microsoft/mcw-enterprise-ready-cloud

MCW Enterprise-ready cloud

This workshop is archived and is no longer being maintained. Content is read-only.

Enterprise-ready cloud

Trey Research is a manufacturing company that builds consumer products with 29.6 billion USD in annual revenue. Trey's headquarters are in New Jersey, but they have data centers and branch offices scattered across the United States; with several major offices in the United Kingdom, France, and Japan.

Even as large as it is, Trey seeks to maximize the cost-effectiveness and flexibility of its IT, especially in new projects and business units. With a dizzying number of existing business units; each with their own unique requirements from IT and ballooning costs from internal hardware and data center investment, Trey is looking to the cloud.

Trey is interested in a large-scale solution that will help mitigate creeping costs and start the transition to a modern cloud-based enterprise architecture using a solid set of controls for governance.

June 2020

Target audience

• Infrastructure Architect

Abstracts

Workshop

In this workshop you will create an Azure Cloud Governance plan to advise a manufacturing company of the features available in Azure. You will discover features to bring governance to their Azure deployments, distributed administration, and allowance for secure remote connectivity and development work for their offshore developers.

At the end of the workshop, you will be better able to design a governance plan to showcase the security and governance features of Azure and control costs. In addition, you'll learn how to provide for cost tracking by business unit, environment, and project, provide for a distributed administration model, put a service catalog in place to prevent deployment of unsupported Azure services, and put controls in place to allow deployment of services only in specific regions. You will also learn how to deploy and manage your Azure subscriptions from a tenant level through Management groups and Azure Blueprints.

Whiteboard Design Session

In this whiteboard design session, you will work in a group to design a comprehensive solution to address concerns about cost management, security, subscription and resource management, identity, deployment, and other areas to help apply an enterprise governance model for Trey Research.

At the end of this whiteboard design session, you will be better able to design a governance plan to showcase the security, governance, and cost management features of Azure. In addition, you'll learn how to provide cost tracking and alerting by business unit and environment, implement a distributed administration model, and control the deployment of Azure services, all delivered at scale across a large enterprise.

Hands-on Lab

In this hands-on lab, you are working with Trey Research to setup some best practices regarding policies, permissions, and management of subscription artifacts such as Policy and Azure Resource Manager templates through Azure Blueprints. Tasks include creating scripts that Enterprise IT will use to automatically set policy and delegate permissions when a new subscription is created. You will help them build a management solution using Azure Blueprints in combination with Management Groups.

At the end of this hands-on lab, you will know how to provide cost tracking by business unit, environment and project with resource tags, provide for a distributed administration model, put a service catalog in place to prevent deployment of unsupported Azure services, and put controls in place to allow deployment of services only in specific regions.

Azure services and related products

• Azure VMs
• Azure Portal
• Azure PowerShell
• Azure CLI
• Azure Active Directory
• Azure Policy
• Azure Role-Based Access Control
• Azure Management Groups
• Azure Resource Graph
• Azure Blueprints

Azure solutions

• DC Migration

Related references

• MCW

mcw-enterprise-ready-cloud's Issues

Fix the script in Exercise 2 Task3.3 by removing guid for $groupObjectId

Please fix the script in Exercise 2 Task3.3.

Existing command is $groupObjectId = (Get-AzADGroup -SearchString $AdGroupName).Id.Guid >> $groupObjectId = (Get-AzADGroup -SearchString $AdGroupName).Id.guid

It should be $groupObjectId = (Get-AzADGroup -SearchString $AdGroupName).Id.Guid >> $groupObjectId = (Get-AzADGroup -SearchString $AdGroupName).Id

June 2020 Update Suggestions

Here are our suggested updates for the June 2020 update. Please add any other suggestions or feedback to this issue.

• Update diagrams to use new Azure icons
• Sync policies with between lab and WDS (use built-in policies instead of custom)
• Change Blueprint to show resource group level artifacts
• Change Blueprint to deploy at resource group scope instead of subscription-level scope
• Verify that Cost Management is fixed for use in Azure Pass, if not, add warning in lab indicating that that part of the lab will not work in Azure Pass.

May 2019 Content update

Hello,
This workshop is scheduled for a May 2019 update. Please review open issues #25 and #26 and pull request #24 then give your suggested updates for SME review.

**SME's - please review issue #26 Suggested updates to WDS by jtuliani and comment there moving forward.

Thanks,
Dawnmarie

Typo error in PowerShell command

There is error in powershell command in Exercise 1 - task 2.1
Command is Login-AzureRmAccount -Subscription "{subscription name or id}" which would be Login-AzureRmAccount -SubscriptionId "{subscription name or id}". Id is missing -SubscriptionId switch.

https://github.com/Microsoft/MCW-Enterprise-ready-cloud/blob/master/Hands-on%20lab/HOL%20step-by-step%20-%20Enterprise-ready%20cloud.md#task-2-apply-the-service-catalog-policy

Ex3, Task3, step 6 portal hangs

Ex3, Task3, step 6 portal hangs Adding vnet. Workaround by student was to just create a new subnet in the existing vnet that is auto created by devtest labs.

They tried this in both Edge and Chrome, did not try PowerShell.

WDS student/trainer guides

Student guide - Line 382 - please check link formatting, leads to a 404 error.
Trainer guide - Line 510 - same as above.

Student guide - Lines 318 - 326 - Please verify my changes are correct. The section title E-commerce developer team was up on the same line as the previous question and the "Identify a solution...." line was not numbered so I fixed the formatting there. You also answered 2 questions in the trainers guide, but only asked 1 question in the student guide, so I added question number 2 to the student guide section.
Trainer guide - Lines 442 - 452 - same as above.

Trainer guide - Line 577 - image has no alt-text

Trainer guide - Lines 873 - 917 - please check coding. It looks to me like some of those lines should be normal text, not in the grey boxes (lines 886, 901 & 903). Verify & change accordingly.

HOL and WDS folders not properly named

HTML files

QC'd and merged...ready for updated HTML files! :)

Verify links in HOLs

Folder and document names have been updated. Please check your HOL documents for links that use folder names in their path and make sure they are still valid and working.

Image in WDS does not match the Powerpoint

Hello,
Image labelled "Image6" in the WDS does not match the corresponding image in the powerpoint. The slide is titled "Common Scenarios." Please see screenshots below:

WDS PPT:

WDS Trainer/Student Guide:

QC review - HOL step-by-step question

Hello,
Please review & advise...

Line 429 reads: Category: Create new > Naming"
Is the " after the word Naming extra, or is there a " missing somewhere in the line?

November update - archive unguided lab

In the Hands on labs, please create an archive folder and place the outdated, unguided lab in there.

ready for qc

Lab guide pre-reqs wrong

The Lab guide prerequisites say you need Visual Studio (or deploy a VM with Visual Studio if you don't have it). But the lab never uses Visual Studio, so this is not needed after all.

MCW HOL Credential Issue

I am trying to run the HOL lab with my internal Azure subscription as a CSA. However, my account doesn't have full-tenant admin rights. I suspect that there might be a different account we're supposed to use? Please advise. Thank you.

Blueprint assignment still failsafter service catalogue update...

... due to a typo. The P in Blueprint must be lower case, so "Microsoft.Blueprint/blueprintAssignments/*". See Task 3: Update the Service catalog policy to allow blueprint assignments - { "source": "action", "like": "Microsoft.BluePrint/blueprintAssignments/*" }

issues resolved - ready for next step

Add comment on avoiding 'Classic' in lab

In the lab, when setting up the policy initiative, it's very easy to accidentally select the 'Classic' version of virtual networks / virtual machines, and very hard to detect afterwards that you have done so.

Have seen several students hit this issue.

Lab guide should add some text to help warn students of this potential trap.

Ready for QC

December 2019 - content update

This workshop is scheduled for a content update. Please review the current workshop and provide update suggestions for review. Thanks!

unable to create budget

Exercise 4 : Task 3: step 6 , I am unable to create budget

Change History is now available via the Activity Log

In the WDS, Security Baseline, Q1

Trainer guide describes how to access the resource change history via Azure Policy, and calls out that it's not included in the Activity Log. That has now changed--Change History IS now part of the Activity Log.

The WDS should be updated to reflect this.

Resource providers not registered

When running this query,

 Get-AzureRmResourceProvider `
>>     | Select-Object ProviderNamespace, ResourceTypes `
>>     | Format-List

the output does not contain Microsoft.Compute (for example) and thus people get confused at the next step of adding these to the restricting policy.

The reason for Microsoft.Compute being absent is that this resource provider is not yet registered in the subscription because it never had any VM in it.

Pic without Microsoft.Compute.

Pic with solution

-> Register resource providers with the subscription.

Thanks!
Joost

Exercise1/Task5/Subtask2/Step3 and Step7

Exercise1/Task5/Subtask2/Step3:
3. Under Available Definitions, find the Restrict Resource Name Suffix policy definition created in Step 2.

I did not find "Available Definition" in this step, instead,

7. Once you've added each resource type, select Save.

there was no Save button.

Suggested updates to WDS

Use

• Blueprints
• Azure Policy for auditing VM password policy (inside the VM)
• Possibly, Managed Applications for Service Catalog

HOL Step-by-Step and Unguided

Hello,

The abstract and the overview in the HOL Step-by-step and Unguided are the exact same - please provide an updated overview for both of these in the test fix branch.

Thank you,

Diana