtual Network and subnets as well as IPv6. The subnets for IPv6 must be exactly /64 in size.

We shall walk through the products and services you may use within the VNet to maximise the benefit.

Subnets

For the VNet to be usable, you will need to create at least one subnet for each CIDR range you specified when going through the creation process. A subnet can cover the VNet CIDR length or be segregated into multiple subnets . You do not need to occupy the whole VNet range if not required, leaving room for new subnets at a later date.

There are some reserved subnet names that are reserved for special services. These include GatewaySubnet, BastionSubnet & FirewallSubnet which are responsible for VPN/ExpressRoute connectivity, VM secure remote access and for hosting the Azure Firewall service respectively. Some will have a minimum or recommended size so be sure to read the documentation before deploying.

Security

Security is a huge part of networking, whether in the cloud or on-premises. So, the provision of security apparatus for virtual networks is comprehensive. We will walk through some of the key security components now.

Firstly, the primary service for securing Azure VNets are Network Security Groups. NSGs contain a set of rules, passed in order of priority, that either allow or block inbound and outbound traffic at OSI layers 3 and 4 (IP address, port and protocol). These Network Security Groups can be assigned to a subnet. The NSG can be assigned to more than one subnet if the rules required for those subnets are the same. You can group VM NICs into an Application Security Groups (ASGs) which simplifies the creation and management of rules for a set of resources in the subnet. You can use service tags to allow or deny whole services within Azure, such as Storage, Backup or Logic Apps, further aiding ease of management.

NSGs can be assigned to a VM’s Network interface (NIC) but it is recommended to apply to the subnet where possible. If an NSG is assigned to the NIC and another to the subnet, the rules will be processed NIC first then subnet for outbound traffic, or Subnet then NIC for inbound. For example, if port 80 inbound is allowed on the NSG assigned to the subnet but blocked on the NSG assigned to the NIC, traffic on port 80 to that host will be blocked but allowed on other hosts who do not have an NSG blocking port 80 assigned to it’s NIC.

NSGs are powerful but are limited to layer 4 filtering. For looking at layer 7, at URLs and web traffic, there is Azure Firewall. Azure Firewall is not only more functional, but it also sits on a subnet of its own and can provide protection for subnets on the same VNet, on other VNets via peering, and for On Premises via a VPN/ExpressRoute connection. It can provide inbound and outbound firewall rules.

Azure Firewall is available in Basic, Standard and Premium SKUs, be sure to check the differences before deploying as they will have varying maximum throughput and features such as web content filtering not available on the Basic SKU and TLS inspection only available on the Premium SKU. Azure Firewall is a first-party Network Virtual Appliance (NVA) but there are other 3rd party NVAs available from the Azure Marketplace. Some allow you to bring an existing licence (BYOL) over so check out those options too.

DDos Protection is running on Azure as standard but there is a paid for service which allows for more features. You can purchase as Network Protection which covers VNets in a subscription, or you can buy per IP address. If you go for Network Protection you get additional features such as DDos rapid response support and cost of data transfer and scale out guarantee (Microsoft reimburses you the cloud consumption costs incurred by the attack).

For web application level DDos protection, you can activate DDos protection on the Azure Web Application Firewall (WAF) which in turn can be used with Application Gateway or Azure Front Door which are both described below.

Services to allow public access to your applications

Whilst it is possible to access a web application via a Public IP address assigned to a VM NIC, this is not considered best practice from a security standpoint, nor will it allow for load balancing or serving workloads that are not on a VM such as containerised services. For best practice, there are 4 main ways of managing inbound access each with their own use case.

First, we have Azure Load balancer. This is an OSI level 4 load balancer which can be set to load balance between different Availability Groups in a given region or across multiple Azure regions with the Global tier. It is a high performance, highly available service options to point to NICs on a VNet or you can specify IP addresses when using the Standard load balancer (the basic SKU has no SLA and isn’t recommended for critical workloads).

If you require regional load balancing but would prefer to work at OSI layer 7, so you can do things like route to different nodes in the server pool based on URL path or domain or want to take the SSL handshake burden off the nodes, then Azure Application Gateway is the service you need. With Azure App Gateway you can activate the Web Application Firewall (WAF) which is the Azure Firewall running within the Gateway. Additionally, in the WAF configuration you can activate DDos protection.

For globally distributed apps, content and websites, you could use Azure Front Door. Whilst not just for resources contained within a VNet, this is a popular use case. Microsoft also describes Front Door as a Content Delivery Network (CDN) because it can route users to the closest region of your app/website. Working at layer 7 it has many features found in Azure Application Gateway such as routing based on URL and having the ability run WAF on Front Door.

Lastly, there is Azure Traffic Manager which again doesn’t have to point to an endpoint contained within a VNet but it is certainly a use case. Traffic Manager is a DNS based load balancer that can work on a global scale. It monitors the endpoints for health like a usual load balancer but this one works by configuring a routing method including Priority which returns the DNS host(s) for a primary service endpoint with backup endpoints if the primary is offline, Performance which will return hosts with the lowest network latency, Weighted is for distributing traffic based on an endpoint’s configured weighting, Geographic will direct users to endpoints based on location which is good for compliance requirements, Multivalve returns all healthy endpoints and allows the client browser/app to select one and finally Subnet routes an end user’s IP address to a specific endpoint. It is worth noting that app traffic does not travel through the Traffic Manager, but Traffic manager serves the client with DNS responses based on the routing method selected from the list above.

Services to support VNet configurations

Azure NAT Gateway is used to give predictable results to outbound traffic for any subnets assigned to it. When setting up the service, you must create or assign a public IP address or an IP prefix to the service. The result of deploying NAT Gateway is you will know the IP address(es) that will be used for external traffic, so you can whitelist services or just know what IP will connect to to make connectivity. You use an IP prefix when your number of systems needing to gain outside access will cause SNAT port exhaustion. A single IP address provides 64,512 ephemeral ports to NAT gateway for connecting outbound. Azure NAT Gateway doesn’t require any custom routing – an assigned subnet is automatically updated with the appropriate routing.

For DNS within a subnet, Azure provides a free DNS service which will register any hostnames in a VNet automatically and take care of everything via the Azure global resolver IP address, 168.63.129.16. There is also Azure Private DNS which allows you to create private DNS zones so you can register DNS entries for multiple VNets for virtual machines, virtual machine scale sets and any other services based on VMs. A private DNS zone allows custom domains instead of the Azure standard ones such as xxx.internal.cloudapp.net. If you have specific needs, you could use your own DNS server solution.

Azure also has public DNS service where you can manage domain names in Azure and all your A, TXT, CNAME, MX etc. record types. You can get your DNS records managed in Azure either by setting up the DNS zone and pointing your domain name to Azure’s nameservers, or you can buy a new domain name in Azure if using Azure App Service.

Azure subnets have a set of default routes which may not suit the use case. You cannot delete the default routes, but you can override them with user defined routes. You can create a route table and assign it to a subnet or multiple subnets. For example, by default there is a 0.0.0.0/0 route that routes all non-internal traffic to the Internet. But say you want to route traffic via Azure Firewall, then a custom route which sets next hop to the NVA would suit this requirement.

If you need to connect two or more Vnets, then the most straightforward approach is to use Azure virtual network peering. Peering is very versatile, with the ability to connect two VNets in the same region or in different regions using global virtual network peering. All traffic travels securely via Microsoft’s backbone infrastructure. With the correct credentials, VNet peering can to VNets on different subscriptions, even different tenants.

To connect two virtual networks, you must ensure each network’s IP range doesn’t overlap, if it does, you must make amendments to one before setting up peering. A common use case for peering is creating a hub and spoke architecture, where one VNet is the hub, containing resources such VPN gateway, Azure Bastion and firewall and the spoke networks connect via the hub to provide connectivity to on premises clients or out to the Internet via the firewall.

Azure Bastion is a great way to securely access to your Windows (via RDP) and Linux VMs (via SSH) without exposing the VMs RDP port/ SSH port to the Internet or having to go via a VPN. Azure Bastion can replace the traditional Jump Box server by allowing secure login via the Azure portal or by creating a Bastion Shareable Link. Bastion works particularly well for administrators, allowing to remote access of individual virtual machines by RDP or SSH.

Secure connectivity to on prem servers and clients and remote workers

The most popular secure connectivity method is the VPN. There are two types of VPN in Azure: site-to-site and point-to-site. One is for connectivity to a whole remote network, and one is for individual client devices to connect to the Azure network. Both connect via a VPN gateway, which runs from a special subnet called Gateway Subnet. There are various SKUs for Azure VPN depending on if you require the VPN to be zone redundant and how much performance you require.

For a site-to-site VPN there are 4 components – a VNet with a subnet called GatewaySubnet. The subnet should be /27 or larger. If you are managing multiple VNets or even if you are preparing for changes later, it may be worth considering this VNet/subnet to be in the hub of a hub and spoke network for ease of management and better security. The main component is the VPN gateway which also provides the point-to-site VPN should you need users to access your Azure resources directly from their devices when, for example working from home. When creating the VPN Gateway, that is where you pick the SKU based on requirements. For each site you are connecting to, you will need to create a local network gateway. A local network gateway is a representation of the remote site. When creating, you will specify the public IP address and the address spaces on the remote LAN. This is what creates the routing to those ranges. Be sure not to overlap remote and Azure address ranges where there needs to be communication. Last step is creating a VPN connection where you configure encryption and security parameters to match your on-premises device configuration. You should ensure your IPSEC and IKEv2 settings give your organisation an acceptable level of encryption as the VPN tunnel will traverse the Internet.

The VPN gateway runs 2 VPN servers, and as default one is active and one is a standby for planned maintenance or should something fail (active-standby). You can however run active-active for more availability. For this configuration, you also need two public IP addresses, one per gateway VM. For maximum availability, you can have 2ll connections each with its own router/appliance at your premises, both connected to both Azure VPN gateway VMs.

Point-to-site connectivity can be to Windows, Mac or Linux devices, using OpenVPN, SSTP or IKEv2, depending on your operating system. Authentication can be done via certificate, Entra ID or an Active Directory Domain Server (using RADIUS).

ExpressRoute is an alternative to VPN where company or regulatory policies dictate no traffic can traverse the public Internet, regardless of encryption. It also allows more predictable results because of the fewer hops required. The connectivity varies from any-to-any (IPVPN) network, a point-to-point Ethernet connection, through a virtual cross-connection via an Ethernet exchange or ExpressRoute Direct. All will have various costs associated and most will require a 3rd party for the provision of the circuit. ExpressRoute connections are highly available and supports bandwidths from 50Mbs to 10Gbs. There are options to connect to a region and just use any resources within that region’s geopolitical area, or globally using ExpressRoute Premium. For cost effectiveness, you can opt to use for resources located in only one region using the ExpressRoute Local SKU which is limited to a single region (not the whole geopolitical area) and includes data egress at no extra cost. ExpressRoute can be used to connect to Azure services or Microsoft 365 services.

To simplify the rollout of connectivity solutions within Azure, you can use Azure Virtual WAN. Using Azure Virtual WAN, you can deploy and manage services from a single interface. Services available include site-to-site and point-to-site VPNs, ExpressRoute connections, interbranch connectivity (via connectivity automation from Virtual WAN Partner devices such as SD-WAN or VPN CPE), routing and Azure Firewall. For just using site-to-site VPN only, there is a basic SKU, for any other services the Standard SKU must be used when setting up Azure Virtual WAN.

Azure Virtual WAN is deployed as a hub-and-spoke architecture. Multiple Azure Virtual WAN deployments can be connected via hub-to-hub connectivity.

Monitoring and diagnostics

There are a multitude of solutions for monitoring and performing troubleshooting tasks for Azure networking. As is the case for most Azure services, Azure Monitor plays a big part in diagnostics and monitoring of the Networking elements of your cloud architecture. From within the Azure Monitor there is a Networks link in the Insights section of the navigation. Here we will look at the various tools available.

The first few tabs in Monitor > Networks are visualisations and summaries of various networking services. On the Health and Metrics tab you can see various services such as Bastions, Virtual Networks, Network Interfaces etc. in a visual form, to quickly see if any of the services are in a degraded or unavailable state. Connectivity is a visualisation of any Connection Monitor Tests created within the Diagnostics Toolkit section. Traffic is the 3rd tab, which is a graphical representation of NSGs that have been configured on an NSG flow log. You also get Traffic Analytics on this view.

The Diagnostic Toolkit menu links to various components contained within Network Watcher, which is a collection of services that help with network and connectivity troubleshooting as well as drive many of the Monitor views discussed previously. Let’s look at each service.

Packet Capture – A popular tool in network engineering, this Azure version provides packet capture for the VMs you specify. By analysing traffic at the packet level, you can understand what data is being sent back and forth from VMs to other resources.

VPN Troubleshoot – Allows you to test for problems with your VPN gateways or connection.

Connection Troubleshoot – This will check TCP connectivity between a VM and another VM, fully qualified domain name (FQDN), URI, or IP address.

Next hop – This feature is a sanity check to ensure routing for a given host is set up correctly. You choose a VM and specific NIC and you can see if the next hop will be Internet, VNet local, VNet peering, Virtual Network Appliance, Virtual Network Gateway or none. It will also inform you if a system or user defined route determined the resulting next hop.

IP flow verify – This will allow us to test if a TCP/UDP connection can be established between a VM’s NIC and a remote host. It uses 5 tuple information (source/destination IP, source/destination port and protocol) which will return if the selected criteria would have passed or been blocked and by what NSG rule or by Azure Virtual Network Manager admin rule.

Effective security rules – With this feature you specify a VM and which NIC on the VM you want to test. It will then calculate all NSG rules applied to the NIC or subnet for inbound and outbound traffic. From that you will be able to ascertain if a given port on a given source/destination IP would be allowed or blocked.

NSG & VNet Flow Logs – You can use these logs to provide visibility about what traffic is being sent from and to your resources. You can use the data to diagnose specific concerns or pipe to a SIEM solution such as Microsoft Sentinel.

Network Topology – This is a tool that will generate a visual representation of your network layout. From VNets and subnets down to the resources within them, you can see what your networking topology looks like and the relationship between resources.

Conclusion

This was an overview of the Azure Virtual Network and associated products and services. If you plan on using any Azure networking components, please check official documentation to ensure best practices and any product updates.

If you want to become highly competent in Azure networking, including but not limited to virtual networks, then following the Microsoft AZ-700 exam learning path is a great place to start. If after digesting the material on MS Learn and other resources such as an online course, you could choose to sit the the Exam. If you pass, you will become a Microsoft Certified: Azure Network Engineer Associate.

Exploring Certifications: Microsoft Azure Fundamentals

September 21, 2023 / Mike Parker / 2 Comments

Microsoft describes this certification on the certification page as follows: This certification validates your foundational knowledge of cloud concepts in general and Azure in particular. As a candidate for this certification, you can describe Azure architectural components and Azure services, such as compute, networking, and storage, as well as features and tools to secure, govern, and administer Azure.

An excellent introduction. Let’s look at this certification in more detail.

Who is this certification for?

When thinking about the list of who should have this certification, it would be easier to list who it isn’t for. It really is for practically anyone. Let’s list some examples:

The most obvious is someone starting in the cloud; either as a speciality or as part of a wider IT learning strategy. Whilst this is a Microsoft specific certification with a focus on Azure, a large part of it covers a lot of cloud concepts in general such as Capex vs Opex, IaaS, PaaS, SaaS, shared responsibility and so on.

Another ideal candidate for the Azure Fundamentals certification would be someone who is migrating from another cloud provider or is looking to become a muti-cloud professional. Whilst this individual will know, and be able to skip the general cloud terms sections, the Azure Fundamentals learning path covers a broad spectrum of Azure products and services and will be the quickest route to getting an overview before deciding what areas to dig deeper next.

An individual who works with Azure for their job but only at a high level would find the Azure Fundamentals learning path useful from a context and overall understanding of the technology point of view. Consider a project manager or an executive who are leading teams in delivering solutions for the company. Whilst they may not be deploying services in the cloud themselves, for discussions around choosing an approach to a task or getting project updates from their team, its good to be across the terminology and capabilities used in the cloud. Whether its containers vs IaaS or virtual disks vs blob storage, knowing the differences will help the organisation become more agile.

Exam requirements

To obtain the Microsoft Azure Fundamentals certification, you must pass a single exam, AZ-900: Microsoft Azure Fundamentals. There are no prerequisite certification requirements, so this is a great standalone certification to start your Azure journey. Microsoft Fundamentals certifications have no expiry, so they won’t require a yearly renewal unlike associate, specialist and expert level certifications which do.

Topics covered

The learning path (exam objectives) are often changed and updated, but at the time of writing, Microsoft has wrapped the “stuff to know” into 3 main areas.

Describe cloud concepts, as the name suggests, is general cloud terminology, not specific to any particular cloud vendor. It walks through the benefits of cloud over on premises solutions (TL:DR – most organisation’s own facilities will not be able to achieve anything like the security, reliability, manageability and scalability that a public cloud can).

After studying this section, the student will be able to understand the foundation of cloud computing including the shared responsibility model, consumption-based resources, how the cloud can bring reliability, elasticity and security to workloads. The describe cloud concepts section concludes with understanding the pros and cons of the cloud service types, which are Infrastructure-as-a-service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-service (SaaS). There are others such as FaaS, DaaS, CaaS etc. but only the broad ones are covered in this learning path.

The next section is describe Azure architecture and services. For me, this is the most enjoyable part of the learning experience because we are now looking at actual products and solutions to host your workloads on the Azure cloud. Beginning with the core architectural components, you will learn about user accounts, management infrastructure and how a resource is created.

Then we look at the compute and networking services which are at the heart of just about any Azure subscription. From Virtual Machines (VMs) which are often used for lift-and-shift migrations from on prem to cloud, through to more cloud native solutions such as containers and function apps. Virtual networks, DNS and connectivity options are covered to begin understanding how software defined networking is woven into the cloud architecture. Azure storage is covered, looking at a core component, the storage account, and more details about storage such as various options for varying levels of redundancy and cost, depending on the requirements. Storage is wrapped up with data movement and migration services.

The architecture and services section is concluded by ensuring you have an understanding of identity, access, and security. The most important subject here in relation to understanding the cloud vs the traditional on premises model is the zero-trust model; with devices and users potentially working from many locations around the globe, security is no longer considered at the edge of the office’s firewall but is built around identity. This part covers Azure specific services related to security, including Azure Active Directory (now called Entra ID), external identity management, conditional access and role-based access control (RBAC) which sets the permissions for users, groups, apps or service principals.

Describe Azure management and governance is the third and final section of the AZ-900 syllabus and it covers a lot of ground. A large section is dedicated to knowing how to get on top of costs. In an Opex / consumption model, it is particularly important to be on top of costs. As well as learning about factors that affect cost such as resource type and geography, there are some tools specifically to look at costs. Pricing Calculator and Total cost of ownership (TCO) calculator are discussed here. When looking at governance and compliance features, the focus is on Azure Policy and resource locks for creating guardrails on your Azure tenant. For a focus on data, Microsoft Purview is for finding and classifying data from multiple storage areas such as M365, Azure storage or another cloud provider. The material continues to the Service Trust Portal which is a resource covering many standards of compliance in relation to Azure such as ISO, GDPR and PCI. For the deployment topic, the learning path relates to ways to interact with Azure, namely the Azure Portal, PowerShell and CLI. Azure Arc is for managing on premises and other cloud provider resources within Azure, and ARM Templates and Bicep are Infrastructure as Code (IoC) solutions which offers repeatable, predictable results when deploying resources and reducing the chance of human error when deploying resources manually. And for the last module in the Azure management and governance learning, we focus on monitoring tools, namely Azure Advisor, Azure Monitor and Azure Service Health.

So you see there is a very broad spectrum of topics, but don’t be discouraged. Questions in the exam will relate to high level matters such as what service is used for going through your data and classifying any personally identifiable information or what would you use to ensure resources are only deployed in the US East region? You will not be asked how you go about writing an ARM template for example.

Exam hints and tips

First tip is don’t be fooled by the word Fundamentals. Whilst it should be a relatively straightforward exam to pass compared with associate, speciality or expert level certifications, if you haven’t studied all the subjects covered in the learning path, you may not pass. The exam is fairly broad, so you need to keep a fair amount in your head.

Microsoft have now made all role-based exams “open book”, meaning you can access Microsoft Learn content during the exam, but not for fundamental level exams. So you can’t look anything up and will need to rely on your obtained knowledge only for the exam.

A great tip from Tim Warner for Microsoft exams in general is always complete all the questions. Even if its a guess, you may get it right – you will definitely get it wrong if you don’t answer. There are no negative points for a wrong answer and some multi part questions such as “pick 3”, will give you some points for a partially correct answer.

Exams can be taken at a test centre or at a place of your choosing via a webcam enabled computer. If you have never taken an exam before, do try the Microsoft exam sandbox, which gives you an interactive experience of what to expect and the format the questions could be served. You have enough to think about in terms of using your obtained knowledge to achieve exam success, so you want to be as comfortable about the exam nuts and bolts as possible.

Read the question carefully. Another general tip is don’t lose points by making silly mistakes. Obvious things would be mixing up “which solution would not” and reading “which solution would” for example.

Recommended resources

The first resource I will always recommend is following Microsoft’s own content on for the AZ-900 exam. Known as a collection, it takes a number of learning paths, with modules in each path that specifically follow the exam syllabus. The content is very good and there’s great reassurance in consuming everything provided for you by Microsoft themselves.

Next up is John Savill’s AZ-900 Azure Fundamentals Certification Course. John works for Microsoft and his John Savill’s Technical Training YouTube content is legendary. He does whiteboarding of the subjects along with practical demonstrations. The course is organised as a playlist and currently contains an amazing 65 videos (9 hours’ worth). I have paid for a lot of courses in my time, and John’s content is as good as, sometimes better than the courses provided by training providers. What’s more, John does it as a passion to help others, he doesn’t monetise the videos, despite them being as good as they are. If you are short on time, I think if you have already read through Microsoft’s content, John’s AZ-900 study cram on its own would likely get you over the line. However, if you have the time, I recommend watching all videos in the playlist. So much of the material will give you a solid base for continuing your learning journey after you pass the AZ-900 exam.

I took and passed my AZ-900 exam in December 2020. It was the first Microsoft certification I did and at the time John Savill’s AZ-900 videos did not exist. One of the best resources I used at the time was Adam Marczak’s Microsoft Azure Fundamentals (AZ-900) Full Course on YouTube as part of his Azure for Everyone channel. Adam is a Microsoft MVP and is a great communicator. The graphics he uses in his videos are brilliant and he got me over the line watching his videos. Some are several years old now but the regular video comments, thanking him for getting them through the exam shows his content is still relevant. Whilst Azure does develop at a fast pace, the concepts of cloud computing and the popular Azure services on a high level are still the same.

Next steps

Once you have passed your AZ-900 exam and have your Microsoft Certified: Azure Fundamentals badge, what’s next?

It all depends on the individual and what their goals are. If you only required an overview of cloud and Azure specifically, you could walk away proud you can demonstrate your knowledge at this level. If you want to progress further, then your choices will depend largely on your job role, job you are working towards or just where your interest lies.

However, if there is to be a next step that ticks many boxes, the Most popular choice must be Microsoft Certified: Azure Administrator Associate.

Two reasons for this. Firstly, after learning the concepts in Fundamentals, no doubt you will want to try Azure and maybe start to leverage it in your organisation. Working through Azure Administrator certification path should give you enough skills to deploy, secure and monitor a good number of the popular services in Azure.

Second, it opens a path to two expert level certifications; Microsoft Certified: Azure Solutions Architect Expert and Microsoft Certified: DevOps Engineer Expert*. Both certifications require a second exam to get the expert badge (AZ-305 and AZ-400 respectively), but the ability to potentially obtain two expert certifications via the AZ-104: Microsoft Azure Administrator exam has to be a great move for your personal development.

* You can also pass the AZ-204: Developing Solutions for Microsoft Azure exam alongside the AZ-400 to obtain the DevOps Engineer Expert certification instead of the AZ-104.