DEV Community: Ayo Hassan

How to Utilise Microsoft Azure Active Directory (Microsoft Entra ID) to Manage Cloud-Based Identities

Ayo Hassan — Wed, 15 May 2024 12:47:45 +0000

In this Project, Hagital Consulting Ltd has decided to streamline its identity management process by utilizing Microsoft Azure Active Directory (Microsoft Entra ID) to manage its cloud-based identities. As part of this initiative, they want to create a group called the Administrative department and add two new staff members and appoint one as Head of Admin. Additionally, they want to assign a Global Administrator role to the head of the Administrative department to add new users to the Company.

Before going into the creation of users and assigning role, let me explain the differences between Azure AD Roles and Azure Roles.

AZURE ACTIVE DIRECTORY (ENTRA ID) ROLES AND AZURE ROLES (RBAC)

Microsoft Entra ID (formerly known as Microsoft Azure Active Directory or Azure AD) is a cloud-based identity and access management (IAM) solution. It is a directory and identity management service that operates in the cloud and offers authentication and authorization services to various Microsoft services such as Microsoft 365, Dynamics 365, and Microsoft Azure. Entra ID provides users with single sign-on experience, regardless of whether their applications are cloud-based or on-premises. Entra ID offers many authentication methods, including password-based, multi-factor, smart card, and certificate-based authentication. It also includes several security features, such as Conditional Access policies, risk-based authentication, and identity protection. On July 11, 2023, Microsoft announced the renaming of Azure AD to Microsoft Entra ID to improve consistency with other Microsoft cloud products. The name change took place on July 15, 2023.

When Azure was initially released, access to resources was managed with just three administrator roles: Account Administrator, Service Administrator, and Co-Administrator. Later, Azure role-based access control (Azure RBAC) was added. Azure RBAC is a newer authorization system that provides fine-grained access management to Azure resources. Azure RBAC includes many built-in roles, can be assigned at different scopes, and allows you to create your own custom roles. To manage resources in Microsoft Entra ID, such as users, groups, and domains, there are several Microsoft Entra roles.

Azure AD (ENTRA ID) Roles
Azure AD roles now Microsoft Entra roles are used to manage Microsoft Entra resources in a directory such as create or edit users, assign administrative roles to others, reset user passwords, manage user licenses, and manage domains. Examples of Azure AD roles include Global Administrator, User Administrator, Application Administrator, and many others.The Azure AD roles include:
Global administrator: The highest level of access, including the ability to grant administrator access to other users and to reset other administrator’s passwords.
User administrator: Can create and manage users and groups, and can reset passwords for users, Helpdesk administrators and User administrators.
Helpdesk administrator: Can change the password for users who don’t have an administrator role and they can invalidate refresh tokens, which forces users to sign back in again.
Billing Administrator: Can make purchases and manage subscriptions.

Azure AD roles are primarily focused on managing access to Azure AD itself and its associated resources.

Azure Roles
Access Management for cloud resources is a critical function for any organization that is using the cloud. Azure role-based access control (Azure RBAC) helps you to manage who has access to Azure resources, what they can do with those resources, and what areas they have access to. They are used to control what users, groups, or applications can do within specific Azure resources such as virtual machines, storage accounts, databases, etc. Azure roles are applied at the subscription, resource group, or resource level. Examples of Azure roles include Owner, Contributor, Reader, and Custom roles that you can define based on specific resource access requirements.The fundamental Azure roles are:
Owner: Full rights to change the resource and to change the access control to grant permissions to other users.
Contributor: Full rights to change the resource, but not able to change the access control.
Reader: Read-only access to the resource
User Access Administrator: No access to the resource except the ability to change the access control.

The Difference Between Azure Roles and Microsoft Entra ID Roles

The primary difference between Azure roles and Microsoft Entra ID roles lies in the resources they manage.

Azure roles primarily govern access to resources deployed inside the cloud, including virtual networks, machines, and resource groups, with role assignments possible at various scopes and are applied at the subscription, resource group, or resource level

On the other hand, Microsoft Entra ID roles operate on identity objects at the tenant level and impact users’ abilities within that specific tenant. Although Microsoft Entra ID roles are typically set at a tenant level, you can make scope adjustments using administrative units. These are used as logical containers that give you more refined control over access permissions.

Now, let us create create a group called the Administrative department and add two new staff members and appoint one as Head of Admin. Additionally, I will assign a global administrator role to the Head of Admin to add new users.

⁠Sign in to Microsoft Azure
Sign in to Azure Portal: To create a group, users and assign roles on Microsoft Entra ID, you will go to the Azure portal (https://portal.azure.com) and sign in with your Azure account (Assuming you already have an account and a subscription, if not you have to create one). After signing in, your screen will display as shown below. You will then click on Microsft Entra ID or search for it in the search bar if not already displayed.

Create a New Group: Click on the Add dropdown to add a group and select Add a new group.

Group type: Select Security as group type.
Group Name: Enter the group name as Administrative Department. You may fill the group description, then “Create”. Then, the Administrative Department Group has been created. Next is to create users.

After creating the group, I will create new user accounts for two newly employed staff who will be assigned groupand roles.

Create new users: Click on the Add dropdown to add a User and select “Create new user”.

Then, fill in the column for User principal name, Mail nickname, Display name, and password. The Mail nickname and password could be auto-filled and generated if the ‘tick” column is selected.

Then click “Next: Properties”.

Fill the identity and job information of the new user. As we can see I have given the user Head of Department. Then click “Next: Assignment”.

Here, I will assign a group to the new user by clicking “Add group”.

Then, list of groups already created will appear. Here, I have only the Administrative Department earlier created. Then, Select the “Administrative Department”, and click “Select”.

We can see here, that the first user created has been assigned a group.
Next, I will assign the user a role.

The role directory will drop down to select appropriate role. Since the Head of Admin is to be assigned the role of Global Administrator, I will scroll until I see the Global Adminstrator. However, if the desired role is not listed, you can add roles by creating “custom role”. This requires premium subscription.

Select the “Global Administrator” then click select

Then, click “Create”.

Now, we have our first new staff (named Abimbola) user account created was assigned a group called “Administrative department” and assigned the “Global Administrator” role.

Next is to create our second user who is also a new staff member. Our second user is Ayoola. We will follow the same step we used in creating the first user to create the second user by filling in the Identity and job information.

Also, add the second staff to the Administrative Department group.

Here I assigned the second user the role of Service Support Administrator.

Now I have created user accounts for the two newly employed staff, where the fisrt staff has a Global Administrator role, and therefore have access to add new user.

To confirm that the account was successfully created, I will use the first user account with Global Administrator role to sign into Azure Portal and also add a new user.

First User signing into Azure using the account name and password generated during the account creation as seen below:

New users are prompted to change their password to a preferred choice.

Then click Next to sign in.

Now, the new Head of Department by name “Abimbola”, who is also the Global Adminstrator has successfully sign in to Azure.

The Head of Department, can now access and add new user to the Administrative Department and also assigning a role to the new staff member following the same steps earlier shown.

The name of the new user being created and added to the Adminstrative Department group is “Chukwuka”.

The new staff being added to the Admistrative Department group is being assigned “Security Reader” role.

Back to my account, I can see that a new staff member by name Chukwuka (Chuks) has been added to the company.

To access who added the new user and any other activities. I opened my Audit Logs, where I could see that a new user Chuwuka@ayohassan71gmail.omnicrosoft.com was added by Abimbola@ayohassan71gmail.omnicrosoft.com. Also, I could see that Abimbola@ayohassan71gmail.omnicrosoft.com changed password. Detailed information of these activities could further be explored when clicked.

How to Utilize Microsoft Azure Active Directory (Microsoft Entra ID) to Manage Cloud-Based Identities

Ayo Hassan — Wed, 15 May 2024 10:05:05 +0000

Before going into the creation of users and assigning role, let me explain the differences between Azure AD Roles and Azure Roles.

AZURE ACTIVE DIRECTORY (ENTRA ID) ROLES AND AZURE ROLES (RBAC)
Microsoft Entra ID (formerly known as Microsoft Azure Active Directory or Azure AD) is a cloud-based identity and access management (IAM) solution. It is a directory and identity management service that operates in the cloud and offers authentication and authorization services to various Microsoft services such as Microsoft 365, Dynamics 365, and Microsoft Azure. Entra ID provides users with single sign-on experience, regardless of whether their applications are cloud-based or on-premises. Entra ID offers many authentication methods, including password-based, multi-factor, smart card, and certificate-based authentication. It also includes several security features, such as Conditional Access policies, risk-based authentication, and identity protection. On July 11, 2023, Microsoft announced the renaming of Azure AD to Microsoft Entra ID to improve consistency with other Microsoft cloud products. The name change took place on July 15, 2023.

Global administrator: The highest level of access, including the ability to grant administrator access to other users and to reset other administrator’s passwords.
User administrator: Can create and manage users and groups, and can reset passwords for users, Helpdesk administrators and User administrators.
Helpdesk administrator: Can change the password for users who don’t have an administrator role and they can invalidate refresh tokens, which forces users to sign back in again.
Billing Administrator: Can make purchases and manage subscriptions.

Azure AD roles are primarily focused on managing access to Azure AD itself and its associated resources.

Owner: Full rights to change the resource and to change the access control to grant permissions to other users.
Contributor: Full rights to change the resource, but not able to change the access control.
Reader: Read-only access to the resource
User Access Administrator: No access to the resource except the ability to change the access control.

Difference Between Azure Roles and Microsoft Entra ID Roles

The primary difference between Azure roles and Microsoft Entra ID roles lies in the resources they manage.

⁠Sign in to Microsoft Azure
Sign in to Azure Portal: To create a group, users and assign roles on Microsoft Entra ID, you will go to the Azure portal (https://portal.azure.com) and sign in with your Azure account (Assuming you already have an account and a subscription, if not you have to create one). After signing in, your screen will display as shown below. You will then click on Microsft Entra ID or search for it in the search bar if not already displayed.

Create a New Group: Click on the Add dropdown to add a group and select Add a new group.

Group type: Select Security as group type.
Group Name: Enter the group name as Administrative Department. You may fill the group description, then “Create”. Then, the Administrative Department Group has been created. Next is to create users.

After creating the group, I will create new user accounts for two newly employed staff who will be assigned groupand roles.
Create new users: Click on the Add dropdown to add a User and select “Create new user”.

Then, fill in the column for User principal name, Mail nickname, Display name, and password. The Mail nickname and password could be auto filledand generated if the ‘tick” column is selected.
Then click “Next: Properties”

Fill the identity and job information of the new user. As we can see I have given the user Head of Department. Then click “Next: Assignment”

Here, I will assign a group to the new user by clicking “Add group”

Then, list of groups already created will appear. Here, I have only the Administrative Department earlier created. Then, Select the “Administrative Department”, and click “Select”

We can see here, that the first user created has been assigned a group.
Next, I will assign the user a role

Select the “Global Administrator” then click select

And, click “Create”

Now, we have our first user by name Abimbola, who was assigned a group called “Administrative department” and assigned the “Global Administrator” role.

Next is to create our second user who is also a new staff member. Our second user is Ayoola. We will follow the same step we used in creating the first user to create the second user by filling in the Identity and job information.

Also, add the second staff to the Administrative Department group.

Then, assign role. Here I assigned the second user the role of Service Support Administrator.

Now I have created user accounts for the two newly employed staff, where the fisrt staff has a Global Administrator role, and therefore have access to add new user.

To confirm that the account was successfully created, I will use the first newly created staff member user's account with Global Administrator role to sign into Azure Portal and also add a new user.

First User signing into Azure using the account name and password generated during the account creation as seen below:

New users are prompted to change their password to a preferred choice.

Then click Next to sign in.

Now, the new Head of Department by name “Abimbola”, who is also the Global Adminstrator has successfully sign in to Azure.

The Head of Department, can now access and add new user to the Administrative Department and also assigning a role to the new staff member following the same steps earlier shown.

The name of the new user being created and added to the Adminstrative Department group by the Head of Department is “Chukwuka”

The new staff being added to the Admistrative Department group is being assigned “Security Reader” role.

Back to my account, I can see that a new staff member by name Chukwuka (Chuks) has been added to the company.

DEPLOYING A VIRTUAL MACHINE SCALE SET ON AZURE

Ayo Hassan — Wed, 08 May 2024 10:42:17 +0000

DETAILED STEPS IN DEPLOYING A VIRTUAL MACHINE SCALE SET

Azure Virtual Machine Scale Sets let you create and manage a group of load balanced Virtual Machines (VMs). The number of VM instances can automatically increase or decrease in response to demand or a defined schedule. Scale sets allows easy creation and management of multiple VMs, it provides high availability and application resiliency by distributing VMs across availability zones or fault domains. It also allows your application to automatically scale as resource demand changes, and works at large-scale. Learn more about Virtual Machine Scale Set.

Sign in to Azure Portal: To create a Virtual Machine Scale Set (VMSS), you will go to the Azure portal (https://portal.azure.com) and sign in with your Azure account (Assuming you already have an account and a subscription, if not you have to create one). After signing in, your screen will display as shown below. You will then search for virtual machine scale sets in the search bar.

This will take you to the next page where you will open the VMSS to begin its creation.

In creating a VMSS, one need to determine the purpose and requirement of the scale set, size, operating system and region among others. Therefore, you will begin by filling the project details in the Basic requirements.

Project Details:
Subscription: Select your Azure subscription.

Resource Group: Create a new one or select an existing resource group. To create a new one, click on the “create new” to give name to your resource group. Resource group could also be autogenerated based on the name you asigned to your VMSS.

Virtual Machine Scale Set Name: Enter a unique name for your VMSS.

Region: Choose the region where you want to deploy your VMSS. A region refers to a specific geographical location with data centres that host infrastructure and services. Click on the drop down to select your availability options. Here I chose (Europe) UK South region. Next is availability zone.

Availability Zone: Many Azure regions provide availability zones, which are separated groups of datacenters within a region. Availability zones are close enough to have low-latency connections to other availability zones. However, availability zones are far enough apart to reduce the likelihood that more than one will be affected by local outages or weather. Availability zones have independent power, cooling, and networking infrastructure. They're designed so that if one zone experiences an outage, then regional services, capacity, and high availability are supported by the remaining zones. They help your data stay synchronized and accessible when things go wrong. For the purpose of this project, I selected the three zones 1-3 as indicated in the screenshot above. Next is Orchestration Mode.

Orchestration Mode: Virtual Machines Scale Sets provide a logical grouping of platform-managed virtual machines. With scale sets, you create a virtual machine configuration model, automatically add or remove additional instances based on CPU or memory load, and automatically upgrade to the latest OS version. Scale set orchestration modes allow you to have greater control over how virtual machine instances are managed by the scale set. There are two types of orchestration mode. These are:
a. Uniform Orchestration: Virtual Machine Scale Sets with Uniform orchestration use a virtual machine profile or template to scale up to desired capacity. Uniform Orchestration has the following features:
(1) Manages virtual machines that are all based on the same configuration model.
(2) Optimized for large-scale stateless workloads with identical instances.
(3) Provides fault domain high availability guarantees when configured with fewer than 100 instances.
(4) Uses identical VM instances.
(5) Individual instances aren't compatible with the standard Azure IaaS VM API commands.

b. Flexible Orchestration: With Flexible orchestration, Azure provides a unified experience across the Azure VM ecosystem. Flexible orchestration does:
(1) Allows for a mix of virtual machines with different configurations within the same scale set.
(2) Achieve high availability at scale with identical or multiple virtual machine types.
(3) Offers high availability guarantees up to 1000 VMs by spreading VMs across fault domains in a region or within an Availability Zone.
(4) Enables you to scale out your application while maintaining fault domain isolation.
(5) Supports standard Azure IaaS VMs.
Here, we are using Uniform orchestration

Scaling Mode:
A Virtual Machine Scale Set deployment can be scaled-out (increased) or scaled-in (reduced) based on an array of metrics, including platform and user-defined custom metrics. While a scale-out creates new virtual machines based on the scale set model, a scale-in affects running virtual machines that may have different configurations and/or functions as the scale set workload evolves. The scale-in policy feature provides users a way to configure the order in which virtual machines are scaled-in, by way of three scale-in configurations:
a. Default: Virtual Machine Scale Set will automatically use the ‘Default’ scale-in policy if there's no scale-in policy definition found on the scale set model.

b. NewestVM: This policy will delete the newest, or most recently created virtual machine in the scale set, after balancing VMs across availability zones (for zonal deployments). Enabling this policy requires a configuration change on the Virtual Machine Scale Set model.

c. OldestVM: This policy will delete the oldest created virtual machine in the scale set, after balancing VMs across availability zones (for zonal deployments). Enabling this policy requires a configuration change on the Virtual Machine Scale Set model.

Scaling Mode can be updated Manually or Automatically configured. Here, we will select “Autoscaling”, then we click on “Configure”.

Scaling conditions: Click on the add scaling condition or the pen icon to make necessary scaling of your choice and save.

Instance details
Image: select the image of your choice, here I selected Ubuntu server.
VM architecture: select x64 as it provides most software compatibility.
size: select the size of your choice.

Administrator account
Authentication type: Select Password
Username: type in your username.
Password: enter your desire password.
Confirm password: re-enter your desire password.
License type: select the license type and select the box.
Then, Click “Next: Spot”

Leave Spot as default, then click on “Next: Disks”

Os disk
OS disk size: Select the size of your choice
OS disk type: Select the one of your choice.
key management: Select Platform-managed key.

Networking
Virtual Network: The auto generated network is recommended.

Load balancing
The term load balancing refers to the distribution of workloads across multiple computing resources. Load balancing aims to optimize resource use, maximize throughput, minimize response time, and avoid overloading any single resource. It can also improve availability by sharing a workload across redundant computing resources. Azure provides various load-balancing services that you can use to distribute your workloads across multiple computing resources. These resources include Azure Application Gateway, Azure Front Door, Azure Load Balancer, and Azure Traffic Manager.

Azure load-balancing services can be categorized along two dimensions: global versus regional and HTTP(S) versus non-HTTP(S).
Global vs. regional
• Global: These load-balancing services distribute traffic across regional back-ends, clouds, or hybrid on-premises services. These services route end-user traffic to the closest available back-end. They also react to changes in service reliability or performance to maximize availability and performance. You can think of them as systems that load balance between application stamps, endpoints, or scale-units hosted across different regions/geographies.
• Regional: These load-balancing services distribute traffic within virtual networks across virtual machines (VMs) or zonal and zone-redundant service endpoints within a region. You can think of them as systems that load balance between VMs, containers, or clusters within a region in a virtual network.
HTTP(S) vs. non-HTTP(S)
• HTTP(S): These load-balancing services are Layer 7 load balancers that only accept HTTP(S) traffic. They're intended for web applications or other HTTP(S) endpoints. They include features such as SSL offload, web application firewall, path-based load balancing, and session affinity.
• Non-HTTP(S): These load-balancing services can handle non-HTTP(S) traffic, and we recommend them for non web workloads.
Read more on Load Balancing

Load balancing options: select Azure load balancer.
select load balancer: Select “create a load balancer” if you don't have an existing one.

Load balancer name: enter the name of your choice.
Type: select the one of your choice and leave others at default then select create.

Then click on “Next: Management”

Upgrade policy
Upgrade mode: select the upgrade mode of your choice.

Next click on “Next: Health”
Health: Select the enable application health monitoring in order to update the status of your instances. Also, select on automatic repair.

You may skip “Advanced, and Tags” as these populate as defaults.
Then Click “Review + create”, after validation is passed then click “Create”.

Click on “Go to Resources”

You have now completed your deployment, and here is the overview of your VMSS. You may now click on “Instances” to confirm if your instances are running.

Here, you can confirm your instances are running.

When you click on the instances above, you can see the availability zones they are deployed within the location selected as shown below.

HOW TO CREATE AND ATTACH A DATA DISK TO AN EXISTING WINDOWS VIRTUAL MACHINE

Ayo Hassan — Mon, 29 Apr 2024 12:06:57 +0000

CREATE AND ATTACH A DATA DISK TO AN EXISTING WINDOWS VIRTUAL MACHINE
In this project, we are going to create and attach a new data disk to an existing Windows 11 Pro Virtual Machine (VM). Below is a screenshot of Windows 11 Pro VM already created. See how a Windows 11 Pro VM is created. For the purpose of learning, we will first check the existing disks in my Windows 11 Pro VM. To do this, you will click on “File Explorer” as indicated below.

The file explorer page will appear, you will then click on “This PC” as shown below to confirm the existing disks

The existing disks on the Windows 11 pro VM created are as shown below:

Disk Roles in Azure:
Before proceeding to create a new data disk, let me explain disk roles. According to Microsoft Azure, there are three main disk roles in Azure. These are, the OS disk, the data disk, and the temporary disk. These roles map to disks that are attached to your virtual machine.

OS disk
Every virtual machine has one attached operating system disk. That OS disk has a pre-installed OS, which was selected when the VM was created. This disk contains the boot volume. Generally, you should only store your OS information on the OS disk, and store all applications, and data on data disks. However, if cost is a concern, you can use the OS disk instead of creating a data disk. It is important to note that OS disk is persistent.

Data disk
A data disk is a managed disk that is attached to a virtual machine to store application data, or other data you need to keep. Data disks are registered as (Small Computer System Interface (SCSI) drives and are labeled with a letter that you choose. The size of the virtual machine determines how many data disks you can attach to it and the type of storage you can use to host the disks. Generally, you should use the data disk to store your applications and data, instead of storing them on OS disks. Data disk is also persistent.

Temporary disk
Most VMs contain a temporary disk, which is not a managed disk. The temporary disk provides short-term storage for applications and processes, and is intended to only store data such as page files, swap files, or SQL Server tempdb. Data on the temporary disk may be lost during a maintenance event, when you redeploy a VM, or when you stop the VM. During a successful standard reboot of the VM, data on the temporary disk will persist. For more information about VMs without temporary disks, see Azure VM sizes with no local temporary disk. To read more on disk roles, see https://learn.microsoft.com/en-us/azure/virtual-machines/managed-disks-overview

1.⁠ ⁠Create a new Data Disk: To create a new data disk, you will go to the Azure portal (Assuming you already have an account and a subscription, if not you have to create one) and navigate to the virtual machine you want to attach the data disk to. If you are a new user, you have to first create a Windows 11 Pro VM. If you have already created the VM, you can search for the VM name on the search bar, or see it under the Resources you have already created in your Azure. The name I assigned to the VM for the Windows 11 Pro earlier created is “AyWin11VM-1”. Therefore, you will click on your VM as indicated below

The Overview page of the Windows 11 Pro VM will displayed as shown below. Then you will click on setting to navigate to the Disk

Under the Settings section, select Disks.

The disks page will show the OS disk and options to create and attach a new data disk or attach existing data disks. Since we are creating a new data disk to be attached, you will click on “Create and attach a new disk”.

You will then have to configure the disk settings such as giving your disk a name, storage type, and Size (in GB) as indicated below and then click on “Apply” . Then you have successfully created a new data disk.

2.⁠ ⁠Attach the Data Disk to the Virtual Machine:
After successfully created a new data disk for your VM on Microsoft Azure, you will need to go back to the Windows 11 pro VM created on your PC to initialize the data disk for use. You will then have to click on the disk management on the status bar for mac users, or right click on the desktop and click on disk management for Windows users. Then click “OK” to Initialise Disk

Then, the disks information will appear as shown below. However, you will only see Disk 0 and Disk 1. Therefore, you will need to scroll down to see Disk 2 and any other Disk available

Now we can see disk 2

You will then right click inside the Disk 2 box and click on “New Simple Volume” to allocate the disk and partition it for use.

3. Initialize and Format Disk:
This will take you to the New Simple Volume Wizard which will help you to create a simple volume on your disk. To continue, click “Next”, continue to click “Next” then click “Finish”

After successfully allocated and partitioning the data disk for use, you will see that the “New Volume disk” has been added to the Disk Management as shown below.

To confirm that the new data disk has been created, initialize and attached for use in the VM, you will need to close the disk management, then click on File Explorer, and click on “This PC”

Then, you will see that the new data disk you created has been added to the Windows 11 Pro VM as shown below

You have now successfully created and attached a new data disk to an existing windows 11 virtual machine

Guide on Creating a Linux Virtual Machine on Azure and Connecting to it via SSH Key Authentication

Ayo Hassan — Mon, 29 Apr 2024 10:35:17 +0000

Step-by-Step Guide on Creating a Linux Virtual Machine on Azure and Connecting to it via SSH Key Authentication

This document describes how to create a Linux Virtual Machine on Azure and connecting to it via SSH key authentication. To do this, you should already have Azure account and subscription. The subscription could either be a paid subscription, free for new users, or student’s account.

Sign in to Azure Portal: Go to the Azure Portal (https://portal.azure.com) and sign in with your Azure account. After signing in, your screen will display as shown below.

Navigate to Virtual Machines: Once you're logged in, navigate to the "Virtual Machines" service as highlighted above or you can find it by searching for "Virtual Machines" in the search bar at the top. Once you click on the virtual machine, your screen will be displayed as shown below.

Then you will click on the "Create" button, anyone you click will display a drop down as shown below. You will then click on the Azure virtual machine highlighted in red arrow. This will take you to the project details where you will begin to fill the basic configuration for you to start creating your virtual machine.

Create a Virtual Machine: Here, you are going to create a virtual machine that runs on linux, you will begin by filling the basic configuration starting with the subscription.

Subscription: Select your Azure subscription.

Resource Group: Create a new one or select an existing resource group. To create a new one, click on the “create new” to give name to your resource group. Resource group could also be autogenerated based on the name you asigned to your VM.

Virtual Machine Name: Enter a unique name for your VM.

Region: Choose the region where you want to deploy your VM. A region refers to a specific geographical location with data centres that host infrastructure and services. Click on the drop down to select your availability options. Here I chose (US) East US region. Next is availability zone.

Availability Zone: Many Azure regions provide availability zones, which are separated groups of datacenters within a region. Availability zones are close enough to have low-latency connections to other availability zones. However, availability zones are far enough apart to reduce the likelihood that more than one will be affected by local outages or weather. Availability zones have independent power, cooling, and networking infrastructure. They're designed so that if one zone experiences an outage, then regional services, capacity, and high availability are supported by the remaining zones. They help your data stay synchronized and accessible when things go wrong. For the purpose of this project, I selected only zone 1 as indicated in the screenshot below. However, you could select 2 or all the 3 zones available.

Image: Select the operating system image you want to use for your VM. You will click on the drop down to select the operating system you want for your VM. Select “Ubuntu Server” as indicated above, or any other Linux distribution you prefer.

Authentication Type: You will select the authentication type. Here I selected SSH public key for authentication since I intended to connect to my VM via SSH key authentication. However, you may chose the second option if you intend to connect via Password.

Username: The username above is auto generated, you may also wish to change the username to a preferred name.

SSH Public Key Source: Click on the SSH Public Key Source drop down to either generate a new key pair or use an existing one.

Key pair Name: You will also assign a unique name to your key pair. Next is inbound port rule.

Public Inbound Ports: This allows you to indicate which virtual machine network port are accessible from the public internet. Here I indicated that selected ports should be allowed. And my selected inbound port is SSH(22). Having done with the Basics configuration, you will then proceed to Disks.

Disks: On the Disk page, click on the OS disk type dropdown and select any disk type of your choice, here I selected “Premium SSD”. You may leave the other columns as default. Then click “Next:Networking” or skip to “Review+Create”

Networking, Management, monitoring, Advanced, Tags: These pages usually displayed as default. Find their default screenshots below. However, you may wish to skip them and proceed to “Review+Create”.

Then Click "Review + create". This will show validation passed as highlighted below.

Then click “Create” . This will take you to the next page to generate new key pair. Then, you will click on “Download private key and create resource” as shown below. The new key pair will then be downloaded on your PC, while Azure will also provision your VM.

Wait for Deployment: Azure will now provision your virtual machine. This process may take a few minutes. Then the next page will show that your deployment is complete as shown below, then you will click on “Go to Resource”

Next, click on “Connect” and then “Connect”. This will take you to a page with other options to connect your VM.

Retrieve Public IP Address: Once the virtual machine is deployed, note down the Public IP address on Azure portal overview page.
Note: Also go to your download and save the downloaded key pair into a file for later use when connecting via SSH.

Note: Other options for connecting to your VM are “SSH using Azure CLI” and “Native SSH” as displayed below

If you select “Native SSH”, you will see instruction on how to configure and connect in the highlighted box below. However, you are not going to connect using “Native SSH” in this project.

If you select “SSH using Azure CLI”, you will see instruction on how to connect in the highlighted box below leading you to how to configure and connect. However, you are not going to connect using “SSH using Azure CLI” in this project.

Connect via SSH Key Authentication: Open your Command Line Interface on Windows or Terminal in case of macOS/Linux.

Then enter the following command to connect to your VM:
⁠ssh -i filepath username@public_ip_address
Note: filepath is the downloaded SSH keypair you earlier saved on your PC

Note: my filepath above is “/Users/a12345/Downloads/AySshVm_key.pem” without the quote. This can be retrieved from your earlier downloaded key pair, when you “copy as path” from your download or from saved document file. Also note, that mac users can copy directly by rightclicking on the download and click copy, when pasted it will appear as “file path”

Replace "username" with your VM username (usually "azureuser" for Ubuntu) and "public_ip_address" with the IP address you noted down earlier.Example: azureuser@123.456.789.012
When prompted “Are you sure you want to continue connecting (yes/no/fingerprint), type yes

However, you may not be prompted “Are you sure you want to continue connecting (yes/no/fingerprint), if you have made earlier attemp to connect. Therefore, once you enter the command “ssh -i filepath username@public_ip_address” and press enter, you will be connected to your Azure virtual machine via SSH key authentication in the terminal as shown below.
⁠

That is it. You have successfully created a Linux virtual machine on Azure and connected to it via SSH key authentication.

Step by Step guide on how to create a Windows 11 Virtual Machine on Azure

Ayo Hassan — Sun, 07 Apr 2024 22:44:38 +0000

Step by Step guide on how to create a Windows 11 Virtual Machine on Azure.
Sign in to Azure Portal: Go to the Azure Portal (https://portal.azure.com) and sign in with your Azure account. After signing in, your screen will display as shown below.

Navigate to Virtual Machines: Once you're logged in, navigate to the "Virtual Machines" service on the GUI as highlighted above or you can find it by searching for "Virtual Machines" in the search bar at the top. Once you click on the virtual machine, your screen will be displayed as shown below.

Then you will click on the "Create" button on the left sidebar (arrowed in red) or the one at the middle. Either one you click will display a drop down as shown below.

You will then click on the Azure virtual machine highlighted in red arrow. This will take you to the project details where you will begin to fill the basic configuration for you to start creating your virtual machine.

Basic Configuration:
Subscription: Select your Azure subscription.
Resource Group: Create a new one or select an existing resource group. To create a new one, click on the “create new” to give name to your resource group.

Virtual Machine Name: Enter a unique name for your VM.

Region: Choose the region where you want to deploy your VM. A region refers to a specific geographical location with data centres that host infrastructure and services. Click on the drop down to select your availability options. Here I chosed (US) East US region. Next is availability zone.

Many Azure regions provide availability zones, which are separated groups of datacenters within a region. Availability zones are close enough to have low-latency connections to other availability zones. They are connected by a high-performance network with a round-trip latency of less than 2ms. However, availability zones are far enough apart to reduce the likelihood that more than one will be affected by local outages or weather. Availability zones have independent power, cooling, and networking infrastructure. They're designed so that if one zone experiences an outage, then regional services, capacity, and high availability are supported by the remaining zones. They help your data stay synchronized and accessible when things go wrong. To ensure availability of service. Should there be a distruption of service at one zone, I selected zones 1 and 2.

Security Type: Select the security type you need by clicking on the drop down. Here I selected the “Trusted launch virtual machine”.

Image: Select the operating system image you want to use for your VM. You will click on the drop down to select the operating system you want for your VM. I selected Windows 11 Pro VM since that is what I want to create.

Size: Choose the size of the VM based on your requirements and budget. For this purpose, I selected the Standard size.

Administrator Account:
Username: Enter the username for the administrator account.
Password: Enter the password for the administrator account. Make sure it meets Azure's password requirements.

Inbound Port Rules: On the inbound port rules section, select “Allow selected ports” and then select RDP (3389). This port will give you remote access to your physical work desktop computers.

After selecting your inbound port, confirm the Licensing, then click “Next Disk” to direct you to the Disk page.

Disks and Networking: On the Disk page, click on the OS disk type dropdown and select “Standard SSD” or any disk type of your choice as shown below. Leave the other columns as default. Then click “Next: Network”

Networking

The networking page usually displayed as default, so you may wish to leave it as displayed, or chose to change them as you may wish. Therefore, instead of clicking on “Next: Management”, just click on “Tag”.

Tag: Give your tag a name. Tags are way to label and organize resources in cloud computing environments. The purpose of tags is to provide metadata or additional information that helps in managing, organizing and tracking resources within a cloud infrastructure. Next click on “review+create”.

Review + Create: This review all the settings you've configured for your VM. Once you're satisfied with the “validation passed” and “pricing”, click on the "Create" button to start the deployment process.

Deployment: Azure will now begin deploying your virtual machine based on the configuration you provided. This process may take a few minutes to complete. Once deployment is complete, click on “Goto resource” to take you to your VM overview .

On the VM overview, click on “connect”

Then connect.

Accessing your VM: You can access your VM by clicking on “Download RDP file”. For Mac users, you may need to download Microsoft Remote Desktop from Mac app store to launch your VM.

After downloading, you will be prompted to enter your password and click “Continue”. Then you will be welcomed to your VM

Chose your privacy setting

You have successfully created a virtual machine on Azure. You can now start using it for your workloads or applications.