DEV Community: Raphael Olaniyi

Mastering the Cloud: A Hands-On Journey Through Azure Resource Management

Raphael Olaniyi — Thu, 02 Apr 2026 11:34:36 +0000

The first time you step into the Azure portal, it feels a bit like walking into a vast digital city. Virtual machines hum quietly in the background, networks connect invisible pathways, and storage vaults guard precious data. But like any city, Azure needs maintenance. It needs structure. It needs someone who understands how to keep everything secure, efficient, and cost-effective.
This is the story of that journey.
By the end, you won’t just know what to click — you’ll understand why it matters.

Setting the Stage: Building the Foundation
Every good project begins with preparation.
Imagine you’ve been asked to assist an Azure Administrator. You won’t run the entire infrastructure, but you’ll handle critical updates. Before anything else, you must create a safe workspace — a container to hold everything you build.
In this stage, we will create a virtual network, a virtual machine, a storage account, and associated resources.

Kick starting the preparation of the environment

Let us set-up the environment to complete the rest of the steps.
Login to Microsoft Azure

Login to Microsoft Azure at https://portal.azure.com Create a resource group Think of a resource group as a project folder. Instead of scattering resources across your subscription, you neatly organize them in one place. This makes cleanup simple and prevents costly mistakes later.
From the Azure portal home page, in the search box, enter resource groups.
Select Resource groups under services.

NB: You take note of existing resource groups — especially one called NetworkWatcherRG. If it was there before you started, you leave it alone later. Cloud hygiene begins with awareness.

Select Create.

Enter guided-project-rg in the Resource group name field.
The Region field will automatically populate. Leave the default value.
Select Review + create.
Select Create.

Return to the home page of the Azure portal by selecting Home.

Constructing the Network
Next, you build the digital roads.
Create a virtual network with one subnet
At first, it contains just one subnet — enough to get started. This network will serve as the backbone for everything else you deploy.

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.

Select Create
Scroll down to the Instance details section and enter guided-project-vnet for the Virtual network name.
Select Review + create.

Select Create.
Wait for the screen to refresh and show Your deployment is complete.

Select Home to return to the Azure portal home page.

Bringing a Machine to Life
Now comes the compute layer — the engine of your infrastructure.
Create a virtual machine
You deploy a Linux virtual machine:
• Name: _guided-project-vm _
• Image: Ubuntu Server
• Authentication: Password-based login
Azure even shows you the hourly cost before deployment. This small detail is powerful — every click in the cloud has financial consequences.

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.

Select guided-project-rg for the Resource group.
Enter guided-project-vm for the Virtual machine name.
For the Image, select one of the Ubuntu Server options. (For example, Ubuntu Server 24.04 LTS - x64 Gen2)
Continue further on the Basics page to the Administrator account section.
Select Password for authentication type.
Enter guided-project-admin for the admin Username.
Enter a password for the admin account.
Confirm the password for the admin account.
Leave the rest of the settings as default settings. You can review the settings if you like, but shouldn’t change any.
Select Review + create. NB: Once validation has passed, you’ll receive a cost estimate of how much it will cost per hour to run the VM.

NB: Once validation has passed, you’ll receive a cost estimate of how much it will cost per hour to run the VM

Select Create to confirm the resource cost and create the virtual machine
Select Home to return to the Azure portal home page.

Adding Storage Capacity
Every system needs storage. So you create a storage account, ensuring its name is globally unique (a reminder that Azure is truly global).
Create a Storage account

From the Azure portal home page, in the search box, enter storage accounts.
Select Storage accounts under services.

Select Create.
NB: The subscription and resource group should automatically fill in. Verify that the information filled in matches the correct subscription and the new resource group created for the guided project (guided-project-rg if you’re following along with the naming conventions).

Scroll down to the Instance details section and enter a name for the storage account. Storage accounts must be globally unique, so you may have to try a few different times to get a storage account name.
Select Review + create.
Select Create.
Wait for the screen to refresh and show Your deployment is complete.
Select Home to return to the Azure portal home page.

With this, your foundational environment is complete:
• Resource group
• Virtual network
• Virtual machine
• Storage account
The stage is set.

Phase Two: Refining the Network
In this phase you will perform the following exercises:
• Update the virtual network
• Manage virtual machines
• Control storage access
• Manage tags and locks
• Clean up
Lets give a Scenario
You’re helping an Azure Admin maintain resources. While you won’t be responsible for maintaining the entire infrastructure, the Admin will ask you to help out by completing certain tasks. Currently, there’s a Linux virtual machine (VM) that’s underutilized, and a need for a new Linux machine to serve as an FTP server. However, the Azure admin wants to be able to track network flow and resource utilization for the needed FTP server, so has asked you to start out by provisioning a new subnet. The current subnet should be left alone, as there are future plans for using it for additional VMs.

Create a new subnet on an existing virtual network (vNet)

Login to Microsoft Azure at https://portal.azure.com
From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.

Select the guided-project-vnet virtual network.

From the guided-project-vnet blade, under settings, select Subnets.

To add a subnet, select + Subnet.

For Subnet purpose leave it as Default.
For Name enter: ftpSubnet.
Leave the rest of the settings alone and select Add.

Select Home to return to the Azure portal home page.

Congratulations – you’ve completed the creation of a subnet. This subnet is only going to be used for SFTP traffic. To increase security, you need to configure a Network security group to restrict which ports are allowed on the subnet.

Strengthening Security with a Network Security Group
Security in Azure is layered.
You create a Network Security Group (NSG) called: ftpNSG
Create a network security group

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select Network security groups.

Select + Create.

Verify the subscription is correct.
Select the guided-project-rg resource group.
Enter ftpNSG for the network security group name.
Select Review + create.

Once the validation is complete, select Create.
Wait for the screen to refresh and display Your deployment is complete.
Select Go to resource.

Create an inbound security rule

Under settings, select Inbound security rules.
Select + Add.
Change the Destination port ranges from 8080 to 22.
Select TCP for the protocol.
Set the name to ftpInbound.
Select Add.

Select Home to return to the Azure portal home page. Congratulations – you’ve created a new Network security group and configured rules to allow inbound FTP traffic. Now, you’ll need to associate the new network security group with the ftpSubnet. Associate a network security group to a subnet
From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet virtual network.
Under settings, select Subnets.
Select the ftpSubnet you created.
On the Edit subnet page, under the Security section heading, update the Network security group field to ftpNSG.
Select Save.

Nicely done. It looks like you’ve completed the work needed to prepare the network for shifting the current Linux VM to a new subnet that’s designed to handle incoming FTP traffic.

Phase Three: Managing the Virtual Machine
With the network prepared, it’s time to adjust the machine itself.
In this exercise, you’ll manage the virtual machine. You’ll change the virtual machine's assigned subnet, vertically scale the virtual machine, add storage, and finally add an automatic shutdown.
Scenario
With the network settings updated to support segmenting the Linux virtual machine, you’re ready to manage the virtual machine itself. The first thing the Azure admin asks you to complete is moving the virtual machine to the new subnet you created in the previous exercise.

Move the virtual machine network to the new subnet

Login to Microsoft Azure at https://portal.azure.com
From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.

If the virtual machine is running, select Stop

NB: In order to make some configuration changes, such as changing the subnet, the VM will need to be restarted. You can request the change without stopping the VM, but Azure will force a restart before completing the change.

Wait for the Status field to update and show Stopped (deallocated).
Within the Networking subsection of the menu, select Network settings.
Select the Network interface / IP configuration hyperlink for the VM.
On the IP Configurations page, update the Subnet to ftpSubnet.
Select Apply.

Select Home to return to the Azure portal home page.

Good job! You’ve migrated the VM from one subnet to another. Remember, the new subnet had specific network security rules applied to help it function as an FTP server. The next task from the Azure admin relates to the computing power of the VM. The admin would like you to vertically scale the machine to increase the computing power.
You resize the VM to a larger instance (for example, D2s_v5). This is vertical scaling — increasing CPU and memory without rebuilding the server.
Cloud flexibility at its best.

Vertically scale the virtual machine

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the _guided-project-vm _virtual machine.
Locate the Availability + scale submenu and select Size.

Select a new VM size D2s_v5 for example. (NB: If you don’t see the same size as shown in this exercise, select something similar.)
Select Resize

NB: The VM size may not update in the Azure UI until the VM is restarted
Select Home to return to the Azure portal home page.

Well done. With the VM scaled up to a more robust processor, it can handle the new role it’s being assigned.
However, now the Azure admin realizes that if the VM is going to server as an FTP server, it needs more storage. The Azure admin asked you to attach a new data disk to the VM.
Attach data disks to a virtual machine

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Locate the settings submenu and select Disks.

Select Create and attach a new disk.
Leave LUN as default.
Enter ftp-data-disk for the Disk name.
Leave the Storage type as default.
Enter 20 for the Size.
Select Apply to create the new storage disk and attach the disk to the machine.

Select Home to return to the Azure portal home page. Nice! Now the VM has enough storage to handle some uploads.

Controlling Costs with Auto-Shutdown
The final thing the Azure admin is concerned about is the cost of running the computer 24 hours a day. The first thing they’ll do every morning is start up the FTP server. However, they’d like you to configure it to automatically shutdown every day at 7 PM Coordinated Universal Time (UTC)
Configure automatic shutdown on a virtual machine

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Under the Operations submenu, select Auto-shutdown.

In order to let late uploads finish, set the Scheduled shutdown to 7:15:00 PM.
Select Save.

Select Home to return to the Azure portal home page.

Phase Four: Controlling Storage Access
In this exercise, you’ll complete several tasks related to managing a storage account and components of the storage account.
Scenario
The Azure admin wants you to get more familiar with storage accounts, containers, and file shares. They anticipate needing to share an increasing number of files and need someone who is skilled using these services. They’ve given you a task of creating a storage container and a file share and uploading files to both locations.
Create a storage container

Login to Microsoft Azure at https://portal.azure.com
From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Setting the stage exercise. The storage account name is the hyperlink to the storage account. (NB: it should be associated with the resource group guided-project-rg.)

On the storage account blade, under the Data storage submenu, select Containers.
Select + Add container.

In the Name field, enter storage-container.
Select Create.

Great! With a storage container created, you can upload a blob to the container. Locate a picture that you can upload, either on your computer or from the internet, and save it locally to make uploading easier.
Upload a file to the storage container

Select the storage container you just created.

Select Upload and upload the file you prepared.

Once the file is ready for upload, select Upload. With the file uploaded, notice that the Access tier is displayed. For something we uploaded just for testing, it doesn’t need to be assigned to the Hot access tier. In the next few steps, you’ll change the access tier for the file.

Change the access tier

Select the file you just uploaded (the file name is a hyperlink).
Select Change tier.

Select Cold.
Select Save

NB: You just changed the access tier for an individual blob or file. To change the default access tier for all blobs within the storage account, you could change it at the storage account level.

Select Home to return to the Azure portal home page. Good job! You’ve successfully uploaded a storage blob and changed the access tier from Hot to Cold. Next, you’ll work with file shares.

Create a file share

From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise. The storage account name is the hyperlink to the storage account. (NB: it should be associated with the resource group guided-project-rg)
On the storage account blade, under the Data storage submenu, select File shares.
Select + File share.

On the Basics tab, in the name field enter file-share.

On the Backup tab, uncheck Enable backup.

Select Review + create.
Select Create.
Once the file share is created, select Upload.
Upload the same file you uploaded to the blob storage or a different file, it’s up to you.
Select Home to return to the Azure portal home page.

Sharing Access Securely with SAS Tokens
The next piece of the puzzle is figuring one way to control access to the files that have been uploaded. Azure has many ways to control files, including things like role-based access control. In this scenario, the Azure admin wants you to use shared access tokens or keys.
Create a shared access signature token

From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the setting the stage exercise.
On the storage account blade, select Storage browser.
Expand Blob containers. NB: Blob container is another name for the storage containers. Items uploaded to a storage container are called blobs
Select the storage container you created earlier, storage-container.

Select the ellipses (three dots) on the end of the line for the image you uploaded.

Select Generate SAS NB: When you generate a shared access signature, you set the duration. Once the duration is over, the link stops working. The **Start automatically populates with the current date and time.
Set Signing method to Account key.
Set Signing key to Key 1 Tip: There are two signing keys available. You can choose either one, or create SAS tokens with different durations
Set Stored access policy to None.
Set Permissions to Read.
Enter a custom start and expiry time or leave the defaults.

Set Allowed protocols to HTTPS only.
Select Generate SAS token and URI.

Copy the Blob SAS URL and paste it in another window or tab of your browser. It should display the image you uploaded. Keep this tab or window open.

Select Home to return to the Azure portal home page. With the SAS token created, anyone with that link can access the file for the duration that was set when you created the SAS token. However, controlling access to a resource or file is about more than just granting access. It’s also about being able to revoke access. To revoke access with a SAS token, you need to invalidate the token. You invalidate the token by rotating the key that was used.

Rotate access keys

From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Setting the stage exercise.
Expand the Security + networking submenu.
Select Access keys.

For Key 1, select Rotate key.
Read and then acknowledge the warning about regenerating the access key by selecting Yes.

Once you see the success message for rotating the access key, go back to the window or tab you used to check the SAS token and refresh the page. You should receive an authentication failed error. Phase Five: Organizing with Tags and Protecting with Locks Now comes governance.

If you’ve completed the previous exercises, you’ve managed added a subnet to a virtual network, made changes to a virtual machine, and worked with an Azure storage account. The final set of tasks focus around working with tags and resource locks to help manage and monitor your environment. During this exercise you’ll go back into each of the areas you’ve already worked to add tags, locks, or a combination of both.

Scenario
Pleased with your progress so far, the Azure admin hopes that you can wrap a few things up to help with monitoring and protecting resources. They want to know that someone can’t accidentally get rid of the virtual machine that’s running as an FTP server, and they want a quick way to see what department is using resources and the resource’s purpose.

Manage tags and locks on VMs
Adding tags to resources is a quick way to be able to group and organize resources. Tags can be added at different levels, giving you the ability to organize and group resources at a level that makes sense for you.

Add tags to a virtual machine
You’ll start by adding a pair of tags to the virtual machine. One tag will be to identify the purpose of the virtual machine and the other will be to indicate the department the machine supports.

Login to Microsoft Azure at https://portal.azure.com
From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
From the menu pane, select Tags.

On one line for Name enter Department and for Value enter Customer Service
On the next line, for Name enter Purpose and for Value enter FTP Server.
Select Apply.

While you’re working on the virtual machine, it’s a great time to add a resource lock.
Add a resource lock to a VM

If necessary, expand the Settings submenu.
Select Locks.

Select + Add.
For the name, enter VM-delete-lock.
For the Lock type, select Delete.
You may enter a note to help remind you why you created the lock.
Select OK.

That’s it. Now the VM is protected from deletion and has tags assigned to help track use. Time to move onto the network.

Select Home to return to the Azure portal home page.

Add tags to network resources

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet network.
From the menu pane, select Tags. NB: Notice that now you can select an existing tag to apply or add a new tag. You can also select just the name or value and apply create something new in the other field.
For the Name select Department.
For the Value enter IT.
Select Apply.

Now both the VNet and VM have are organized.

Congratulations! You’ve completed this exercise.

The Final Step: Clean Up

Remove delete locks

If you attempt to delete a resource with a delete lock, you’ll receive a warning that the operation failed due to a delete lock being in place. To avoid that, it’s important to clear delete locks from resources you intend to delete before issuing the delete command.

Login to Microsoft Azure at https://portal.azure.com
From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
If necessary, expand the Settings submenu.
Select Locks.
Select Delete on the line for the VM-delete-lock.

On the pop-up window, select Delete to confirm deletion of the lock. Once the delete lock is removed, you’ll be able to delete the VM. While this was the only delete lock required by the exercise, if you applied other delete locks during the exercise, remove them now. When you’re done, select Home to return to the Azure portal home page.

Delete the project resource group
A key benefit of using resource groups is the ability to rapidly delete all of the resources assigned to a resource group at once.

From the Azure portal home page, in the search box, enter Resource groups.
Select resource groups under services.
Select the guided-project-rg resource group.
Select Delete resource group.

Select Apply force delete…
Enter guided-project-rg in the confirmation box.
Select Delete.

On the Delete confirmation pop-up, select Delete.

It will approximately 5 minutes before the resource group is fully deleted. You’ll need to refresh the resource group page every few minutes until the guided-project-rg is gone to confirm complete deletion.
Important: Recall at the beginning, you checked for a NetworkWatcherRG resource group. If there was a NetworkWatcherRG when you started, then you’re finished. However, if the NetworkWatcherRG was created for the project, you’ll need to delete the NetworkWatcherRG as well following a nearly identical process.
If you don’t need to delete the NetworkWatcherRG, you can head back to Learn now and complete the module. If you need to delete the NetworkWatcherRG, continue on for instructions.

Delete the NetworkWatcherRG
Important: If the NetworkWatcherRG existed prior to starting the guided project, do not delete it as part of the guided project clean up.

From the Azure portal home page, in the search box, enter Resource groups.
Select resource groups under services.
Select the NetworkWatcherRG resource group.
Select Delete resource group.
Enter _NetworkWatcherRG _in the confirmation box.
Select Delete.
On the Delete confirmation pop-up, select Delete. It will approximately 5 minutes before the resource group is fully deleted. You’ll need to refresh the resource group page every few minutes until the NetworkWatcherRG is gone to confirm complete deletion.

What You’ve Truly Learned from this article are:

This wasn’t just about clicking buttons in Azure.
You’ve learned how to:
• Scale and manage virtual machines
• Design and secure networks
• Control storage tiers and access
• Protect resources with locks
• Organize infrastructure with tags
• Prevent unnecessary costs
Most importantly, you’ve learned that cloud administration is not about deployment — it’s about stewardship.
Azure is powerful. But mastery comes from maintaining it with intention.
And now, you’ve taken that step.
See you in my next article.

How to create a shared services hub virtual network with isolation and segmentation

Raphael Olaniyi — Fri, 26 Jul 2024 13:14:37 +0000

Let us assume you were tasked with applying Zero Trust principles to a hub virtual network in Azure. Let us take for instance, The IT department needs network isolation and segmentation for the web application in a spoke network.

To provide network isolation and segmentation for the web application, you need to create an Azure virtual network with subnets with address space that the IT team provided. Once the virtual network is created, the next step is to configure virtual network peering. This allows the virtual networks to communicate with each other securely and privately.
We shall be performing these three tasks:

Create a virtual network
Create a subnet
Configure vnet peering

Create hub and spoke virtual networks and subnets
Begin by creating the virtual networks.
Open a browser and navigate to the Azure portal and login.

To create a Virtual Network, in the search bar at the top of the portal type “Virtual Networks” and select “Virtual Networks” from the results.

In the “Virtual Networks” portal pane, select ““+ Create”.

Fill out all the tabs of the creation process by using the values in the following table:

Property Value
Resource group RG1
Name app-vnet
Region East US
IPv4 address space 10.1.0.0/16
Subnet name frontend
Subnet address range 10.1.0.0/24
Subnet name backend
Subnet address range 10.1.1.0/24
Note: Leave all other settings as their defaults. Select “Next” to advance to the next tab, and Create to create the virtual network.

Following the same steps as above, create the Azure virtual network Hub-vnet by using the values in the following table:

Property Value
Resource group RG1
Name Hub-vnet
Region East US
IPv4 address space 10.0.0.0/16
Subnet name AzureFirewallSubnet
Subnet address range 10.0.0.0/24

Once the deployment is complete. Navigate back to the portal, in the search bar type “resource groups” and select Resource Groups” from the results. Select on “RG1” in the main pane and comfirm both virtual networks have been deployed.

Setup a peer relationship between the virtual networks
Setting up a peer relationship between the two virtual networks will allow traffic to flow in both directions between the app-vnet and hub-vnet virtual networks.

In the Portal in the RG1 resource group view. Select on the “app-vnet” virtual network.

On the app-vnet context menu on the left hand side of the portal scroll down and select on peerings

In the app-vnet peerings pane, Select + Add.

Fill out the form using the values in the following table:

Property Value
This virtual network Peering link name app-vnet-to-hub
Remote virtual network Peering link name hub-to-app-vnet
Virtual network hub-vnet
Note: Leave all other settings as their defaults. Select “Add” to create the virtual network peering.

Once the process completes,and after the configuration updates. Validate that the Peering status is set to Connected. (you may have to refresh the page to see the updated status)

How to Create a Window Server Virtual Machine and install and IIS Web server role on the VM

Raphael Olaniyi — Sat, 08 Jun 2024 12:33:24 +0000

In this article we will be creating a virtual machine and also we wuill install an IIS weber sever role on the virtual machine.

Lets Begin

Search for Virtual Machine and select Virtual machine

Click on +create on your extreme left

Select Azure Virtual Machine from the options.

Under project details for resource group click on Create New and give it a name (make it a special name or name of a project)

Under the Instance details give your virtual machine a name of your choice.

Select a region of your choice

Select the availability zones (this is dependent on how highly available you want the virtual machine to be you can choose zone1 and zone2 if you want the VM to be highly available and you can choose zone1,zone2 and zone3 if you want your VM to be very highly available its all dependent on your budget, the higher the availability the higher the cost)

Because you are creating a Linux VM for image you will select Window Server

Leave every other things at default then go to Administrator Account and Create a User Name and Password of your choice

Under select inbound port SELECT HTTP this will enable us to view our virtual machine as a web page.

Select Licencing

Click on the Monitoring tab and disable boot diagnostic

Then click on tags tab and tag the VM by putting your name or company name.

Click on create and Review wait for it to validate or show green.

Once Validation is passed Select Create

Once the deployment is complete, click on Go to Resource

Click connect to connect to the VM

Click on Select on the Native RDP Local Machine

It will pop up on the right, wait for it to validate and show configured then download the RDP file

When it has finished downloading then you click on the downloaded file then click connect NB! If you are using a MAC book you need to download and install Microsoft Remote Desktop App

Enter the Password we created during Administrator Settings

Click on Yes

Our Window Server2019 data center edition is ready

Click on the Start menu.
Type PowerShell and open Windows PowerShell or Windows PowerShell ISE as an administrator (right-click and select Run as administrator).

Install IIS:

Run the following command to install the IIS role and management tools:
Install-WindowsFeature -name Web-Server –IncludeManagementTools (you can copy and paste the command)

This is what you get if the command installs successfully (it shows that something has been installed on the window web server)

Verify Installation:
You can verify that IIS has been installed by opening a web browser and navigating to http://localhost. You should see the default IIS welcome page.
or Just paste the ip address of the VM in a browser and verifiy that you installed the webserver.

Click on iP address on the Azure page

Paste it to browser to know if you have installed a Web Server or not.

As you can see from the browser that we have successfully installed a web server

How to Create Linux virtual machine on Azure SSH into Linux server and install nginx on it.

Raphael Olaniyi — Sat, 08 Jun 2024 07:40:59 +0000

In this article we will create a linux virtual mirchine, SSH into the Linux server and also install nginx! on the virtual machine.

Lets Begin:

Click on the +create button (virtual machine hosted by Azure )

Click on +create on your extreme left

Select Azure Virtual Machine from the options.

Under project details for resource group click on Create New and give it a name (make it a special name or name of a project)

Under the Instance give your virtual machine a name of your choice.

Select a region of your choice

Because you are creating a Linux VM for image you will select Ubuntu Server

For Administrator type Select password (With this you can access your VM with password rather than SSH Public keys)

Create a User Name and Password of your choice

Under select inbound port SELECT HTTP and SSH this will enable us to view our virtual machine as a web page.

Click on the Monitoring tab and disable boot diagnostic

Then click on tags tab and tag the VM by putting your name or company name.

Click on create and Review wait for it to validate or show green.

Once Validation is passed Select Create

Once the deployment is complete, click on Go to Resource

Click on the ip address to increase the idle timeout

Increase the idle time out to 30min (this is to avoid your VM timing out after 5min )

After you are done with that then click save and hit the X sign on the right.

You have successfully created a Linux Virtual Machine, In other to connect to it or to SSH to it , open the power shell application on your windows laptop and type SSH |space |VM Name|VMipaddress NB there is no space between the VM name and ip address as seen below then click enter
You will be asked if you would like to continue then you type Yes
Then you will be asked for password then type the VM password you created and press Enter NB when you are typing your password it will be invisible that’s how Linux protects its self just keep typing when you are done hit the enter button.

Once the Password is correct the power shell will connect to the Linux VM after that it will instruct that for you to run command as an administrator you need to be connected as user “Root” you will use the Sudo command to achieve this next is type sudo su and hit Enter

After that you are connected as a root “user” then you can now instruct apt to install apt nginx by typing “apt install nginx” then hit Enter

Now let us confirm if nginx! Was actually installed on the virtual machine, we can do this by going to your Azure site and copy the ip address and paste it on the web page and see the result.

Copy ip address

Paste the ip address to the browser

From the result you can see that nginx! Has been successfully installed on the virtual machine.

Securing App Development with Managed Identities and Role-Based Access Control

Raphael Olaniyi — Wed, 29 May 2024 21:36:54 +0000

The company is designing and developing a new app, requiring secure storage access using keys and managed identities. Developers aim to implement role-based access control and need protected immutable storage for testing.

Our goals are as follows:

Create the storage account and managed identity.
Secure access to the storage account using a key vault and key.
Configure the storage account to use the customer-managed key in the key vault.
Set up a time-based retention policy and an encryption scope.

Create the storage account and managed identity
Provide a storage account for the web app.
In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name is unique and meets the naming requirements.

Move to the Encryption tab.
Check the box for Enable infrastructure encryption.
Notice the warning, This option cannot be changed after this storage account is created.

Select Review + Create.

Wait for the resource to deploy.

Provide a managed identity for the web app to use.
Search for and select Managed identities.

Select Create.

Select your resource group.

Give your managed identity a name.

Select Review and create, and then Create.

Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs.

Search for and select your storage account.

Select the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Storage Blob Data Reader role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select the managed identity you created in the previous step.

Click Select and then Review + assign the role.
Select Review + assign a second time to add the role assignment.

Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key
To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions.

In the portal, search for and select Resource groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Administrator role.

On the Members page, select User, group, or service principal.

Select Select members.

Search for and select your user account. Your user account is shown in the top right of the portal.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

You are now ready to continue with the lab.

Create a key vault to store the access keys.

In the portal, search for and select Key vaults.
Select Create.

Select your resource group.

Provide the name for the key vault. The name must be unique.

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.

Select Review + create.

Wait for the validation checks to complete and then select Create.

After the deployment, select Go to resource.

On the Overview blade ensure both Soft-delete and Purge protection are enabled.

Create a customer-managed key in the key vault.

In your key vault, in the Objects section, select the Keys blade.

Select Generate/Import and Name the key.

Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault
Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity.

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select your managed identity.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

Configure the storage account to use the customer managed key in your key vault. Learn more about customer managed keys on an existing storage account.

Return to your the storage account.

In the Security + networking section, select the Encryption blade.

Select Customer-managed keys.

Select a key vault and key. Select your key vault and key.

Select to confirm your choices.

Ensure the Identity type is User-assigned.

Select an identity.

Select your managed identity then select Add.

Save your changes.

If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure an time-based retention policy and an encryption scope.
The developers require a storage container where files can’t be modified, even by the administrator.

Navigate to your storage account.
In the Data storage section, select the Containers blade.

Create a container called hold. Take the defaults. Be sure to Create the container.

Upload a file to the container.

In the Settings section, select the Access policy blade.

In the Immutable blob storage section, select + Add policy.

For the Policy type, select time-based retention.

Set the Retention period to 5 days.
Be sure to Save your changes.

Try to delete the file in the container.
Verify you are notified failed to delete blobs due to policy.
The developers require an encryption scope that enables infrastructure encryption.

Navigate back to your storage account.
In the Security + networking blade, select Encryption.

In the Encryption scopes tab, select Add.

Give your encryption scope a name.

The Encryption type is Microsoft-managed key.

Set Infrastructure encryption to Enable.
Create the encryption scope.

Return to your storage account and create a new container.
Notice on the New container page, there is the Name and Public access level.
Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

Efficient and Secure File Sharing for Geographically Dispersed Offices with Restricted Network Access on Azure

Raphael Olaniyi — Tue, 28 May 2024 12:12:23 +0000

The company operates in multiple locations and requires an efficient method for file sharing and information dissemination across its offices. For instance, the Finance department needs reliable access to confirm cost information for auditing and compliance purposes. These file shares must be easily accessible and load quickly, with certain content restricted to selected corporate virtual networks.

Our goals are as follows:

Create a storage account specifically for file shares.
Configure a file share and directory.
Set up snapshots and practice restoring files.
Restrict access to a specific virtual network and subnet.

Create and configure a storage account for Azure Files.
Create a storage account for the finance department’s shared files. Learn more about storage accounts for Azure Files deployments.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name meets the naming requirements.

Set the Performance to Premium.

Set the Premium account type to File shares.

Set the Redundancy to Zone-redundant storage.

Select Review and then Create the storage account.

Wait for the resource to deploy.
Select Go to resource.

Create and configure a file share with directory.
Create a file share for the corporate office. Learn more about Azure File tiers.

In the storage account, in the Data storage section, select the File shares blade.

Select + File share and provide a Name.

Review the other options, but take the defaults.

Select Create

Add a directory to the file share for the finance department. For future testing, upload a file.

Select your file share and select + Add directory.

Name the new directory finance.

Select Browse and then select the finance directory.

Notice you can Add directory to further organize your file share.
Upload a file of your choosing.

Configure and test snapshots.
Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots.

Select your file share.
In the Operations section, select the Snapshots blade.

Select + Add snapshot. The comment is optional. Select OK.

Select your snapshot and verify your file directory and uploaded file are included.

Practice using snapshots to restore a file.

Return to your file share.
Browse to your file directory.

Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion.

Select the Snapshots blade and then select your snapshot.

Navigate to the file you want to restore,

Select the file and the select Restore.

Provide a Restored file name.

Verify your file directory has the restored file.

File has been restored

Configure restricting storage access to selected virtual networks.
This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created.

Search for and select Virtual networks.

Select Create. Select your resource group. and give the virtual network a name.

Take the defaults for other parameters, select Review + create, and then Create.

Wait for the resource to deploy.
Select Go to resource.

In the Settings section, select the Subnets blade.

Select the default subnet.

In the Service endpoints section choose Microsoft.Storage in the Services drop-down.

Do not make any other changes.
Be sure to Save your changes.

The storage account should only be accessed from the virtual network you just created.

Return to your files storage account.
In the Security + networking section, select the Networking blade.

Change the Public network access to Enabled from selected virtual networks and IP addresses.

In the Virtual networks section, select Add existing virtual network.

Select your virtual network and subnet, select Add.

Be sure to Save your changes.

Select the Storage browser and navigate to your file share.

Verify the message not authorized to perform this operation. You are not connecting from the virtual network.

Creation of Private Storage for Internal Comapny Document with Restricted Access on Azure .

Raphael Olaniyi — Tue, 28 May 2024 07:58:07 +0000

The company requires secure storage for its offices and departments to ensure that private content is not shared without consent. This storage must have high availability to withstand regional outages and will also be used for backing up the public website.

Our goals are as follows:

Create a storage account for the company's private documents.
Configure redundancy for the storage account.
Set up a shared access signature to provide partners with restricted access to specific files.
Back up the public website storage.
Implement lifecycle management to move content to the cool tier.

Let us Start:
Create a storage account for the internal private company documents.
In the portal, search for and select Storage accounts.
Select + Create.

Select the Resource group created in the previous lab.

Set the Storage account name to private. Add an identifier to the name to ensure the name is unique.

Select Review, and then Create the storage account.

Wait for the storage account to deploy, and then select Go to resource.

This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.

In the storage account, in the Data management section, select the Redundancy blade.

Ensure Geo-redundant storage (GRS) is selected.

Refresh the page.
Review the primary and secondary location information.
Save your changes.

Create a storage container, upload a file, and restrict access to the file.
Create a private storage container for the corporate data.

In the storage account, in the Data storage section, select the Containers blade.

Select + Container.

Ensure the Name of the container is private.
Ensure the Public access level is Private (no anonymous access).

As you have time, review the Advanced settings, but take the defaults.
Select Create.

For testing, upload a file to the private container. he type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publically accessible.

Select the container.
Select Upload.

Browse to files and select a file.
Upload the file.

Select the uploaded file.
On the Overview tab, copy the URL.

Paste the URL into a new browser tab.
Verify the file doesn’t display and you receive an error.

An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS).

Select your uploaded blob file and move to the Generate SAS tab.

In the Permissions drop-down, ensure the partner has only Read permissions.

Verify the Start and expiry date/time is for the next 24 hours.
Select Generate SAS token and URL.

Copy the Blob SAS URL to a new browser tab.

Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.

Configure storage access tiers and content replication.
To save on costs, after 30 days, move blobs from the hot tier to the cool tier.

Return to the storage account.
In the Overview section, notice the Default access tier is set to Hot.

In the Data management section, select the Lifecycle management blade.

Select Add rule.

Set the Rule name to movetocool.

Set the Rule scope to Apply rule to all blobs in the storage account.

Select Next.

Ensure Last modified is selected.

Set More than (days ago) to 30.
In the Then drop-down select Move to cool storage.

As you have time, review other lifecycle options in the drop-down.
Add the rule.

The public website files need to be backed up to another storage account.

In your storage account, create a new container called backup. Use the default values. Refer back to the container we created earlier if you need detailed instructions.

Navigate to your publicwebsite storage account. This storage account was created in the previous articles

In the Data management section, select the Object replication blade.

Select Create replication rules.

Set the Destination storage account to the private storage account.

Set the Source container to public and the Destination container to backup.

Create the replication rule.

Optionally, as you have time, upload a file to the public container. Return to the private storage account and refresh the backup container. Within a few minutes your public website file will appear in the backup folder.
As seen below:

File uploaded to public container

File backed up seen in backup container

How to Create Storage Account With High Availability On Microsoft Azure.

Raphael Olaniyi — Mon, 27 May 2024 08:58:46 +0000

An example of the need for a high-availability storage account is the storage supporting the company website. This site offers product images, videos, marketing literature, and customer success stories. Given the global customer base and rapidly increasing demand, it's vital to ensure low latency load times for this mission-critical content. Additionally, maintaining version control of documents and enabling quick restoration of deleted files are crucial.

Our goals are as follows:

Create a storage account with high availability.
Ensure the storage account has anonymous public access.
Create a blob storage container for the website documents.
Enable soft delete so files can be easily restored.
Enable blob versioning.

Lets start

Create a storage account with high availability.

In the portal, search for and select Storage accounts.

Select + Create.

For resource group select new. Give your resource group a name and select OK.

Set the Storage account name to publicwebsite. Make sure the storage account name is unique by adding an identifier.

Take the defaults for other settings.
Then Select Review and then Create.

Wait for the storage account to deploy, and then select Go to resource

This storage requires high availability if there’s a regional outage. Additionally, enable read access to the secondary region.

In the storage account, in the Data management section, select the Redundancy blade.

Ensure Read-access Geo-redundant storage is selected.

Review the primary and secondary location information.

It is important to note that Information on the public website should be accessible without requiring customers to login.
Hence In the storage account, in the Settings section, select the Configuration blade.

Ensure the Allow blob anonymous access setting is Enabled.

Be sure to Save your changes.

Ensure the storage account has anonymous public access.
The public website has various images and documents. Create a blob storage container for the content.
In your storage account, in the Data storage section, select the Containers blade.

Select + Container.

Ensure the Name of the container is public.

Select Create.

Customers should be able to view the images without being authenticated. Configure anonymous read access for the public container blobs. Learn more about configuring anonymous public access. to do this follow the step below;
Select your public container.

On the Overview blade, select Change access level.

Ensure the Public access level is Blob (anonymous read access for blobs only). Select OK.

Lets Practice uploading files and testing access to be sure of what we have done
For testing, upload a file to the public container. The type of file doesn’t matter. A small image or text file is a good choice
Ensure you are viewing your container then Select Upload.

Browse to files and select a file. Browse to a file of your choice.

Select Upload.

Close the upload window, Refresh the page and ensure your file was uploaded.

Determine the URL for your uploaded file. Open a browser and test the URL.
Select your uploaded file.

On the Overview tab, copy the URL.

Paste the URL into a new browser tab, If you have uploaded an image file it will display in the browser. Other file types should be downloaded.

Now let us configure Soft Delete; It’s important that the website documents can be restored if they’re deleted. Configure blob soft delete for 21 days.
Go to the Overview blade of the storage account.

On the Properties page, locate the Blob service section.

Select the Blob soft delete setting.

Ensure the Enable soft delete for blobs is checked.
Change the Keep deleted blobs for (in days setting is 21.
Notice you can also Enable soft delete for containers.

Don’t forget to Save your changes.

If something gets deleted, you need to practice using soft delete to restore the files
Navigate to your container where you uploaded a file.

Select the file you uploaded and then select Delete.

Select OK to confirm deleting the file.

On the container Overview page, toggle the slider Show deleted blobs. This toggle is to the right of the search box.

Select your deleted file, and use the ellipses on the far right, to Undelete the file.

Refresh the container and confirm the file has been restored.

Now let us configure blob versioning, this will help us keep track of the different website product document versions.
Go to the Overview blade of the storage account.

In the Properties section, locate the Blob service section.

Select the Versioning setting.

Ensure the Enable versioning for blobs checkbox is checked.
Notice your options to keep all versions or delete versions after.

Don’t forget to Save your changes.

As you have time experiment with restoring previous blob versions.
Upload another version of your container file. This overwrites your existing file.
Your previous file version is listed on Show deleted blobs page.

Now you have been able to create a storage account that has high availability on Microsoft Azure

Creating Storage For Less Important Data On Azure With Simple Configuration Settings

Raphael Olaniyi — Wed, 22 May 2024 03:17:36 +0000

Create a resource group and a storage account.

In the Azure portal, search for and select Resource Group then Select Create.

Give your resource group a name. For example, abioduntesting

Select a region.

Select Review and create to validate the resource group.

Select Create to deploy the resource group.

Your Resource group is ready

CREATE AND DEPLOY STORAGE ACCOUNT
In the Azure portal, search for and select Storage accounts.
Select + Create.

On the Basics tab, select your Resource group.

Provide a Storage account name. The storage account name must be unique in Azure.

Set the Performance to Standard.

Select Review, and then Create.

Wait for the storage account to deploy and then Go to resource.

Configure simple settings in the storage account.
The data in this storage account doesn’t require high availability or durability. A lowest cost storage solution is desired.

In your storage account, in the Data management section, select the Redundancy blade.

Select Locally-redundant storage (LRS) in the Redundancy drop-down.

Be sure to Save your changes.

Refresh the page and notice the content only exists in the primary location.

The storage account should only accept requests from secure connections.
In the Settings section, select the Configuration blade.

Ensure Secure transfer required is Enabled.

Developers would like the storage account to use at least TLS version 1.2.
In the Settings section, select the Configuration blade.
Ensure the Minimal TLS version is set to Version 1.2.

Until the storage is needed again, disable requests to the storage account.
In the Settings section, select the Configuration blade.
Ensure Allow storage account key access is Disabled.
Be sure to Save your changes

Ensure the storage account allows public access from all networks
In the Security + networking section, select the Networking blade.

Ensure Public network access is set to Enabled from all networks.

Be sure to Save your changes

Steps to Create a Virtual Machine in Azure Portal

Raphael Olaniyi — Tue, 21 May 2024 23:09:50 +0000

Create a free trial account in Azure ( a free trial account provides a subscription and $200 Azure credits which will be more than enough for the course ).
Login to Azure Account (portal.azure.com).To access the Azure portal, we must provide our login credentials which includes our username and password.
After login, In the "Search resources, services and docs" field, type “virtual machines”.

Alternatively, you can select Virtual machine by clicking on the hamburger icon and scrolling through till we get the virtual machine.

we can also get this by clicking on the create a resource button and typing virtual machine.

From the list of search results, click on the “Virtual machine” option.The best option would usually be grayed out.

Click the “Create” button to start the virtual machine creation process.There is the option of two create buttons, click on either but from the options choose Create a virtual machine hosted by Azure.

Enter Project details this would be our subscription and resource group.Select the appropriate subscription and create a resource group by clicking the create resource group button and giving it a name or you select from an existing resource group

Enter details about the virtual machine we’re creating. Provide information about our virtual machine, such as the name of the Virtual Machine, the operating system, size, and other configuration settings. Give the VM a name and choose either Ubuntu server 20.04 or Windows Server Datacenter -x64 G2, leave every other thing option as default.

Select the region you want your virtual machine to be located

Select the availability zone that you want.

Select more than one zone if you want the Virtual machine to be highly available.

Go to image and select any desired Operating system

Create an Administrator Account. We need to a username and a password in case we need to connect to the Virtual Machine

Select the inbound port rule as SSH if we selected a Linux VM and RDP if it's a windows VM. This is needed just incase we want to connect to the virtual machine as it will allow IP address to connect to the VM created.

Check the licensing. By default, this is unchecked, click the box to have it checked.

Click “Next” till we get to boot diagnostics in the Monitoring tab, and click on “disable”.

Click on “Review + Create” button, if the validation passes, the deployment will go on if not take not of any recommendation, fix and try again

Deployment of the Virtual Machine might take 3-5 minutes.

Once the virtual machine has been deployed, we can access it by clicking on the "Connect" button in the virtual machine blade in the Azure portal.

Click Native RDP and click on select and wait for configured sign to be displayed on the right hand side

Download the RDP file

Open the RDP file from local computer & click on “connect”. Enter the Admin details created during the process of creating the VM. Click on the “connect” button displayed to initiate connection.

Follow the prompt and on click continue.This would be the username and passwrd created for the Admin section.

Wait for the remote pc to be configured.

Connection is successful, start using the virtual machine.

How to create Azure Resource Group

Raphael Olaniyi — Tue, 21 May 2024 11:52:43 +0000

The first thing you need to do is to login to the portal after you login with your Microsoft credentials then you will land on the Azure home, then click on Create on the home page.

Then type resource group on the search

Then Click on Resource group icon

Then click Create

Then it will take you to the page where you will Create a resources group

Then you give the Resource group a name

Then you choose the region you want it to be located

Then click review and create, once it becomes green then it means validation passed

Then click on create

Your resource group is ready

Understanding Cloud Computing General Terms

Raphael Olaniyi — Thu, 09 May 2024 10:47:43 +0000

What is Virtualization?
Virtualization relies on software to simulate hardware functionality and create a virtual computer system. This enables IT organizations to run more than one virtual system – and multiple operating systems and applications – on a single server. The resulting benefits include economies of scale and greater efficiency. Virtualization technology makes cloud computing possible. Cloud providers set up and maintain their own data centers. They create different virtual environments that use the underlying hardware resources. You can then program your system to access these cloud resources by using APIs.
Scalability
Cloud scalability refers to the ability of a cloud-computing infrastructure to dynamically adjust resources to meet the changing demand. This means that as your business grows, your cloud environment can quickly adapt to provide additional resources, such as processing power, storage, or bandwidth, without the need for costly hardware upgrades or infrastructure changes.
Cloud scalability offers a number of key benefits, including improved flexibility, better cost control, increased performance, and enhanced reliability. It allows you to scale your IT resources up or down quickly in response to changing business needs, which can help you optimize your operations, minimize downtime, and improve the overall performance of your IT infrastructure.
Overall, cloud scalability is a crucial aspect of cloud computing and an essential tool for any organization looking to manage its IT resources effectively.
There are three main types of cloud scalability:
a. Horizontal scalability, also known as scale-out, refers to the ability to add more instances of the same resource to a cloud environment. For example, you can add more servers to your environment if you need more computing power.
b. Vertical scalability, also known as scale-up, refers to the ability to add more resources to an existing instance. For example, if you need more computing power, you can add CPU, RAM, or storage to an existing server.
c. Hybrid scalability. also known as diagonal scaling, combines both horizontal and vertical scalability to provide a flexible and scalable cloud environment. This type of scalability allows you to add more instances or resources as needed while also optimizing your existing resources to achieve maximum efficiency.
Agility
Agility is the ability to quickly develop, test, and launch applications in a cloud-based environment. Much like in the athletic theater, agility makes it easier to move nimbly in response to changing environments or challenges. It allows businesses to create, launch, and test their applications quickly in a cloud-based environment. When an organization is agile, it's able to respond rapidly and effectively to new business challenges or changing technological environments.
High Availability
is the ability of a system or application to remain accessible and operational for a long period of time. A key characteristic of cloud services ensures they can handle different load levels and recover quickly from any failures.
Fault Tolerant
Fault Tolerance refers to the ability of a system to continue functioning even when part of it fails. This is achieved by designing the system in such a way that the failure of a single component does not impact the overall performance of the system.
Global Reach
Cloud computing enables businesses to reach customers and clients globally. With data centres located in various regions, cloud providers offer low-latency access to applications and data from anywhere in the world. This global reach allows businesses to expand their markets and serve customers in different geographic locations effectively.
What is the difference between Elasticity and Scalability
When we talk about scalability, we’re talking about the ability of your cloud services to grow with you. You plan for it, ensuring that your tech can handle the extra load as your business or project grows, whether it’s data storage, processing power, or user traffic.
Elasticity, on the other hand, is all about flexibility. It’s the cloud’s way of saying, “I’ve got you,” adapting to your needs in real time. Elasticity allows your cloud services to expand instantly to handle the traffic spike and then shrink back down when things cool off, ensuring you’re not paying more than you need.