Azure private MEC—A thriving partner ecosystem

In June of 2021, Microsoft introduced Azure private multi-access edge compute (MEC), a solution that enables operators and system integrators (SI’s) to deliver high performance, low latency connectivity, together with IoT applications at the edge, helping to deliver the next wave of digital transformation. This is made possible because Azure private MEC combines network functions, applications, and edge-optimized Azure services to deliver high-performance, ultra-low latency solutions.

This year at Mobile World Congress, Microsoft announced Azure Private 5G Core (P5GC), which is available as part of Azure private MEC. Azure P5GC enables deployment and management of 5G core network functions on an Azure Stack Edge (ASE) device, as part of an on-premises private mobile network for enterprises. The 5G core network functions connect with 4G and 5G radio access networks (RANs) and SIM solutions from a growing list of solution partners, providing secure, high performance, low latency connectivity. In this way, Azure P5GC dramatically simplifies the deployment and operation of private networks for a variety of use cases.

With just a few clicks, organizations can easily deploy a customized set of selectable 5G core functions, and a variety of applications on a small edge-compute platform, at tens to hundreds of locations, within minutes. RAN deployments can also be managed from the cloud with common observability across the network. SIMs can be securely configured and deployed from the cloud without exposing them to manual operations. In this article, we highlight a few partners from within our ecosystem, and the solutions they’re developing across a variety of industries.

Microsoft partner ecosystem

As enterprises shift to the cloud, the demand for cloud solutions and services is at an all-time high. As a result, the partner ecosystem is integral to the Azure private MEC strategy. Microsoft’s technology partners represent a tremendous opportunity for collaboration while driving growth.

“A recent study shows that for every dollar our cloud generates in revenue in the local region, our local partner ecosystem generates as much as nine additional dollars. Our customers are using the power of the cloud to generate even more revenue. That means even more local economic success. That’s at the core of what we do.”— Satya Nadella, CEO of Microsoft

Operator and system integrator (SI) partners building solutions using Azure private MEC have full access to the Azure Marketplace, offering a curated ecosystem of products, networking, cloud services, and applications, simplifying procurement, deployment of management, and monetization of 5G edge for enterprise customers. Application ISVs benefit from a consistent onboarding experience with established tools and resources, while working with a fully featured platform to develop ultra-low latency applications. Partner solutions are then distributed via Azure Marketplace, easily scaling distribution.

Azure private MEC partner solutions

Our GTM partners are actively developing solutions that utilize their proven technology on Azure private MEC to help enterprises meet digital transformation goals. Below are a few recent examples of innovative solutions that have been created for the manufacturing, transportation, and logistics industries.

Video analytics enables simultaneous real-time quality inspection of 100 iterations

Accenture has developed a solution to improve quality monitoring processes for the manufacturing industry, leveraging AI and video analytics over 5G and boosting overall productivity using cameras and sensors to increase quality assurance testing throughput and improvements in defect detection. 5G’s ultra-low latency and high throughput make it possible to have rapid access to high volumes of data, enabling manufacturers to use analytics to help identify defects, and dynamically test based on real-time conditions, improving scrap rates and total cost of quality in the process.

“A large car manufacturing company wanted to take advantage of 5G technology to enhance their production quality, meet compliance effectively, and increase manufacturing plant efficiency. Partnering with Microsoft, Accenture leveraged video analytics asset Solution.AI for processing to build a solution that was developed using Azure Private MEC. One of the priority use cases was quality inspection. In this scenario, the solution captures images of the moving vehicles on the assembly line, processes the images in real-time using 5G network and solution, and alerts the monitoring team and allows the inspection team to analyze the data in real-time to facilitate faster remediation. The solution has enabled the automobile manufacturer to perform immediate quality inspection boosting their quality accuracy, enhanced safety, compliance, and production efficiencies. As a result, they can simultaneously visualize more than 100 iterations of the same model. It gives them a more flexible and efficient production line to better serve customers with their unique needs.”—Mark Rogers, Accenture Microsoft BG Communication & Media Lead

Protecting frontline workers’ safety with real-time video analytics

Avanade, a leading provider of digital, cloud, and advisory services works closely with enterprise clients and Microsoft to develop private network solutions to protect workers in hazardous environments, using real-time analytics. By leveraging 5G’s wide coverage and reliability characteristics, Avanade’s private networking solution provides the foundation for industries to transform their operations, addressing today’s production challenges around worker safety and enhanced operational processes.

“As we collaborate with our clients in preparing for 5G and emerging opportunities with next-generation connectivity and edge, a focus area has been worker effectiveness and safety. Many of our clients have frontline workers in mission-critical and dangerous locations like warehouses, ports, logistics facilities, and frontline mining, utility, and energy field sites and we have been working closely with Microsoft using private MEC services to bring worker safety as a service that leverages public and private wireless networks. Designed to enable reliable coverage in difficult areas, the solution provides a dashboard and operational tools for near real-time health and safety monitoring of workers, all delivered over a secure network from Microsoft's cloud to edge.”—Aaron Reich, Executive and Emerging Technologies lead at Avanade

Digital twins offer a bird’s eye view of how to improve worker safety

Cognizant, a company whose offerings help make buildings smarter, was striving to create a comprehensive, robust, and cost-effective solution to improve worker safety. Their holistic approach to enterprise private 5G network includes design, implementation, and management—as well as helping them implement innovative digital solutions using technology such as AGV/AMR, Vision AI, AR/VR, and digital twins to solve their operational challenges. Private 5G provides the ultra-low latency, device scale and reliability needed for these applications that Wi-Fi networks cannot guarantee.

“Cognizant’s solution for worker safety for oil and gas vessels and manufacturing environments uses off-the-shelf cameras and innovative visual behavior sensing software from its partner to create a digital twin of physical space. The solution provides a bird eye view of the space including location of workers using multi-camera field of view and raises alerts when a worker is in close proximity of a pre-defined hazard zone. In addition, the solution will provide information such as workers entering into unauthorized locations, or workers crowding into a space which can trigger alerts to the facility’s safety officer. The solution is to be available on Azure Stack Edge for deployment and will operate in a standalone mode in case of no connectivity between the vessel and Azure cloud.”—Anjali Deo, AVP & CTO Industry+, Cognizant

Reducing manufacturing costs with private networks

With 5G, it is possible to have critical communications over private networks in real time, allowing these applications to operate reliably and securely. 5G opens up new fields of application in industries where the performance of other wireless technologies, such as Wi-Fi, previously fell short. Capgemini views this new communications standard as key to reducing costs and enhancing manufacturing processes in automated factory operations.

“By integrating and deploying 5G use cases based on PMEC, Capgemini is working closely with Microsoft to bring the end-to-end solutions facilitating the rapid deployment of private networks. Capgemini is innovating by providing customized Industry 4.0 use cases and business process modernization to support Intelligent Industries. Capgemini has a rich repository of industrial use cases leveraging its unique microservices library, which enables the acceleration of tailored use cases for its clients. As an example, Capgemini has developed Remote Assistance and guided procedure use case to support and help field operations and technicians for complex maintenance and repair in real-time. Using high definition 5G video calls, collaborative tools, and 3D procedures, the solution is integrating AR/VR and Object detection Software Components available off the shelf."—Fotis Karonis, Executive Vice President, Capgemini Group Leader 5G & Edge

Private 5G powers biosecurity to improve airport safety

Successfully restarting air passenger travel while restoring confidence in safety is vital to enabling the global economy’s recovery from COVID-19. HCL is taking advantage of private 5G to bring biosecurity to airports, speeding up passenger checkpoints like luggage handling and security screening.  Biosecurity applications will limit necessary human interaction, helping airlines manage worker shortages, high travel demand and increased health screening requirements.

“Our comprehensive approach for biosecurity at airports involves people tracking, crowd management, and location awareness using the Microsoft private MEC and HCL’s homegrown solution, UnlocSafe. This implementation has proven how 5G addresses integration and operational challenges in the Airport 4.0 roadmap.”—Srinivas Yerramilli, Director, HCL Technologies

Container condition monitoring creates smarter ports via 5G networks

Tech Mahindra’s “PORTNxT” portfolio of 5G and edge solutions leverages in-house expertise and partner platforms for MEC, analytics, and AI, along with solutions on Private LTE (CBRS), 5G and SDN/NFV to drive the next generation of shipping ports.

“Tech Mahindra’s ContainerSight, an AI-based video analytics solution deployed over cellular networks, helps logistics firms and port authorities generate real-time insight into a container's condition at the time of entry and exit from their facilities, eliminating false claims and avoiding reputation loss.”—Ranga Thittai, Vice President & Head Enterprise Network Service at Tech Mahindra

Looking ahead

As we move forward with Azure private MEC, we continue to work with our partners, helping them identify and validate industry use cases, while developing and distributing solutions to enterprises via Azure Marketplace and sales motions. This effort remains at the core of our strategy, with the above use cases validating the importance of our partner ecosystem and its ability to positively impact a broad array of industries. The insights gained from our partners are pivotal to evolving the private MEC solution to meet the needs of our partners and enterprises.

It’s easy to get started with Azure private MEC

As innovative use cases for private wireless networks continue to develop and industry 4.0 transformation accelerates, we welcome ISVs, platform partners, operators, and SIs to learn more about Azure private MEC.

Application ISVs interested in deploying their industry or horizontal solutions on Azure should begin by onboarding their applications to Azure Marketplace.

Platform partners, operators, and SIs interested in partnering with Microsoft to deploy or integrate with private MEC can get started by reaching out to the Azure private MEC Team.
Quelle: Azure

Azure Virtual Machines with Ampere Altra Arm–based processors—generally available

Microsoft is announcing the general availability of the latest Azure Virtual Machines featuring the Ampere Altra Arm–based processor. The new virtual machines will be generally available on September 1, and customers can now launch them in 10 Azure regions and multiple availability zones around the world. In addition, the Arm-based virtual machines can be included in Kubernetes clusters managed using Azure Kubernetes Service (AKS). This ability has been in preview and will be generally available over the coming weeks in all the regions that offer the new virtual machines.

Earlier this year, we launched the preview of the new general-purpose Dpsv5 and Dplsv5 and memory optimized Epsv5 Azure Virtual Machine series, built on the Ampere Altra processor. These new virtual machines have been engineered to efficiently run scale-out, cloud-native workloads. Since then, hundreds of customers have tested and experienced firsthand the excellent price-performance that the Arm architecture can provide for web and application servers, open-source databases, microservices, Java and .NET applications, gaming, media servers, and more. Starting today, all Azure customers can deploy these new virtual machines using the Azure portal, SDKs, API, PowerShell, and the command-line interface (CLI).

Customers build and run a vast variety of workloads on Azure, whether they are digitally transforming and modernizing their businesses or building all-new innovative distributed apps and services that the world has never seen before. At the same time, customers want to maximize operational efficiency and are taking a holistic approach across their application portfolios. They are also beginning to evaluate sustainability factors and the overall impact of their technological choices. Azure’s Ampere Altra Arm–based virtual machines represent a cost-effective and power-efficient option that does not compromise the level of performance that customers require.

Customers like Amadeus, the leading IT provider for the global travel industry, shared their perspective:

"The preview of the Ampere Altra Arm–based Dpsv5 Azure Virtual Machine series on Azure was the perfect opportunity to explore how these new instances could improve Amadeus Search and Shopping products for our customers. During our tests and benchmarks, we experienced an already mature Arm ecosystem and a seamless integration with Azure services. As expected, the high throughput and the reduced energy consumption makes this Series a must for improving both the performance and the sustainability of our Compute footprint. Following this conclusive experience, we are now planning on using these instances in production to run our Cloud workloads at scale."—Antoine Collier, Cloud Engineer at Amadeus

A growing partner ecosystem

Microsoft has over 20 years of experience with Arm-based technologies, and we continue to participate in the vibrant Arm ecosystem to help accelerate customer innovation. We are uniquely positioned to help customers build great solutions by collaborating with software and hardware companies—such as Ampere and Arm—across the globe, and we can also help customers deploy workloads more easily and run them with high performance.

"Ampere’s Cloud Native Processors are uniquely designed to meet both the high performance and power efficiency needs of the cloud. Through our strong partnership with Microsoft, Ampere Altra processors are now generally available as Azure Virtual Machines, bringing new cloud-focused processor technology to end users so that they can deploy the next generation of innovative cloud applications at scale, and do so in a sustainable manner."—Jeff Wittich, Chief Product Officer, Ampere

"The general availability of Microsoft Azure VMs on Arm marks an important milestone in redefining what is possible in cloud computing. Through market-leading scalable efficiency and the liberty to innovate, Arm Neoverse is enabling Azure customers to embrace the increasing diversity of workloads with better overall TCO and cleaner cloud service operations."—Chris Bergey, Senior Vice President and General Manager, Infrastructure Line of Business, Arm

We have been working with the open-source community and various independent software vendors (ISVs) to make several Linux OS distributions including Canonical Ubuntu, Red Hat Enterprise Linux, SUSE Enterprise Linux, CentOS, and Debian available on the new Arm-based Azure Virtual Machines. We will also add support for Alma Linux and Rocky Linux in the future.

"We see companies using Arm-based architectures as a way of reducing both cost and energy consumption. Arm-based architectures are ideal for computing workloads including microservices, application servers, machine learning, open-source databases, and in-memory caches. It truly is a huge advancement for those looking to develop with Linux on Azure. We are pleased to partner with Microsoft to announce the general release of Ubuntu images."—Alexander Gallagher, Vice President of Cloud, Canonical

"Red Hat has long been committed to providing our customers with a choice of architectures that meet their unique computing needs, from on-premises environments to public clouds and edge. We are pleased to support Ampere Altra Arm-based VMs on Red Hat Enterprise Linux on Microsoft Azure, adding to our hybrid cloud-spanning roster of architecture options. We work very closely with key partners like Microsoft to support the evolving needs of enterprise customers, highlighted here by helping to drive greater efficiencies through cloud-based Arm-based processors."—Maryam Zand, Vice President, Cloud Partners, Red Hat

"Given the importance of cloud and edge workloads, SUSE recognizes the significant opportunities with Arm in these environments.  SUSE is excited to partner with Microsoft Azure in supporting the Dpsv5 and Epsv5 Azure VM-series based on the Ampere Altra Arm-based server instances in our recently released SUSE Linux Enterprise Server 15 SP4. Arm-optimized solutions in the cloud offer significant market potential as enterprises improve time to value and scale-out cloud environments with Azure Virtual Machines."—Thomas Di Giacomo, CTO SUSE

We have also collaborated with companies like Avanade, Datadog, Elastic, and many others who are building innovative solutions on Azure.

"Ansys simulation tools make use of massively distributed compute resources from cloud providers like Microsoft Azure to analyze some of the world's most advanced electronic and optical designs. Ansys has collaborated with Arm and Microsoft to make Ansys products, including RedHawk-SC and LS-DYNA, available on Ampere Altra Arm-based VMs in Azure. Ansys is dedicated to providing our customers with the best possible solutions for distributed computing and looks forward to continuing this very successful partnership."—John Lee, Vice President and General Manager of electronics, semiconductor, and optics business unit, Ansys

“The Arm-based virtual machines deliver great price performance value for many cloud-native workloads and scale-out scenarios, and the low power consumption per ARM core will enable Avanade to deliver solutions which meet clients’ sustainability goals by further reducing their carbon footprint."—Steve Hunter, Global Azure Platform Services lead, Avanade

"Datadog is proud to be a monitoring partner in the launch of Arm-based architectures on Azure Virtual Machines. By enabling deep visibility into Ampere Altra Arm–based virtual machines, customers can get full visibility into their entire Azure environment, including Arm-based instances to help with migration planning and performance monitoring."—Yrieix Garnier, VP of Product, Datadog

“At Elastic, we are at the forefront of innovation by providing customers the ability to use our solutions on Arm-based architecture. With the new Azure Virtual Machines featuring the Ampere Altra Arm–based processor, Elastic will be able to deliver better throughput and improved price-performance to our customers across their use-cases for observability, security, and search. We are looking forward to introducing the new Virtual machines on Elastic Cloud.”—Uri Cohen, VP, Product Management, Elastic

We know that many Arm applications will also be open source and cloud-native, and that’s why we’ve included support for these new virtual machines in Azure Kubernetes Service (AKS) from the start. Today we’re actively deploying updates across the Azure fleet to also make AKS support for Arm nodes generally available. These deployments will be made region by region and are expected to be fully available within two weeks. To check the status in your region(s), visit the AKS release tracker.

We’re excited that customers can already leverage so many partner solutions to accomplish their goals using Arm-based virtual machines. We’ll continue working closely with the software and partner ecosystem to bring even more packages, partners, and services to Arm on Azure in the months ahead.

Accelerating developer productivity with Arm in the cloud

The Arm ecosystem continues to benefit from the contribution of the global community for most major developer platforms and languages such as Java, Python, Rust, PHP, .NET, and more.

Java has played a critical role in democratizing cross-platform development. Java developers can enjoy the development experience they are familiar with while building and running their applications with the Microsoft build of OpenJDK. Microsoft provides Java 11 and Java 17 binaries for Windows, Linux, and macOS. With Microsoft's recent JEP 388 contribution to OpenJDK, Java applications can now run on a wider range of Arm systems with no additional code changes.

Native support for the Arm architecture is available in .Net 6 on both Windows and Linux. With C# 10 and F# 6, .NET 6 delivers language improvements that simplify your code. Native support for Windows on Arm64 is now also available for the .NET Framework starting with the recent 4.8.1 release for Windows 11 and with Visual Studio 2022 17.3 generally available. The vast ecosystem of .NET Framework apps can receive the benefits of running on Arm now. The latest Microsoft Visual C++ tools (currently in preview and available as part of Visual Studio 17.4 preview) allow you to not just run your apps, but also build natively for Arm, on Arm. Visual Studio 17.4 previews support the desktop (C++ and C#), Web, and Universal Windows Platform (UWP) workloads and will be generally available later this year. The totally free Visual Studio Code editor running natively on Arm enables you to harness the power of the cloud—not just for your production environment, but now also for your development environment.

Outside the datacenter, the Arm hardware landscape continues to expand beyond mobile to a variety of client devices for customers looking for the battery life and performance benefits of Windows on Arm PCs and tablets. Until now, developers and software-provider partners building for Windows on Arm devices have had to build and test their software on physical devices or resort to cross-compilation and inefficient emulation solutions. To support their work, we’ve made Insider Preview releases of Windows 11 Pro and Enterprise available to run on Arm-based Azure VMs. Client application developers can now take advantage of Azure’s highly available, scalable, and secure platform to run cloud-based software and build and test workflows that help them increase their agility. NortonLifeLock was part of the preview:

"We are using Azure VMs featuring the Ampere Altra Arm-based processors to run and test Norton products supporting Windows 11 on Arm. We have found them appealing not only for performance and scalability, but from a cost perspective as well. Microsoft has made it easy for their customers to use their VMs seamlessly across different scenarios."—Leena Elias, Vice President of Product, NortonLifeLock

Azure Arm-based virtual machines support a broad range of workloads

The Azure Arm-based virtual machine families include:

Dpsv5 series, with up to 64 vCPUs and 4GiBs of memory per vCPU up to 208 GiBs,
Dplsv5 series, with up to 64 vCPUs and 2GiBs of memory per vCPU up to 128 GiBs, and
Epsv5 series, with up to 32 vCPUs and 8GiBs of memory per vCPU up to 208 GiBs.

All the new virtual machine sizes support up to 40 Gbps of networking bandwidth; Standard SSDs, Standard HDDs, Premium SSDs, and Ultra Disk Storage can be attached to the virtual machines. Dpdv5, Dpldv5, and Epdv5 virtual machine series also include fast local-SSD storage. Virtual Machine Scale Sets are also supported. Monitor your virtual machines and protect your data with Azure Monitor and Azure Backup.

The Ampere Altra Arm–based Azure virtual machines are now available in the US (West US 2, West Central US, Central US, East US, East US 2), Europe (West Europe, North Europe), Asia (East Asia, Southeast Asia), and Australia (Australia East) Azure regions. We plan to expand Azure regional availability after September 1.

Spot Virtual Machines are also available today. Azure Reserved Virtual Machine Instances pricing will be offered when the Virtual Machines become generally available on September 1. Prices vary by region.

Getting started

We can’t wait to hear about the amazing workloads customers will build with these new virtual machines and tools. Start running your applications on Azure Arm-based Virtual Machines and AKS containers today.

Additional resources

Canonical blog
Datadog blog
Elastic blog
Microsoft’s binary distribution of the OpenJDK and related support.
Dplsv5 and Dpldsv5 virtual machine series documentation
Dpsv5 and Dpdsv5 virtual machine series documentation
Epsv5 and Epdsv5 virtual machine series documentation 
Azure portal
Get help selecting the ideal virtual machine for your workload using the virtual machine selector 
Azure Virtual Machines overview and Azure Virtual Machines pricing

Quelle: Azure

Enhance Azure Firewall policy management with Tufin SecureTrack integration

Organizations today are faced with growing network challenges with hundreds of network assets deployed in hybrid and multi-cloud environments. Daily tasks such as enabling access or troubleshooting network connectivity issues have become increasingly more complex and spread across different teams within the organization. In addition, organizations are asked to do more while keeping costs under control. Gaining full and clear visibility and control is needed for Network Security and Cloud Security teams to manage their fragmented networks, enforce security policies, work more efficiently, and reduce their attack surface caused by misconfigurations.

To help organizations address these challenges and achieve agility and security, Tufin announced integration with Azure Firewall to provide holistic security policy management within your Azure and hybrid environments.

Simplified and automated Azure Firewall policy management with Tufin SecureTrack

Tufin SecureTrack delivers real-time visibility and policy-driven, unified security across your hybrid and cloud environments. Azure Firewall integration with Tufin SecureTrack enhances your visibility and security while managing Azure Firewall policies. Key features to simplify and automate network security management across on-premises and cloud include policy automated audit trail and network topology visualization.

Automated audit trail

Keeping track of changes in the Firewall Policy is essential for various use cases—it allows you to reduce the attack surface by gaining visibility into misconfigurations and risky changes. In addition, you can easily identify each change and its deployment time and leverage this information to deploy a new Azure Firewall policy version when needed.

With Tufin SecureTrack, you can leverage automated audit trail to changes made to your Azure Firewall policy. In addition, you can compare different policy versions in an intuitive, side-by-side user interface, to quickly pin each exact change.

Network topology visualization

Having a clear picture of your network topology is required in modern and fast-changing networks to control potential risks and troubleshoot misconfigurations. Maintaining such network mapping manually is a time-consuming task that involves various teams. Even with such a map in hand, it is still difficult to tell if a specific network connection is allowed and in which path.

With Tufin SecureTrack, you can leverage live and automated network topology maps, generated by the configuration of your Azure Firewall and other network assets. This map allows you to simulate a path analysis of a specific network connection, based on your network topology and applied policy rules, for both East and West and North and South traffic. Tufin visualizes how the traffic flows based on the routing and networking configuration, and whether the access is allowed or blocked based on the security configuration.

Learn more

Join the upcoming free webinar on Wednesday, September 14, 2022, from 8:00AM–9:00AM Pacific Time, to learn more about Tufin’s Azure Firewall integration and get your questions answered from Tufin and Microsoft product experts. If you are not able to attend, please register so that you can watch the webinar on-demand anytime.

You can also sign-up for a live demo to see the solution in action.

Resources

Tufin SecureTrack webpage.
Tufin SecureTrack user guide.
Azure Firewall webpage.
Azure Firewall documentation.
Azure network security webpage.

Quelle: Azure

High availability solutions on Microsoft Azure by SLES for SAP Applications

This post was co-authored with Sherry Yu, Director of SAP Success Architect, SUSE.

In today’s business world, service availability and reliability are key to a successful digital transformation. Extensive downtime not only costs a business revenue and productivity, but may also cause reputational damage. SUSE and Microsoft have been working closely to provide a trusted path to SAP Solutions in the cloud, including solutions to reduce unplanned and planned downtime.

SUSE and Microsoft work together

SUSE is the leader in SAP Solutions, especially the developer of high availability (HA) solutions. HA Solutions are first tested, supported on-premises, and documented in the official configuration guides that are published on SUSE’s site. Microsoft tests the solutions in Azure’s infrastructure, tunes the settings and configurations, then releases Azure-specific HA configuration guides on Microsoft’s documentation site. Microsoft actively provides feedback and requests support for new scenarios from SUSE. The working process can be summarized in the chart below. It’s been a smooth collaboration between SUSE and Microsoft to support customers’ digital transformation journey.

Solutions to reduce unplanned downtime

High availability solutions—that can prevent 24/7 SAP systems from being disrupted by various issues caused by hardware, network, and applications—are commonly based on cluster technologies. Pacemaker is an open source cluster, used by various HA solutions.
For SAP HANA, the HA solutions are based on HANA System Replication (HSR). SUSE has developed resource agents to automate the failover of HANA System Replication in scale-up and scale-out scenarios.

For SAP S/4HANA and NetWeaver, the HA solutions are based on ASCS/ERS enqueue replication. SUSE’s HA solutions for ENSA1 and ENSA2 are both certified by SAP HA-Interface certification. Recently SUSE released a new architecture called Simple Mount File System, that reduces the complexity of the Pacemaker configuration for SAP ASCS/ERS architecture. It’s also SAP HA-Interface certified. Microsoft was the first cloud provider to release a configuration guide for SAP ASCS/ERS simple mount structure.

HA for SAP ASCS/ERS on Azure with SLES for SAP Applications

The following configurations are supported on Azure based on ASCS/ERS Enqueue Replication, ENSA1 and ENSA2, respectively:

SAP ASCS/ERS with NFS on Azure Files on SLES for SAP Applications
SAP ASCS/ERS with NFS on ANF on SLES for SAP Applications
SAP ASCS/ERS with NFS cluster (DRBD)
SAP ASCS/ERS Multi-SID guide on SLES for SAP Applications

The paragraph below outlines the major differences between the various scenarios:

New simple mount architecture for SAP ASCS/ERS on Azure VMs with NFS

This is a new architecture to simplify the management of shared file systems on NFS. Instead of using a FileSystem resource agent to manage the shared file systems by the cluster, shared file systems are managed by the OS and mounted at boot time. A new resource agent SAPStartSrv was created to control the start and stop of the SAP start framework of each SAP instance. The benefit is a more robust cluster architecture.

This solution has been tested and released on Microsoft Azure with the official configuration guide published.

HA for SAP HANA on Azure with SLES for SAP Applications

HA Solutions for SAP HANA are based on HANA System Replication (HSR) in scale-up and scale-out. The following scenarios are supported on Azure:

Scenario

SLES for SAP Applications

 

Scale-up HSR + Pacemaker

High availability of SAP HANA on Azure VMs on SLES – Azure Virtual Machines | Microsoft Docs

• Basic HANA scale-up and HSR

• Can be used with NFS-mounted file systems

• Doesn’t include more resilient pacemaker configuration to handle loss of NFS mounts

Scale-up HSR with NFS-mounted file systems

High availability of SAP HANA Scale-up with ANF on SLES – Azure Virtual Machines | Microsoft Docs

• Additional Pacemaker configuration monitors the NFS file systems

• Loss of access to NFS-mounted files systems (including /hana/shared), triggers failover

Scale-out n+m

(scale-out with stand-by node)

SAP HANA scale-out with standby with Azure NetApp Files on SLES – Azure Virtual Machines | Microsoft Docs

• Requires shared storage (ANF on Azure)

• For /hana/data and /hana/logs only NFSv4.1 supported!

• For /hana/shared NFSv3 or NFSv4.1 is supported

Scale-out HSR + Pacemaker

SAP HANA scale-out with HSR and Pacemaker on SLES – Azure Virtual Machines | Microsoft Docs

• Includes the additional Pacemaker configuration for loss of NFS access

 

There are some considerations in picking the right scenario based on your business needs:

How critical is it to minimize downtime in the case of a failover?
What is the willingness to increase spend and/or lower downtime, in case of incident?

Azure virtual machine availability overview

Azure offers several compute deployment options and it’s important to understand their differences, especially the SLAs as noted below:

Solutions to reduce planned downtime

Planned downtime normally is associated with maintenance of the environment. SUSE and Microsoft present the following solutions to minimize the planned downtime.

For instance, when performing maintenance on a SAP HANA system running in a cluster, whether it’s to upgrade of the OS or apply HANA SPs, it’s recommended to do a rolling update. That means to upgrade the secondary HANA node first, perform a takeover, then upgrade the former primary HANA node. It’s an effective way to reduce the planned downtime to the time necessary to perform a takeover. The same approach can be applied to SAP Central Services in HA configuration.

To keep the SAP systems secure, system admins must apply security patches in a timely manner. Kernel Live Patching is provided by SUSE to effectively help avoid reboots for up to one year. It’s highly practical and recommended for mission-critical HANA systems.

When performing maintenance to the SAP ASCS/ERS running in the cluster, it’s essential to leverage the sap_vendor_cluster_connector that SUSE has developed for the SAP HA-Interface certification, to avoid split-brain. During maintenance, a system admin can stop an SAP ASCS or ERS instance via SAP tools such as sapcontrol or MMC. If the instance is managed by the cluster, via the cluster connector, the cluster will be notified that this is intended and instead of trying to remediate the “failure,” the cluster will not interfere. The HA-Interface helps avoid accidents during planned maintenance windows. You can find the details and an example in this blog.

Accelerate your SAP S/4HANA migration to Azure

SUSE and Microsoft provide solutions to automate, validate and monitor the SAP Landscape:
•    Automation: Microsoft Automation Framework for SAP provides built-in best practices to speed up provisioning and reduce errors. Deployment time is reduced from months or weeks to days. SUSE as a contributing partner provided best practices especially for the HA deployment.
•    Validation: SUSE Project Trento, part of SLES for SAP Applications, provides rule-based autodetection of SAP configuration issues in Azure infrastructure. It can be used as a powerful pre-go-live validation tool to ensure quality. In Day 2 operations it continuously checks the production system to detect deviation and prevent outage.
•    Monitoring: Microsoft Azure Monitor for SAP helps customers gain insights into the SAP landscape, especially HA clusters. The proactive monitoring helps to fix issues before outages happen. Monitor for clusters on SLES for SAP Applications co-developed with SUSE.

SLES for SAP Applications

SLES for SAP Applications is the leading Linux platform for SAP HANA, SAP NetWeaver, and SAP S/4HANA solutions and is an SAP Endorsed App. Two of the many key components of SLES for SAP Applications are the High Availability Extension and Resource Agents. The High Availability Extension provides Pacemaker, an open-source cluster framework. The Resource Agents manage automated failover of SAP HANA System Replication, S/4HANA ASCS/ERS ENSA2, and NetWeaver ASCS/ERS ENSA1. On Microsoft Azure’s marketplace, the PAYG image of SLES for SAP Applications includes Live Patching.

Learn More

Microsoft Azure is an enterprise-class cloud platform optimized for SAP that provides significant cost savings, new insights from advanced analytics, and unmatched security and compliance.

SUSE has more than 20 years in SAP Partnership with more than 130 worldwide benchmarks. Some of the world’s largest SAP workloads run on SUSE on Azure. The first reference architectures for SAP on Azure were SUSE based. As a result of the close collaboration between Microsoft and SUSE, a comprehensive portfolio of HA Solutions for SAP on Azure is available for customers, leveraging the strengths of SUSE on Microsoft Azure.
Quelle: Azure

Microsoft named a Leader in 2022 Gartner® Magic Quadrant™ for Data Integration Tools

In the modern business landscape, the intake of information and data is growing at an incredibly rapid pace. Organizations, regardless of size, need to quickly gain insights from all data to inform customer experiences and empower their employees. Current solutions are bespoke and siloed, leading to users spending considerable time and resources stitching together disparate products across a variety of vendors. This creates costly operational overhead and diverts resources away from value creation. In response to this high-pressure environment, many organizations are looking for cutting-edge data integration platforms and resources, and Microsoft is fully invested in empowering these companies to succeed.

We are excited to share that Gartner has positioned Microsoft as a Leader once again in the 2022 Gartner Magic Quadrant for Data Integration Tools. We believe this recognition shows our continued growth and ongoing commitment to delivering comprehensive and cost-effective data integration solutions.

The Gartner Magic Quadrant for Data Integration Tools evaluated companies on a range of categories including data engineering, cloud migration, and operational data integration tasks.

Translating data into a competitive advantage

It’s easy to be overwhelmed with the amount of data businesses are generating every day. Not only do organizations need to deal with the technical requirements of processing their data, they also are operating in a high-risk environment, where the regulatory challenges are significant and noncompliance can mean an expensive penalty.

Against this backdrop, Microsoft brings an end-to-end data integration strategy to drive competitive advantage and deliver better business outcomes. Regardless of where source data is coming from—from operational databases to software as a service (SaaS) to multicloud—Microsoft data integration serves as the foundation that brings this data together and prepares it for cloud-scale analytics.

To lay the groundwork for reliable data pipelines, organizations can choose from more than 100 connectors to seamlessly move data. New capabilities also enable connections without time-consuming export, transform, and load (ETL) processes, so users can achieve insights faster. Microsoft data integration works seamlessly to combine data and prepare it for analysis in a central, secure environment. Simplified data migration, low or no-code ETL, enterprise business workflows, metadata management, and data governance help boost productivity and empowers organizations to achieve more with data. The company’s entire data team—from data engineers to business analysts—can discover and use the data they need, whether users want to write their own queries or leverage a low-code environment to ingest and transform data.

Microsoft services for data integration

With tooling that delivers a comprehensive set of capabilities, organizations can build a solid data integration foundation.

Azure Data Factory is a managed cloud service that's built for petabyte-scale data ingestion, data transformation, and orchestration at scale. Use Azure Data Factory for data engineering (build, manage, and operationalize data ingestion and transformation pipelines), data and cloud migration (customers migrating data from on-premises or another cloud), and operational data integration (ongoing data integration and synchronization to support ongoing and critical business processes).

Azure Data Factory Studio is purpose-built to provide data engineers with a familiar and productive environment for authoring their data integration pipelines and data flows for code-free transformations at scale. The experience provides users with sophisticated control flow and orchestration capability to author robust data integration tasks that operate over large amounts of data. Hundreds of connectors enable data-source-specific connectivity from Azure Data Factory and Power Query.

Power Query is a data transformation and data preparation engine that delivers an approachable user experience with self-service and enterprise-ready connectors to hundreds of data sources, from cloud to on-premises. Power Query enables business analysts to handle data preparation tasks on their own for workloads across Power Platform, Dynamics 365, and Microsoft Excel.

Azure Synapse Link is a service that eliminates barriers between Microsoft data stores and Azure Synapse Analytics. Automatically move data from both operational databases and business applications without time-consuming ETL processes. Get an end-to-end view of the business by easily connecting separate systems—and democratize data access with a solution that brings the power of analytics to every data-connected team.

Azure Synapse Link already connects to a variety of Microsoft data stores, such as Azure Cosmos DB and Azure SQL Database, and will connect to more in the future. Here are the connections available now:

Azure Synapse Link for Dataverse—now generally available.
Azure Synapse Link for Cosmos DB—now generally available.
Azure Synapse Link for SQL (both SQL Server 2022 and Azure SQL Database)—now in preview.

The future of data is integration

In this complex environment where data holds such immense value, our north star is to enable our customers to drive a data culture and power a new class of data-first applications. We want our customers to take intelligent action based on insights unlocked from their data, and turn it into competitive advantage, all while respecting and maintaining compliance. We do this by empowering every individual and organization, delivering data integration and analytic tools and resources to inform every decision, at any scale.

Learn more

Read the full complimentary report from Gartner.
Learn more about Azure Synapse Analytics.
Get a free copy of the Limitless Analytics with Azure Synapse e-book.
Learn more about the Microsoft Intelligent Data Platform.
Get started with a free Azure account.
Join the free Azure Synapse Influencers program.

 

 

Gartner, Magic Quadrant for Data Integration Tools, August 17, 2022, Ehtisham Zaidi, Robert Thanaraj, Sharat Menon, and Nina Showell.

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Microsoft. GARTNER and Magic Quadrant are registered trademarks and service mark of Gartner, Inc. and its affiliates in the United States and internationally and are used herein with permission. All rights reserved. Gartner does not endorse any vendor, product, or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
Quelle: Azure

Dive deep into NAT gateway’s SNAT port behavior

In our last blog, we examined a scenario on how network address translation (NAT) gateway mitigates connection failures happening at the same destination endpoint with its randomized source network address translation (SNAT) port selection and reuse timers. In addition to handling these scenarios, NAT gateway’s unique SNAT port allocation is beneficial to dynamic, scaling workloads connecting to several different destination endpoints over the internet. In this blog, let’s deep dive into the key aspects of NAT gateway’s SNAT port behavior that makes it the preferred solution for different outbound scenarios in Azure.

Why SNAT ports are important to outbound connectivity

For anyone working in a virtual cloud space, it is likely that you will encounter internet connection failures at some point. One of the most common reasons for connection failures is SNAT port exhaustion, which happens when the source endpoint of a connection runs out of SNAT ports to make new connections over the internet.

Source endpoints use ports through a process called SNAT, which allows destination endpoints to identify where traffic was sent and where to send return traffic. NAT gateway SNATs the private IPs and ports of virtual machines (VMs) within a subnet to NAT gateway’s public IP address and ports before connecting outbound, and in turn provides a scalable and secure means to connect outbound.

Figure 1: Source network address translation by NAT gateway: connections going to the same destination endpoint over the internet are differentiated by the use of different source ports.

With each new connection to the same destination IP and port, a new source port is used. A new source port is necessary so that each connection can be distinguished from one another. SNAT port exhaustion is an all too easy issue to encounter with recurring connections going to the same destination endpoint since a different source port must be used for each new connection.

How NAT gateway allocates SNAT ports

NAT gateway solves the problem of SNAT port exhaustion by providing a dynamic pool of SNAT ports, consumable by all virtual machines in its associated subnets. This means that customers don’t need to worry about knowing the traffic patterns of their individual virtual machines since ports are not pool-based in fixed amounts to each virtual machine. By providing SNAT ports on-demand to virtual machines, the risk of SNAT exhaustion is significantly reduced, which in turn helps prevent connection failures.

Figure 2: SNAT ports are allocated on-demand by NAT gateway, which alleviates the risk of SNAT port exhaustion. 

Customers can ensure that they have enough SNAT ports for connecting outbound by scaling their NAT gateway with public IP addresses. Each NAT gateway public IP address provides 64,512 SNAT ports, and NAT gateway can scale to use up to 16 public IP addresses. This means that NAT gateway can provide over one million SNAT ports for connecting outbound.

How NAT gateway selects and reuses SNAT ports

Another key component of NAT gateway’s SNAT port behavior that helps prevent outbound connectivity failures is how it selects SNAT ports. Whether connecting to the same or different destination endpoints over the internet, NAT gateway selects a SNAT port at random from its available inventory.

Figure 3: NAT gateway randomly selects SNAT ports from its available inventory to make new outbound connections.

A SNAT port can be reused to connect to the same destination endpoint. However, before doing so, NAT gateway places a reuse cooldown timer on that port after the initial connection closes.

NAT gateway’s SNAT port reuse cooldown timer helps prevent ports from being selected too quickly for connecting to the same destination endpoint. This is advantageous when destination endpoints have their own source port reuse cooldown timers in place.

Figure 4: SNAT port 111 is released and placed in a cooldown period before it can connect to the same destination endpoint again. In the meantime, port 106 (dotted outline) is selected at random from the available inventory of ports to connect to the destination endpoint. The destination endpoint has a firewall with its own source port cooldown timer. There is no issue getting past the on-premise destination’s firewall since the connection from source port 106 is new.

What happens then when all SNAT ports are in use? When NAT gateway cannot find any available SNAT ports to make new outbound connections, it can reuse a SNAT port that is currently in use so long as that SNAT port connects to a different destination endpoint. This specific behavior is beneficial to any customer who is making outbound connections to multiple destination endpoints with NAT gateway.

Figure 5: When all SNAT ports are in use, NAT gateway can reuse a SNAT port to connect outbound so long as the port actively in use goes to a different destination endpoint. Ports in use by destination 1 are shown in blue. Port connecting to destination 2 is shown in yellow. Port 111 is yellow with a blue outline to show it is connected to destinations 1 and 2 simultaneously.

What have we learned about NAT gateway’s SNAT port behavior?

In this blog, we explored how NAT gateway allocates, selects, and reuses SNAT ports for connecting outbound. To summarize:

Function
NAT gateway SNAT port behavior
Benefit

SNAT port capacity
Up to 16 public IP addresses.
 
64,512 SNAT ports / NAT gateway public IP addresses.   
Easy to scale for large and variable workloads.

SNAT port allocation
Dynamic and On-demand.
Great for flexible, unknown, and large-scale workloads.

SNAT port selection
Randomized.
Reduces risk of connection failures to the same destination endpoint.

SNAT port reuse
Reuse to a different destination—connect outbound immediately.
 
Reuse to the same destination—set on a cooldown timer.
Reduces risk of connection failures to the same destination endpoint with source port reuse cooldown timers.

Deploy NAT gateway today

Whether your outbound scenario requires you to make many connections to the same or to several different destination endpoints, NAT gateway provides a highly scalable and reliable way to make these connections over the internet. See the NAT gateway SNAT behavior article to learn more.

NAT gateway is easy to use and can be deployed to your virtual network with just a few clicks of a button. Deploy NAT gateway today and follow along on how with: Create a NAT gateway using the Azure portal.
Quelle: Azure

Gain Deeper Insights with Microsoft Intelligent Data Platform

Data is foundational to any digital transformation strategy, yet many organizations struggle to understand what data they have, how to extract insights from it, and how to govern it—according to a 2022 Evanta survey1, over half of Chief Data Officers (CDOs) struggle with siloed operating models when it comes to data sharing and democratization. According to Harvard Business Review2, organizations that have embraced their data as a strategic asset have been better positioned to drive strategic differentiation and grow their revenue, but the fragmentation that exists today between databases, analytics, and governance is a common barrier to success.

The Microsoft Intelligent Data Platform, empowers organizations to invest more time creating value rather than integrating and managing their data estate. It integrates best-in-class solutions across Microsoft’s technology stack—breaking down data siloes and enabling organizations to extract real-time insights with the data governance needed to run the business safely.

“Shifting from a legacy on-premises data warehouse to Azure Synapse, supported by Datometry, has allowed us to virtualize the vast majority of our code without needing to repoint it. We have gained speed, performance, and agility while reducing costs and taken a big step forward in modernizing our enterprise data storage and management.”—Charlotte Lock, Director of Data, Digital & Loyalty at Co-op.

Added security and analytics features for the Azure data portfolio

The Microsoft Intelligent Data Platform features everything already available in the Azure Data portfolio (Azure Data Factory, Azure Data Explorer, SQL Server 2022, Azure SQL, Cosmos DB, and more.) as well as new products and features, including SQL Server 2022, Azure Synapse Link for SQL, Microsoft Purview Data Estate Insights, and Datamart in Power BI:

SQL Server 2022, currently in preview, is the most secure database of the last decade. And is now integrated with Microsoft Purview and Azure Synapse Link, allowing for richer insights and governance from data at scale. SQL Server 2022 also comes with new features including AWS S3 support, Azure Active Directory authentication, Query Store hints, as well as security improvements compared to SQL Server 2019.
Azure Synapse Link for SQL, now in preview, offers real-time analytics for data stored in Azure Synapse Analytics and Azure SQL. It is an automated system that allows for replication of data from transactional databases (both SQL Server 2022 and Azure SQL Database) to a dedicated SQL pool in Azure Synapse Analytics. Azure Synapse Link features near real-time analytics, low-code/no-code solutions for replicating data, as well as minimal operational impact on source systems.
Purview Data Estate Insights is an application that provides Chief Data Officers and other strategic leaders with a summary of their data estate and the risk associated with that data. Purview provides insights on data stewardship, inventory, curation, and governance through automatically generated reports which can be easily shared with stakeholders.
Lastly, Datamart in Power BI allows analysts to access richer insights from their data sets through data marts. Datamarts are self-service analytic solutions that help to bridge the gap between business users through a simple and optionally no-code experience. With datamarts, you can easily ingest and prepare data, add business semantics to data, manage and govern data, as well as build and share reports.

Real-world applications for businesses through real-time data

Let’s explore one example of how the Microsoft Intelligent Data Platform helped navigate supply chain issues:

Many operations companies conduct daily batch runs, where they must manually track their inventory levels and input the data at least once a day. With this method, these organizations cannot accurately predict how much product to sell and must err on the side of selling less to avoid running out of inventory. In times when supply chains are uncertain, this means companies miss out on even more sales.

.

With the Microsoft Intelligent Data Platform, companies can get real-time information on current inventory levels, rather than a daily report. They can also extract AI-driven insights based on demand spikes, shipping delays, and factory status that predict how many units will be available in a week’s time. This information is supported by the upgraded SQL Server 2022 as well as Azure Synapse Link for SQL server, which allows for more on-premises data to be extended to the cloud, analyzed, and used for decision making.

But what about using data for customer-facing solutions? The Microsoft Intelligent Data platform leverages the CosmosDB platform, providing consumers with recommendations for the best product based on real-time availability of units, delivery time, and compatibility with their needs. Consumers also have access to a support number powered by Power Virtual Agents; through Conversational AI, consumers can get intelligent updates on their order status so they can get the information they need quickly.

Learn more

These applications are only the tip of the iceberg when it comes to using the Microsoft Intelligent Data Platform. Learn more about the platform and how to get started—and make sure to watch the entire episode of the Microsoft Intelligent Data Platform Mechanics video, where we cover the technology and sample scenario, by clicking the linked image below!

 

 

Sources:

1Top 3 Goals & Challenges for CDOs in 2022, evanta.com.

2How to Lead a Data-Driven Digital Transformation, hbr.org.
Quelle: Azure

Azure Data Explorer: Log and telemetry analytics benchmark

Azure Data Explorer (ADX), a component of Azure Synapse Analytics, is a highly scalable analytics service optimized for structured, semi-structured, and unstructured data. It provides users with an interactive query experience that unlocks insights from the ocean of ever-growing log and telemetry data. It is the perfect service to analyze high volumes of fresh and historical data in the cloud by using SQL or the Kusto Query Language (KQL), a powerful and user-friendly query language.

Azure Data Explorer is a key enabler for Microsoft’s own digital transformation. Virtually all Microsoft products and services use ADX in one way or another; this includes troubleshooting, diagnosis, monitoring, machine learning, and as a data platform for Azure services such as Azure Monitor, PlayFab, Sentinel, Microsoft 365 Defender, and many others. Microsoft’s customers and partners are using ADX for a large variety of scenarios from fleet management, manufacturing, security analytics solutions, package tracking and logistics, IoT device monitoring, financial transaction monitoring, and many other scenarios. Over the last years, the service has seen phenomenal growth and is now running on millions of Azure virtual machine cores.

Last year, the third generation of the Kusto engine (EngineV3) was released and is currently offered as a transparent, in-place upgrade to all users not already using the latest version. The new engine features a completely new implementation of the storage, cache, and query execution layers. As a result, performance has doubled or more in many mission-critical workloads.

Superior performance and cost-efficiency with Azure Data Explorer

To better help our users assess the performance of the new engine and cost advantages of ADX, we looked for an existing telemetry and logs benchmark that has the workload characteristics common to what we see with our users:

Telemetry tables that contain structured, semi-structured, and unstructured data types.
Records in the hundreds of billions to test massive scale.
Queries that represent common diagnostic and monitoring scenarios.

As we did not find an existing benchmark to meet these needs, we collaborated with and sponsored GigaOm to create and run one. The new logs and telemetry benchmark is publicly available in this GitHub repo. This repository includes a data generator to generate datasets of 1GB, 1TB, and 100TB, as well as a set of 19 queries and a test driver to execute the benchmark.

The results, now available in the GigaOm report, show that Azure Data Explorer provides superior performance at a significantly lower cost in both single and high-concurrency scenarios. For example, the following chart taken from the report displays the results of executing the benchmark while simulating 50 concurrent users: 

Learn more

For further insights, we highly recommend reading the full report. And don’t just take our word for it. Use the Azure Data Explorer free offering to load your data and analyze it at extreme speed and unmatched productivity.

Check out our documentation to find out more about Azure Data Explorer and learn more about Azure Synapse Analytics. For deeper technical information, check out the new book Scalable Data Analytics with Azure Data Explorer by Jason Myerscough.
Quelle: Azure

Announcing Microsoft Dev Box Preview

Many IT organizations must choose between giving developers the flexibility they need to be productive and keeping developer workstations managed and secure. Supply chain challenges have led to developers waiting weeks or months to get the hardware they need, forcing them to use aging hardware or unsecured personal devices. At the same time, hybrid work has forced IT to open access to corporate and on-premises resources to developers around the world. With access to sensitive source code and customer data, developers are increasingly becoming the target of more sophisticated cyberattacks.

Today, we’re excited to announce the preview of Microsoft Dev Box is now available to the public. Microsoft Dev Box is a managed service that enables developers to create on-demand, high-performance, secure, ready-to-code, project-specific workstations in the cloud. Sign in to the Azure portal and search for “dev box” to begin creating dev boxes for your organization.

Focus on code—not infrastructure

With Microsoft Dev Box, developers can focus on writing the code only they can write instead of trying to get a working environment that can build and run the code. Dev boxes are ready-to-code and preconfigured by the team with all the tools and settings developers need for their projects and tasks. Developers can create their own dev boxes whenever they need to quickly switch between projects, experiment on a proof-of-concept, or kick off a full build in the background while they move on to the next task.

Microsoft Dev Box supports any developer IDE, SDK, or tool that runs on Windows. Developers can target any development workload that can be built from Windows including desktop, mobile, IoT, and web applications. Microsoft Dev Box even supports building cross-platform apps thanks to Windows Subsystem for Linux and Windows Subsystem for Android. Remote access gives developers the flexibility to securely access dev boxes from any device, whether it’s Windows, MacOS, Android, iOS, or a web browser.

Tailor dev boxes to the needs of the team

With Microsoft Dev Box, developer teams create and maintain dev box images with all the tools and dependencies their developers need to build and run their applications. Developer leads can instantly deploy the right size dev box for specific roles in a team anywhere in the world, selecting from 4 vCPU / 16GB to 32 vCPU / 128GB SKUs to scale to any size application. By deploying dev boxes in the closest Azure region and connecting via the Azure Global Network, dev teams ensure a smooth and responsive experience with gigabit connection speeds for developers around the world.

Using Azure Active Directory groups, IT admins can grant access to sensitive source code and customer data for each project. With role-based permissions and custom network configurations, developer leads can give vendors limited access to the resources they need to contribute to the project—eliminating the need to ship hardware to short-term contractors and helping keep development more secure.

Centralize governance and management

Developer flexibility and productivity can’t come at the expense of security or compliance. Microsoft Dev Box builds on Windows 365, making it easy for IT administrators to manage dev boxes together with physical devices and Cloud PCs through Microsoft Intune and Microsoft Endpoint Manager. IT admins can set conditional access policies to ensure users only access dev boxes from compliant devices while keeping dev boxes up to date using expedited quality updates to deploy zero-day patches across the organization and quickly isolate compromised devices. Endpoint Manager’s deep device analytics make it easy to audit application health, device utilization, and other critical metrics, giving developers the confidence to focus on their code knowing they’re not exposing the organization to any unnecessary risk.

Microsoft Dev Box uses a consumption-based compute and storage pricing model, meaning organizations only pay for what they use. Automated schedules can warm up dev boxes at the start of the day and stop them at the end of the day while they sit idle. With hibernation, available in a few weeks, developers can resume a stopped dev box and pick up right where they left off.

Get started now

Microsoft Dev Box is available today as a preview from the Azure Portal. During this period, organizations get the first 15 hours of the dev box 8vCPU and 32 GB Memory SKU for free every month, along with the first 365 hours of the dev box Storage SSD 512 GB SKU. Beyond that, organizations pay only for what they use with a consumption-based pricing model. With this model, organizations are charged on a per-hour basis depending on the number of Compute and Storage that are consumed.

To learn more about Microsoft Dev Box and get started with the service, visit the Microsoft Dev Box page or find out how to deploy your own Dev Box from a pool.
Quelle: Azure

Security for next generation telecommunication networks

Almost two years ago, the National Defense Science Board invited me to participate in the Summer Study 2020 Panel, “Protecting the Global Information Infrastructure.” They requested that I brief them on the evolution of the global communications infrastructure connecting all nations. The U.S., like other nations, both cooperates and competes in the commercial telecom market, while prioritizing national security.

This study group was interested in the implementation of 5G and its evolution to 6G. They understood that softwarization of the core communication technologies and the inclusion of edge and cloud computing as core infrastructure components of telecommunications services is inevitable. Because of my expertise in these areas, they invited me to share my thoughts on how we might secure and protect the emerging networks and systems of the future. I prepared for the meeting by looking at how Microsoft, as a major cloud vendor, had worked to secure our global networks.

My conclusion was simple. It is clear that attacks on the national communications infrastructure will occur with much greater sophistication than ever before. Because of this, we continue to develop our networks and systems with security as our first principle and we stay constantly vigilant. To these ends, Microsoft has adopted a zero-trust security architecture in all our platforms, services, and network functions.

Specialized hardware replaced by disaggregated software

One challenge for the panel was to understand precisely what the emerging connectivity infrastructure will be, and what security attributes must be assured with respect to that infrastructure.

Classical networks (the ones before the recent 5G networks), were deployed as hub-and-spoke architecture. Packets came to a specialized hardware-software package developed by a single vendor. From there, they were sent to the Internet. But 5G (and beyond) networks are different. In many ways, the specialized hardware has been “busted open.”

Functionality is now disaggregated into multi-vendor software components that run on different interconnected servers. As a result, the attack surface area has increased dramatically. Network architects have to protect each of these components along their interconnects—both independently and together. Furthermore, packets are now processed by multiple servers, any of which could be compromised. 5G brings the promise of a significant number of connected Internet-of-Things (IoT) devices that, once compromised, could also be turned into an army of attackers.

The power of cloud lies in its scale

In a word, Microsoft Azure is big: 62 regions in 140 countries worldwide host millions of networked servers, with regions connected by over 180,000 miles of fiber. Some of our brightest and most experienced engineers have used their knowledge to make this infrastructure safe and secure for customers, which includes companies and people working in healthcare, government services, finance, energy, manufacturing, retail, and more.

As of today, Microsoft tracks more than 250 unique nation-states, cybercriminals, and other threat actors. Our cloud processes and analyzes more than 43 trillion security signals every single day. Nearly 600,000 organizations worldwide use our security offering. With all this, Microsoft’s infrastructure is secure, and we have earned the trust of our customers. Many of the world’s largest companies with vital and complex security needs have offloaded much of their network and compute workloads to Azure. Microsoft Azure has become part of their critical infrastructure.

Securing Open RAN architecture

The cloud’s massive and unprecedented scale is unique, and precisely what makes the large investments in sophisticated defense and security economically possible. Microsoft Azure’s ground-up design includes strict security measures to withstand any type of attack imaginable. Conversely, the scale required to defend against sophisticated threats is not logical or feasible for smaller-scale, on-premises systems.

The report, “Why 5G requires new approaches to cybersecurity”1 articulates several good reasons why we need to think about how to protect our infrastructure. Many of us in research and engineering have also been thinking about these issues, as evidenced by Microsoft’s recently published white paper, Bringing Cloud Security to the Open RAN, which describes how we can defend and mitigate against malicious attacks against O-RANs, beginning with security as the first principle.

With respect to O-RAN and Azure for Operators Distributed Services (AODS), we explain how they inherit and benefit from the cloud’s robust security principles applied in the development of the far-edge and the near-edge. The inherently modular nature of Open RAN, alongside recent advancements in Software Defined Networking (SDN) and network functions virtualization (NFV), enables Microsoft to deploy security capabilities and features at scale across the O-RAN ecosystem.

We encapsulate code into secure containers and enable more granular control of sensitive data and workloads than prior generations of networking technologies. Additionally, our computing framework makes it easy to add sophisticated security features in real-time, including AI/ML and advanced cloud security capabilities to promptly detect and actively mitigate malicious activities.

Microsoft is actively working on delivering the most resilient platform in the industry, backed by our proven security capabilities, trustworthy guarantees, and a well-established secure development lifecycle. This platform is being integrated with Microsoft security defense services to prevent, detect, and respond to attacks. It includes AI/ML technologies to allow creation of logic to automate and create actionable intelligence to improve security, fault analyses, and operational efficiency.

We are also leveraging Azure services such as Active Directory, Azure Container Registry, Azure Arc, and Azure Network Function Manager to provide a foundation for secure and verifiable deployment of RAN components. Additional technologies include secure RAN deployment and management processes on top of these, which will eliminate significant upfront cost otherwise incurred by RAN vendors when building these technologies themselves.

It is noteworthy that across the entire project lifecycle—from planning to sunsetting—we integrate security practices. All software deliverables are developed in a “secure by default” manner, going through a pipeline that leverages Microsoft Azure’s security analysis tools that perform static analysis, credential scanning, regression, and functionality testing.

We are taking steps to integrate our RAN analytics engine with Microsoft Sentinel. This enables telecom operators to manage vulnerability and security issues, and to deploy secure capabilities for their data and assets. We expect Microsoft Sentinel, Azure Monitor, and other Azure services will incorporate our RAN analytics to support telecommunications customers. With this, we will deliver intelligent security analytics and threat intelligence for alert detection, threat visibility, proactive hunting, and threat response. We also expect that Azure AI Gallery will host sophisticated 3rd party ML models for RAN optimization and threat detection, running on the data streams we collect.

Mitigating the impact of compromised systems

We have built many great tools to keep the “bad guys” out, but building secure telecommunication platforms requires dealing with the unfortunate reality that sometimes systems can still be compromised. As a result, we are aggressively conducting research and building technologies, including fast detection and recovery from compromised systems.

Take the case of ransomware. Traditional ransomware attacks encrypt a victim’s data and ask for a ransom in exchange for decrypting it. However, modern ransomware attacks do not limit themselves to encrypting data. Instead, they remove the enterprise’s ability to control its platforms and critical infrastructure. The RAN constitutes critical infrastructure and can suffer from ransomware attacks.

Specifically, we have developed technology that prepares us for the unfortunate time when systems may be compromised. Our latest technology makes it easier to recover as quickly as possible, and with minimal manual effort. This is especially important in telco far-edge scenarios, where the large number of sites makes it prohibitively expensive to send technicians into the field for recovery. Our solution, which leverages a concept called trusted beacons, automatically recovers a far-edge node from a compromise or failure. When trusted beacons are absent, the platform automatically reboots and re-installs an original, unmodified, and uncompromised software image.

Looking into the future

We have developed mechanisms for monitoring and analyzing data as we look for threats. Our best-in-class verification technology checks every configuration before lighting it up. Our researchers are constantly adding new AI techniques that use the compute power of the cloud to protect our infrastructure better than ever before. Our end-to-end zero-trust solutions spanning identity, security, compliance, and device management, across cloud, edge, and all connected platforms will protect the telecommunications infrastructure. We continue to invest billions to improve cybersecurity outcomes.

Microsoft will continue to update you on developments that impact the security of our network, including many of the technologies noted within this article. Microsoft knows that while we need to continue to be vigilant, the telecommunications industry ultimately benefits by making Microsoft Azure part of their critical infrastructure.

1 Tom Wheeler and David Simpson, “Why 5G requires new approaches to cybersecurity.” The Brookings Institution.
Quelle: Azure