Deploy a VM from the Azure Marketplace

Azure Marketplace

When we create a new virtual machine within the Azure environment, we can use the Azure Marketplace. Services and software are available in the Azure Marketplace, which you can deploy within an environment. For virtual machines, Windows operating systems, Open source variants and also 3rd party appliances are available.

Create my first Windows virtual machine

From the Azure portal, we can view the Azure Marketplace.

The Azure Marketplace from the Azure portal

Search within the Azure Marketplace
For example, search for “Windows”

In this example, I’m going to create my first Windows virtual machine. What do I need to know/have?

  1. A valid Azure subscription (PayG, NCE/CSP, EA, etc…)
  2. What operating system do you need?
Deploy a VM from the Azure Marketplace

Overview of all the different image types of Windows Server in the Azure Marketplace.

Suppose we are going to build a new server based on Windows Server 2022, then we can easily select the right variant in the Azure Marketplace. But what are the differences? Small disk, Azure Edition Hotpatch, Core edition…how do I make the right choice?

A quantity of storage is linked per variant. By default, a virtual machine gets 127 GiB of OS disk. In a number of cases that is too much, for example when you choose the Core edition of Windows. A small(er) OS disk is sufficient. You then choose the option [smalldisk].

The different variants in the Azure Marketplace can also be seen with, for example, Powershell.

Login-AzAccount
Select-AzSubscription -Subscription “###############”

#———————————————
#Set Azure Location
$Location = “West Europe”
$PublisherName = “MicrosoftWindowsServer”

Get-AzVMImageOffer -Location $Location -PublisherName $PublisherName

Connect to the Azure subscription. Then specify the region in which you want to build the virtual machine, for example, Western Europe.

Now the OfferName and PublisherName values are important. All Marketplace images have an Offer, Publisher, SKU, and version. First we will make an overview of all Offers within the Publisher MicrosoftWindowsServer.

Overview of all Offers of publisher WindowsServer.

Here we choose the Offer WindowsServer and make an overview of all SKUs within this Offer.

#———————————————
#Set Azure Location
$Location = “West Europe”
$PublisherName = “MicrosoftWindowsServer”
$OfferName = “WindowsServer”

Get-AzVMImageSku -Location $Location -PublisherName $PublisherName -Offer $OfferName | Select Skus

Overview of all image SKUs of offer MicrosoftWindowsServer

Here we choose 2022-datacenter-azure-edition-hotpatch. As a final step, we can make an overview of all versions within this SKU.

can make an overview of all versions within this SKU.Deploy a VM from the Azure Marketplace
If you want to deploy the latest version available, then use the variable latest instead of the version number.

All image details at a glance.
Before we can rollout an image from the Azure Marketplace, the Terms must first be accepted.

Get-AzMarketplaceterms -Publisher $PublisherName -Product $OfferName -Name $skuName

The Terms have not yet been accepted for the image in question.

Set-AzMarketplaceTerms -Publisher $PublisherName -Product $OfferName -Name $skuName -Accept

The Terms have been accepted and the image can be rolled out.

The Terraform code for deploying the appropriate image in Azure.

Because we use the Azure Hotpatching image, the patch mode must be indicated in the code.

Since we’re going to use Azure Hot Patching, we need to add another line to the Terraform code (line 64).

The first virtual machine with associated resources was successfully deployed.

The various resources rolled out with Infrastructure as Code.

The new server is running in Azure.

OS disk of server mss-azhp-22-01.

Now let’s rollout the same virtual machine, but with a different image SKU. Namely 2022-datacenter-azure-edition-hotpatch-smalldisk. The virtual machine is named mss-azhp-22-02.

Changed the SKU image to smalldisk.

Overview of the Plan, Offer, and Publisher per server in Azure.

The difference in OS disk size can be clearly seen here.

  • 2022-datacenter-azure-edition-hotpatch – 127 GiB
  • 2022-datacenter-azure-edition-hotpatch-smalldisk – 30 GiB

The number of IOPS (Read/Write operations) is also different

  • 2022-datacenter-azure-edition-hotpatch – 500 IOPS
  • 2022-datacenter-azure-edition-hotpatch-smalldisk – 120 IOPS

The throughput on the OS disk is different

  • 2022-datacenter-azure-edition-hotpatch – 100 MBps
  • 2022-datacenter-azure-edition-hotpatch-smalldisk – 25 MBps

The cost on the OS disk is different

  • 2022-datacenter-azure-edition-hotpatch – P10 (128 GiB)
  • 2022-datacenter-azure-edition-hotpatch-smalldisk – P4 (32 GiB)
  • The burst IOPS and throughput are the same!

Wrap up

Deploying a virtual machine in Azure can be done in multiple ways. Ofcourse via the Azure portal, where you can select most of the configuration yourselves. The fastest and most flexible way is through Infrastructure as Code (in this example, Terraform), but it can also be Bicep, Azure Resource Manager, or Powershell. You then have more influence on naming convention of the Azure resources and you can quickly and consistently rollout your virtual machines.

The choice of image SKU is of great importance when designing the workload and associated virtual machines. Determine a number of crucial variables in advance, such as:

  • what OS am i going to use
  • which version
  • with graphical user interface (GUI) or not (Core edition)
  • required IOPS
  • required storage capacity
  • disk throughput
  • what are the monthly costs of the Azure resources

If all variables are clear, then rolling out the necessary virtual machines is the last step. Spending a bit of time in preparation is therefore very important. Thansk for supporting my blog and feel free to reach out to me on my socials!

Part 2 – Azure Privileged Identity Management (PIM) for Groups

In my previous post I explained what PIM for Groups is, what it takes to get started with PIM for Groups and how the configuration works. In this post, we are going to look at the different settings that are possible for activating PIM for Groups.

Sign in to the Azure portal and navigate to Azure Active Directory and select Groups. Find the right group, in this example the previously created group ‘PIM-for-Groups-example-group’. Select Privileged Access (Preview), then Settings.

Continue reading “Part 2 – Azure Privileged Identity Management (PIM) for Groups”

Part 1 – Azure Privileged Identity Management (PIM) for Groups

What is PIM for Groups?

PIM for Groups is part of the Azure Active Directory Privileged Identity Management. With PIM for Groups users can activate membership or ownership of an Azure AD security group or Microsoft 365 group. These groups can be used to assign access to for example Azure AD roles or Azure roles.

When using Azure PIM with PIM for Groups, you’re following the Microsoft best practices of ‘least privileged’ strategy.

Continue reading “Part 1 – Azure Privileged Identity Management (PIM) for Groups”

How to enable hidden Education Themes for Windows 11

Microsoft has released a new Education Theme for students. Using this theme, you can more personalize your desktop with some great wallpaper.
By default, this theme is hidden, but you can enable this option on your Windows 11 device. Important note: you need to have Windows 11 22H2!

1.) Open ‘regedit’
2.) Navigate to:
HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\device
3.) Create a new ‘Key’ with the value ‘Education’
4.) Create a new ‘DWORD (32-bit) Value’ with the value ‘EnableEduThemes’
5.) Set the value to ‘1’ (Hexadecimal)
6.) Restart your device
7.) After restarting your device, make sure you’re connected to the Internet

Continue reading “How to enable hidden Education Themes for Windows 11”

Install and configure ADDS on Windows Server 2022 Core in Azure (Part 2)

A question I often get is ‘why should I use Windows Server Core edition’? This is difficult to manage and I do not like a server without a graphical interface.

The first thing I always tell you is, you DON’T HAVE to do anything, but my advice is to do it. Especially for a number of crucial server roles.

Some advantages of Windows Server Core edition at a glance:

Continue reading “Install and configure ADDS on Windows Server 2022 Core in Azure (Part 2)”

Install and configure ADDS on Windows Server 2022 Core in Azure (Part 1)

Today, I’m going to show you how to install and configure Active Directory Domain Services on Windows Server 2022 Core edition on Azure.

I’ve used some ARM templates to deploy my two domain controllers in Azure, based on Windows Server 2022 Core edition. These servers are in a separate subnet within my Azure environment. In this example, Í’ve two domain controllers, mss-dc-core001 and mss-dc-core002.

Continue reading “Install and configure ADDS on Windows Server 2022 Core in Azure (Part 1)”

Enable Azure Hybrid Benefit with Azure Resource Manager (ARM)

In Azure, you have the option to bring in your own licenses (Azure Hybrid Benefit). If you deploy a virtual machine using Azure Resource Manager (ARM) templates, this option is not enabled by default. Certainly for test environments, demos, but in many cases also production environments, you want to enable this option.

By adding the line below to your ARM template, the Azure Hybrid Benefit is enabled.

2021-10-19_21h12_41

2021-10-19_21h04_48

Use Azure Bastion to access your virtual machine in Azure

As most of you know, it’s possible to provide a virtual machine in Azure with a public IP address. This IP address can then be used to build a connection to, for example, RDP or SSH.

This way of connecting takes place over the Internet, which entails a great security risk. In many environments we see jumpbox or stepping stone servers, which are placed in the DMZ. These servers can be accessed from the Internet, and from these servers a connection can be made to a server or multiple servers on the internal network.

Such an arrangement is not safe, unmanageable and vulnerable. Azure Bastion is a great addition to facilitate a secure connection to a virtual machine in Azure. Azure Bastion integrates into the Azure portal, requiring multi-factor authentication. The virtual machines do not need to have a public IP address, so they are not accessible directly from the Internet.

Azure Bastion is a fully managed, autoscaling and hardened PaaS service, to provide you secure RDP and SSH connectivity. It is easy to configure in just a few steps. By using virtual network peering, it’s possible to easily add Azure Bastion to an existing configuration in Azure.

image

  1. Configure a new virtual network for Azure Bastion
  2. Create a new subnet named ‘AzureBastionSubnet’ required for Azure Bastion
  3. Configure virtual network peering to your other networks
  4. Create an Azure Bastion host
  5. Login in the VM through the Azure portal using Azure Bastion
  6. See the list of active sessions in the Azure Bastion Host properties

2021-05-20_16h00_34    2021-05-20_16h00_532021-05-20_16h00_59    2021-05-20_16h01_102021-05-20_16h01_45    2021-05-20_16h11_542021-05-20_16h12_54    2021-05-20_16h15_14

Now you can securely connect through Azure Bastion to a virtual machine running RDP or SSH. As you can see, the virtual machine I’m connecting to has no public IP address, only a internal IP address.

image