Azure Managed vs Unmanaged disks : The choice

Hi folks,

Recently (few months) , a new feature was announced to bring a new capability to Azure Virtual Machines : Azure Managed Disks.

Many blog posts explain well the purpose of managed disks, and how they bring enhancements to Azure IaaS virtual machines. I recommend the following readings :

The latter post shows the advantages of using Azure Managed disks, which I agree and confirm. But on the meanwhile, there is some ‘inflexible’ properties of managed disks, that may not be suitable for your or for your expectations. This is the purpose of this post : What is the model that fits my requirements , Managed or unmanaged disks.

1- The main difference between Managed disks and Storage Accounts based disks

There are some main differences between managed and unmanaged disks :


Managed disks

Unmanaged disks


Is an ARM (Azure Resource Manager) object (resource) Is not an ARM resource, but a file (.vhd) residing on a Azure Storage Account. The latter is an ARM  object


The managed disks sizes are fixed (and can be resized). Which means that you cannot choose a custom size. You will need to pick up from a list. See (1) You can choose the disk size during the provisioning (and can be resized) when using Standard Storage. See (2)


You will pay :

·       Standard Storage :

o   A fixed price per disk size (Per month), whatever the disk usage is

o   Operations cost*

·       Premium Storage

o   A fixed price per disk size whatever the disk usage is

See (1)

You will pay :

·       Standard Storage :

o   The GB / month disk usage. You pay only what you consume

o   Operations cost*

·       Premium Storage

o   A fixed price per disk size whatever the disk usage is

See (3) and (4)


A managed disk have a predictable performance, with Standard storage (500 IOPS) or Premium storage (Depends on the disk). Only premium storage disks have a predictable performance (depends on the disk). Standard storage have a predictable performance (500 IOPS) unless they are impacted by the Storage Account performance limits (A maximum of 40 disks per standard storage account is recommended, otherwise disks can be throttled). See (5)


When placing VMs using managed disks under an Availability Set, disks are placed on different fault domains in order to achieve the better SLA (The Availability Set SLA is only for compute) When placing VMs using unmanaged disks under an Availability Set, there is no guarantee that the disks are placed on different fault domains, even if they are on different Storage Accounts.




ADE, SSE (Coming soon) ADE, SSE

* Operations cost means : Replication data transfer cost (In case of GRS) + Storage operations costs


2- Are managed disks more expensive that unmanaged disks ?

The answer is : It depends, but except in some cases, managed disks are always more expensive than unmanaged disks. Let’s prove it :

Standard Storage managed disk cost per month

  • Managed disk cost = Fixed Cost (Per disk size) + Operations cost
  • Unmanaged disk cost = Storage_Usage_In_GB * CostperGB + Operations cost

Because the Operations cost is the same for both models, we will omit them during calculation. Because the managed disk pricing model is not per usage, we will calculate the Disk size equity* value, to be able to compare with unmanaged disk :

Managed disk type

Size (GB) Price Cost per GB Standard Storage price per GB Disk size equity*


32 1.3 0.040625 0.0422 31
















S30 1024 34.56



* If you use less than the given size, then Unmanaged disks will cost less than managed disks. If you use more, then managed disks cost will be less than unmanaged disks. The €/GB will be greater as long you consume less storage space.

NB : New disk sizes have been announced (6) that finally make and end for the 1 TB disk size limit, with 2 and 4 TB for managed disks, and up to 4 TB for unmanaged disks. The service started on the West US Central region and will be generalized for the remaining regions during the coming months

3- Do I really need managed disks ?

This is a good question, but the answer is very relative to your needs. As you probably have read on the posts I mentioned earlier in this post, there are many benefits of using managed disks:

  • Disk snapshots
  • Predictable performance
  • Distribution in different fault domains when associated with Availability Sets
  • ARM object

Some workarounds may be used to have similar properties with unmanaged disks:


Unmanaged disk workaround

Disk snapshots


No workarounds

Predictable performance


Place less than 40 disks per Storage Account

Distribution in different fault domains when associated with Availability Sets


No Workaround. There is no way to know if the disks are place on different pools even if they are on different Storage Accounts

ARM object


Place each disk on its own Storage Account. Look if this will fit your needs  (Do not forget quotas)


4- Verdict

As you can see, managed disks brought new experience and features to Azure VM storage that permits better controlling the VM storage. Personally, I would recommend using managed disks, even if the ‘Pay as you consume’ model is not adopted there. But the features and the simplicity is worth the ‘little’ difference we can see with pricing.  Continue reading

Azure Backup with Azure Recovery Services : Features and limitations

Hi all,

It has been  days since Microsoft announced the Public Preview of Azure Backup via Azure Recovery Services. In this post I will enumerate the different features and limitations of the service, to help you decide if it fits your needs.

NB : This post is only related to IaaS part of Azure Backup

The following is the agenda of this post :

Introduction to Azure Backup via Recovery Services

Azure Backup for Azure IaaS features (Current and Coming)

Azure Backup for Azure IaaS  limitations

1- Introduction to Azure Backup via Recovery Services

Azure Backup was released first time under Azure Backup vaults, and it was only supporting classic Azure IaaS (Azure Service Management ie IaaS v1). With the GA of the Azure Resource Manager stack on summer 2015, IaaS V2 users were not able to use Azure Backup to protect their V2 virtual machines. This was the first blocker of the ARM stack adoption and one of the most wanted feature regarding the ARM platform.


After 10 months of struggle, Microsoft announced the Public Preview of Azure Backup supporting IaaS V2 virtual machines. It’s a real alleviation for Azure IaaS V2 users, but also for all Azure users planning to use Azure backup features. The main difference is that Azure Backup is now part of Azure Recovery Services vaults, and no longer Azure Backup vaults. Azure Backup vaults still exist under the ASM stack, but it’s clear that sooner or later, all will be integrated to Azure Recovery Services.

Azure Recovery Services include both Azure Backup and Azure Site Recovery supporting both ASM and ARM stacks. This is what we call great news:

  • Azure Recovery Services is integrated to the new portal (Ibiza portal)
  • Azure Backup and ASR under Recovery Services vaults support both ASM and ARM stacks

Azure Backup under Recovery Services vaults support the 4 backup scenarios:

  • Azure Backup Server or Agent based:
    • Azure Backup Agent to Azure –> Backup files and foders to Azure Storage
    • Azure Backup with System Center Data Protection Manager –> Backup Hyper-V VMs, SQL server, SharePoint, files and folders to Azure Storage
    • Azure Backup with Azure Backup Server (MABS, code name Venus) –> Backup Hyper-V VMs, SQL server, SharePoint, files and folders to Azure Storage
  • Azure Backup on the Azure Service Fabric :
    • Azure Backup for IaaS VMs –> Backup Classic and ARM Azure Virtual Machines


This post will only detail Azure Backup for IaaS virtual machines

2- Azure Backup for Azure IaaS features (Current and Coming)

Azure Recovery Services is currently under Public Preview. The following are the features of Azure Backup and the expected features that will come with GA:

  • Backup and Restore ARM and ASM Azure virtual machines (V1 and V2)
  • Based on backup policies : Two backup schedules exist : Daily and Weekly. This way you can define backups which occur daily or weekly
  • Azure Backup provides different retention periods possibility : Daily, Weekly, Monthly and yearly. Microsoft officially stated a maximum retention period of 99 years, however, thanks to Azure Backup flexibility, you can have unlimited retention period, up to 9999 years. This way, you can achieve long term retention using the same policy and mechanism (9999 days for daily backups, 9999 weeks for weekly backups,9999 months for monthly retentions ,9999 years for yearly retention)
  • Azure Backup provides 3 recovery point consistency types : Application, File and Crash consistent recovery points. You can consult the documentation to get the requirements and prerequisites for each type
  • The Backup Vault’s Storage redundancy can be GRS or LRS. GRS is more secure (Data is replicated between two regions) but more expensive (LRS *2), LRS is less secure (Locally Redundant) but cheaper. As per my experience, because the Azure Backup pricing is per protected instance (And the price is relatively high), you will notice that the Storage cost is a small fraction of the Azure Backup instances cost, so using GRS will not really impact the bill.
  • Azure Backup use incremental backups : The first recovery point is a full backup, the next ones are incremental backups : This reduce the consumed backup storage. Due to the Azure Backup design and mechanism, incremental backups will not impact the restore time.
  • Simple pricing model : The cost of Azure Backup is like the following : Total Cost = Instance Cost + Consumed Storage. If you know the daily change or growth of your data, than you can easily predict the backup cost. See this link for Azure Backup pricing :
  • A backup operation consist of two phases : Snapshot phase and Data transfer phase. The snapshot phase occur when the scheduled moment comes. The data transfer he backup vault begins just after the snapshot completion. This operation lay take up to 8 hours during rush hours but will always completes before 24 hours.
  • Azure Backup provides 99,99 availability SLA for Backup and Restore, monthly based. This is only applicable for the GA product.
  • Currently, two restore options are available
    • To a Virtual Machine : A new Virtual Machine is created
    • To a Storage Account : VHDs can be restored to a Storage Account
  • I expect some features to come with and post GA, but this my own thoughts, since this is what actually implemented with DPM and MABS :
    • Backup/Restore of Files and folders from a VM recovery point
    • Backup/Restore SQL or/and MySQL databases directly from a VM

3- Azure Backup for Azure IaaS limitations

  • Azure Backup does not currently support Premium Storage virtual machines. This feature will released probably during the GA
  • Currently, the daily backup supports 1 recovery point per day ie you cannot backup a Virtual Machine more than once time a day. To achieve this, use the ‘manual backup’ to schedule more than one backup a day. Keep in mind that two simultaneous backups are not supported, so you will need to wait for the first once to compete before triggering the next one.
  • The Azure VM agent and the Backup extension are required to achieve Application or File consistent recovery points. Otherwise, the recovery point will be crash consistent. Be careful of the Azure VM and Backup agents network requirements 
  • The ‘Backup now’ operation does not replace a ‘Snapshot’ mechanism if you want to rapidly restore a VM (The recovery point may take up to 8 hours to be available)
  • Currently, the Restore to a VM is not very customizable : You cannot choose a number of properties like Storage Container, VHDs names, NIC names … To have control of the created VM, you can restore the VHDs to a storage account and use a script or template to create a VM with the configuration of your choice.
  • There is no notification system built-in with Azure backup. So you can’t at this stage configure notifications for the backup jobs statuses. However, there possible alternate methods to do it : When Powershell will be supported, you can create automation scripts which get the Backup jobs statuses and make the notifications. You can also use the Azure Audit logs since the Backup operations are logged within them
  • No Powershell support, but will be released with GA
  • You cannot edit en exiting policy. If you want to change a policy, you will need to create a new one and change the VM’s assignment. Things will change by GA, so no worry
  • You cannot change the vault Redundancy type once you configured at least one backup. You need to change the redundancy  before any data is being transferred to the vault
  • There some limitations about the backup / restore possibilities, I will rephrase here the documentation
    • Backing up virtual machines with more than 16 data disks is not supported.Backing up virtual machines with a reserved IP address and no defined endpoint is not supported.
    • Backing up virtual machines by using the Azure Backup service is supported only for select operating system versions:
      • Linux: See the list of distributions that are endorsed by Azure. Other Bring-Your-Own-Linux distributions also should work as long as the VM agent is available on the virtual machine.
      • Windows Server: Versions older than Windows Server 2008 R2 are not supported.
    • Restoring a domain controller (DC) VM that is part of a multi-DC configuration is not supported.
    • For classic VMs, restore is supported to only new cloud services.
    • Restoring virtual machines that have the following special network configurations is supported through restoring disks to a desired storage account and using PowerShell to attach restored disks to VM configuration of choice. To learn more, see Restoring VMs with special network configurations.
      • Virtual machines under load balancer configuration (internal and external)
      • Virtual machines with multiple reserved IP addresses
      • Virtual machines with multiple network adapters

Azure Backup for Iaas V2 released on Public Preview

Update 2 : MS just confirmed me (but not published) that Azure Site Recovery is supported via the new portal, via Recovery Services

Update : MS released the official documents, I was just announcing here Smile

Great news for Azure IaaS V2 users (ARM). Yesterday, Microsoft announced the release of the Public Preview of Azure Backup for IaaS V2 via ‘Recovery Services Vaults’

This is a quick step be step to rapidly configure your VMs backup

NB : Azure Backup via Recovery Services Vaults will let you backup V1 and V2 VMs (Classic and ARM). It’s recommended that you will use it just to get your hands on and not for Production, since it’s not covered by any SLA or commitment (Preview). MS has not published guides to migrate existing Backup vaults to Recovery Services Vaults, but I think this is planned.

Let’s start:

Login to the Azure Portal ( Go to Browse –> Recovery Services vaults


Click the Add + button


Type a Name for the RS vault, choose a Subscription, a Resource Group and a Region. You need to know that the Recovery Services vault in tied to a Region. you cannot Backup/Restore resources to/from a different region.


After the vault creation. you can discover the different options available. Just for Information : Recovery Services Vaults include Azure Backup services (VMs, Files, SCDPM) and ASR (Azure Site Recovery). ASR is currently on Private Preview and is not yet released. File and SCDP support we come soon too.

To configure a Backup, click on Backup +


Select the Backup type. As mentioned, only Azure Virtual Machine Backup is supported by now


You will now choose the Backup Policy. You can select an existing policy or create a new one.


The policy have the following options:

Name : Type a Name for your policy (Class1, Class2, Class3). Just a recommendation, Do not make naming like ‘Daily’ or ‘weekly’ since the retention may differ for two ‘daily’ based policies

Backup Frequency : There are only two options and a start hour. You can make Daily Backups or Weekly backups

Retention : This is great about Azure Backup since on the same policy you can configure your retention and  long term retention (Daily, Weekly, Monthly and Yearly!!)


Once the Policy is selected, you can choose which Virtual Machines to backup with this Policy. Note that Classic VMs and ARM VMs can be backed up with the same policy.


You can verify that the VMs selected are under the Backup Items blade, in addition to some other information like the Last Backup status, the Policy…


On the Backup Jobs Blade, you can find all the Backup Jobs of all VMs. You can change the period using the Filter Button


This just a teaser, more is coming, try it, you can ask me question on the comments, but as a reminder:

  • Do not use on Production, wait for the GA (Maybe 2 months)
  • ASR is not supported yet
  • A lot of enhancements are coming (User Experience mainly), stay tuned

Move Azure (ARM) VM between Storage Accounts and beyond

Hi all,

One of the hardest operations which I’m actually encountering when working with Azure virtual machines is to move a Virtual Machine from a location to another.

Moving a VM from a location includes :

  • Change the VM’s Storage Account
  • Change the VM’s Storage Container
  • Change from  subscription
  • Change the VM location/Region
  • Change the Virtual Network

You may also want to :

  • Change the VM name
  • Change the VM’s availability set
  • Pass from single NIC VM to multiple NIC VM

or any combination of them.

Today, I’m publishing the first version of the ‘Move-ArmVM’ powershell script which is intended to provide a simple way to move/recreate an Azure Resource Manager VM (Or VMs), covering different move scenarios. The script will  create a copy of the Source VM. The Source VM will only be stopped, no change will affect it.

Move-ArmVM v1.0


  • Move a VM to a different Storage Account
  • Move a VM to a different Storage Container
  • Move a VM to a different Virtual Network
  • Move a VM to another location
  • Move a VM to a different Subscription
  • Change the VM Name during the move
  • Change the VM’s resource Group during the move
  • Change the VM’s availability Set  during the move
  • Pass from single NIC VM to multiple NICs VM ( Annex 1- How to configure the parameter file to have  multiple VNICs on the target VM)

* This script supports moving one or more VMs (Annex  2- How to configure the parameter file to move multiple VMs)

Release Notes

This version does not support moving/creating the next items. You should create them manually after the move:

  • VNIC’s Public IP
  • Tags
  • Load Balancer Configurations
  • Anything not mentioned on the Features section

Download Link

Version 1.0 Preview :

How To use it ?

I highly recommend you to download this JSON editor. It’s free, simple and will help you visualize and edit  JSON files : JSONedit

1- Fill the parameter file

This script uses a Parameters file, you should first fill the required parameters. The parameter file name is hardcoded, do not change its naming and location (the same location than the script). A ‘Logs’ folder will be created on the working directory. The log files will be created under this folder.







The source Subscription Name SamirSub


The source VM Name (The name of the VM to be moved) ADFS01


The source VM Resource Group ADFSRG


The destination Subscription Name
  • BuildSub


  • Set this value to 0 if you don’t want to place the VM in a availability Set
  • Type the name of the target availability set. If the AS does not exist, it will be created
  • 0
  • AdfsAS


  • Set this value to 1 if you want to use the same source VM Name
  • Type another Name if you want that the moved VM have another name
  • 1
  • ADFSVM01


  • Type a name of the resource group when to place the target VM. If the Resource Group does not exist, it will be created under the same region where the VM will be created


  • Set this value to 1 if you want to use the same source VmSize
  • Type a new VM Size (Standard_A1, Standard_A2, Standard_D1…)
  • 1
  • Standard_D1


  • Type the name of the target Storage Account. This Storage Account must already exist
  • vhdsa


  • Type the name of the target storage container, if the container does not exist, it will be created
  • vhd


  • Type 0 if you don’t want to attach an NSG to this NIC
  • Type the name of destination Network Security Group to attach to this VNIC
  • 0
  • ADFSnsg


  • Type the NSG’s resource Group. If the NSG is set to 0, this parameter will be ignored


  • Type the Virtual Network name for this VNIC


  • Type the Virtual Network Resource Group


  • Type the Subnet name for this VNIC


  • Type the IP address if this VNIC

* The value of this parameter is not monitored, if the value is wrong (Inexistent Vnet, erroned IP…), the script will fail. The error can be checked  on the log file

** You can choose to have multiple VNICs on the target VM. Check the Annex for the how to. The VM size must support the VNICs count

2- Run the script

After the configuration of the parameter file, run the script file. You will be prompted for your Azure credentials. The Parameter file name and location are hardcoded and can’t be changed. The parameter file have to be located on the location than the script file

1- How to configure the parameter file to have  multiple VNICs on the target VM

  • Open the parameter file on a text editor
  • Copy the Section between the two brackets, on the VNICs section


  • Paste it just after the closing bracket of the first VNIC (paste it too many times than the VNICs count). On the example, I will paste it two times because  I want to have 3 VNICs on the target VM


  • Add a comma (,) after all the VNICs closing brackets except the last one


2- How to configure the parameter file to move multiple VMs

  • Open the parameter file on a text editor
  • Copy the Section between the two brackets, on the Virtual Machines section


  • Paste it just after the closing bracket of the previous Virtual Machine (paste it too many times than the VMs count). On the example, I will paste it only one time because  I want to move 2 VMs. Add a comma (,) after all the VMs closing brackets except the last one


Add or change an ARM Virtual Machine’s Availability Set

Hi all,

One of the limitations we may encounter when dealing with Azure ARM Virtual Machines is the ability to manipulate the VM’s availability Set configuration after the VM deployment. In fact :

  • You can’t change the VM’s Availability Set once the VM is created
  • You can’t add an Azure VM to an Availability Set once the VM is created
  • You can’t remove a VM from an Availability Set

This is a big limitation since we may need such feature, in different cases:

  • We need to add an existing VM to a highly available pool
  • We want to change the Availability Set name
  • We messed up with the Availability Set  naming

I think this feature will come in the future, but the far or the near future, I have no idea. Maybe by the end of the year (Q4 !)

Till that time, I wrote this Powershell script, which will enable you to manage an ARM VM’s availability Set


  • Add a VM to an Availability Set
  • Change a VM’s Availability Set
  • Remove a VM from an Availability Set

How it works ?

The script will:

  1. Get the VM configuration
  2. Save it to a local location (If something goes wrong, we can recreate the VM)
  3. Remove the VM (Only the configuration, all related objects are kept)
  4. Create a new  VM configuration with the AS config (Add AS, Remove AS, Change AS)
  5. Recreate the VM

How to use it ?

1- Download the script and save it to local location

2- Run it and provide the requested parameters


2- ./Set-ArmVmAvailabilitySet.ps1 –VmName ‘The VM Name’ –ResourceGroup ‘Resource Group’ –AvailabilitySetName ‘As Name’ –SubscriptionName  ‘The Subscription name’


To remove a VM from an AvailabilitySet:

./Set-ArmVmAvailabilitySet.ps1 –VmName ‘The VM Name’ –ResourceGroup ‘Resource Group’ –AvailabilitySetName 0 –SubscriptionName  ‘The Subscription name’



Download Link

Version 1.01 :

Version 1.0 : (Retired)

How to create a Multiple NIC Azure Virtual Machine (ARM)

Hi all,

A lot of people asked me to write a short post of how to create an Azure Virtual Machine with multiple NICs. After some googling an binging, I was not able to find a blog or an article which explains how to achieve it in a simple manner. And here we are !

I- Considerations and requirements

To be able to create a multiple NIC ARM virtual machine, the next requirements should be respected :

  • Not all the virtual machines sizes support multiple NICs. Check if your VM size is supported (
  • The Virtual NICs must be connected to Subnets within the same VNET. You cannot deploy a VM on multiple VNETs
  • You can use Azure CLI, Azure API or Powershell to make this operation. The portal does not provide a way to deploy multiple NIC VM
  • In this post I’m using Azure Powershell 1.0. If you are using the 0.9.8 or prior, remove the ‘Rm’ suffix from your commands and change the mode to ResourceManager. It highly recommended to update to Azure Powershell 1.0 or later
  • To add a NIC to a existing VM, use this post instead

II- Create a Multiple NIC Virtual Machine

Use the  ‘sample’ Powershell script  to create a multic NIC VM. This script will deploy a Windows Server 2012 R2 Virtual Machine from the gallery. Adjust it to deploy other Operating Systems or to add extra configurations like Availability Set, Static IP, Public IP…

The most important step are :

  • The creation of the VNIC resource before the VM creation. 

$VNIC01 = New-AzureRmNetworkInterface -Name $NIC01Name -ResourceGroupName $RGName -Location $Region -SubnetId $SUBNET01.Id
$VNIC02 = New-AzureRmNetworkInterface -Name $NIC02Name -ResourceGroupName $RGName -Location $Region -SubnetId $SUBNET02.Id

  • Adding the VNICs to the VM configuration object. You must set one VNIC as Primary

$VM = Add-AzureRmVMNetworkInterface -VM $VM -Id $VNIC01.Id -Primary
$VM = Add-AzureRmVMNetworkInterface -VM $VM -Id $VNIC02.Id

Download LINK :

How to access an ARM Azure virtual machine from Internet

Hi readers,

Lack of documentation ! This is my starting point for this post. I’m a regular answerer of the Microsoft TechNet forum, and I noticed a repeatable question, or an issue related to the same subject : How to access an Azure Resource Manager virtual machine (RDP, SSH, publish a port…). To avoid repeating the same answer each time I decided to write a post instead. This way, I can just do the  easy Copy/paste (Ctrl c/ Ctrl v)

So what is the goal of this post:

  1. Understand the ways you can access a virtual machine in Microsoft Azure (Azure Service Management vs Azure resource Manager)
  2. Show you how to implement it for Azure Resource Manager virtual machines
  3. Show you how to assign static Public IP addresses to Azure VMs

Before continuing : In this post, I will only talk about accessing an Azure virtual machine from the public network, internet. Accessing a VM from a private network (S2S VPN, P2S VPN, ExpressRoute…) is out of the scope of this reading as it’s considered as an internal access, just like you access a server from your corporate network (The VM is directly exposed to you unless you have a firewall or an NSG)

Suppose you created an virtual machine on Azure. Now you want to access it and you wonder how it’s happening.

I- Azure Service Management (Classic)

With the classic deployment model (which is accessible from both the classic portal and the new portal), when you create a virtual machine, you are forced to deploy it within a cloud service. A cloud service is a container of your VM or VMs like depicted on Picture 1 (You can deploy multiple VMs within the same cloud service).


Picture 1 : VMs and Cloud Services


There are two ways to access a virtual machine in this case (Picture 2) :

  1. We can access a VM by assigning a Public IP address to the Virtual Machine. This IP called PIP belongs to the Virtual Machine  itself
  2. We can access a VM by accessing it through a public IP address assigned to the Cloud Service.This IP called VIP belongs to the Cloud Service and can be used to access all the VMs within the Cloud Service


Picture 2 : VMs, Cloud Services, VIP and PIP

What is the difference between accessing a VM using a PIP or the VIP ?

Using the PIP

It’s clear, the PIP belongs to the Virtual Machine itself, so when you try to access a VM using this IP, your packets will land directly on the VM (Picture 3, Left). The only obstacle between you and the VM is :

  • The VM’s firewall : you have to allow the inbound traffic for the ports you want to access the VM from (Example : 3389 for RDP or 21 for SSH or an application port)
  • A Network Security Group applied to the VM or to the subnet : You have to allow the inbound traffic for the ports wherever you are using NSG
  • ACL : If you are using ACLs, you have to allow the access to the VM also

–> If you are using nothing of the things above, then you can access the VM on any opened port. Look to this link to know how to assign a Public IP address (PIP also called ILPIP) to an Azure VM

Using the VIP

As explained above, the VIP belongs to the Cloud Service, so if you want to access a VM using the VIP, you have to tell Azure about your need. You have to tell Azure for example that if it receives a packet on the VIPx on port Y, it have to redirect it to a VM  (which belongs the cloud service) on port Z. It’s simply NAT. This is achieved using VM Endpoints (Picture 3, right). Like the link explains, you have to configure a VM endpoint each time you want to access a VM on a specific port using it’s VIP. The VM endpoint is simply a NAT rule that Azure adds to the cloud service’s configuration. It’s important to keep in mind that VM endpoints are configured at the VM level but they are related to the cloud service’s Virtual IP (VIP). As you can notice, you cannot access two VMs belonging to the same Cloud Service using the same external port.

PS : Do not forget that the Internal port used when configuring an Endpoint must be allowed (if any) at the VM’s firewall level, NSG or ACL.


Access VIP PIP

Picture 3 : VMs, Cloud Services, VIP and PIP

II- Azure Resource Manager

With Azure Resource Manager, things changed. And the big change concerning us is : No more Cloud Services. So the question is how to access a VM in this case!

There are two ways to access a virtual machine in the ARM case (Picture 4 ) :

  1. We can access a VM by assigning a Public IP address to the Virtual Machine. This IP called PIP belongs to the Virtual Machine  itself*. It’s the same thing than the Classic mode
  2. We can access a VM by using  NAT rules added to a Load Balancer.  This is new in comparison with the classic mode which require an explanation.

* The VM’s network configuration in Azure Resource Manager differs from the classic mode.  The network configuration for a classic VM is hold by the VM itself, which means for our case that the Public IP is hold by the VM. In ARM, things changed. For each VM’s object, a virtual NIC is created and then attached to the VM. This VNIC will hold the Network configuration like the VNET/Subnet, the internal IP and the Public IP address. A VM with multiple addresses (like A3 VMs) will have multiple VNICs attached.


Picture 4 : Access an ARM VM (PIP or Azure LB)

II.1- Using the Public IP address

You can assign a Public IP address to the VM’s VNIC. You can choose to create a new Public IP address or use an existing one.

Via the Azure Portal

Go to the Azure Portal –> Virtual Machines –> Your VM –> All Settings –> Network Interfaces –> VNIC –> All Settings –> IP Addresses –> Public Ip Address Settings. Click on Enable and choose to create or use an existing IP address


Via the Azure Powershell

The following Azure Powershell commands will allow you to create a Public IP Address and assign it the first VM’s VNIC

Function Create-PublicIP ($IPName, $RG, $Region, $AllocMethod, $DomainLabel)


        $publicIP = New-AzureRmPublicIpAddress -Name $IPName -ResourceGroupName $RG -Location $Region –AllocationMethod $AllocMethod -DomainNameLabel $DomainLabel.ToLower()

        return $publicIP


$ELBPublicIPName = Read-host ‘Public IP Address Name’
    $AllocMethod = Read-host ‘Allocation Method (Static/Dynamic)’
    $DomainLabel = Read-host ‘Domain Label’
    $RG = Read-host ‘Resource Group’
    $Region = Read-host ‘Region/Location’
    $VMName = Read-host ‘VM Name’

     # 1- Create the Public IP for the Load balancer

    $ELBPublicIP = Create-PublicIP -IPName $ELBPublicIPName -RG $RG -Region $Region -AllocMethod $AllocMethod -DomainLabel $DomainLabel

    #2- Assign the IP to the VM first IP
    $VM = Get-AzureRmVM | where {$_.Name -eq $VMname }
    $VNIC = Get-AzureRmNetworkInterface | where {$_.Id -eq $VM.NetworkInterfaceIDs[0] }
    $EIPPublicIP = Get-AzureRmPublicIpAddress | where {$_.Name -eq $EIPName}

    $VNIC.IpConfigurations[0].PublicIPAddress = $ELBPublicIP
    Set-AzureRmNetworkInterface -NetworkInterface $VNIC

II.2- Using the Azure Load Balancer

Why it’s so complicated, and why do we need to create a Load Balancer and then create NAT rules :/

To be honest, it’s not complicated and Microsoft did not change anything, they just change  names, and give you more customization. We have to thank them for this. Let me explain the steps to access a VM using this method:

  1. Create the Azure Load Balancer
  2. Create a Backend pool and associate it with the Load Balancer
  3. Create a NAT rule
  4. Associate a NAT rule to a VM’s NIC (VNIC)

II.2.1- Create the Azure Load Balancer

Microsoft provides at no extra cost the ability to deploy Load Balancers which provide load balancing features. More about the Azure Load Balancer here. Keep in mind that he goal of deploying a Load Balancer in our case is to create NAT rules and not load balancing rules. In addition, in our case, we want to create an Internet Facing Load Balancer because we aim to access internal resources from the public internet. This link is the official Microsoft link of how to create an Internet facing Load Balancer.

The following are the steps to create an Internet Facing Load Balancer:

  1. Create a Public IP address resource (If not already created) : In this step, you will create a Public IP address Resource. You can choose between a Static IP (Reserved) or a Dynamic IP, which is subject to change over time. This Public IP will be used to access the Load Balancer, and it’s used on the next step
  2. Create the Front End IP : The Front End IP is the frontal IP for the load balancer. It’s a configuration to which we will associate the Public IP address
  3. Create the Load Balancer resource

The following is a Powershell code to create an Internet Facing LB


$IPName : The Name for the Public IP resource

$RG : The resource Group name where the resources will be created

$Region : Thee location where to deploy the resource (north europe…)

$AllocMethod : The IP allocation method, there are two possible values : Dynamic or Static

$DomainLabel : The DNS prefix for the Public IP. The public IP address will have a  DNS record associated to it of the form : $

$FEName : The name of the Front End configuration

$ELBName : The name of the Load Balancer resource

# 1- Create the Public IP for the Load balancer

   $PublicIP = New-AzureRmPublicIpAddress -Name $IPName -ResourceGroupName $RG -Location $Region –AllocationMethod $AllocMethod -DomainNameLabel $DomainLabel.ToLower()

   # 2- Create the front End IP for the Load balancer using the created Public IP

   $FEConfig =  New-AzureRmLoadBalancerFrontendIpConfig -Name $FEName -PublicIpAddress $PublicIP

   # 3- Create LB
   $ELB = New-AzureRmLoadBalancer -ResourceGroupName $RG -Name $ELBName -Location $Region -FrontendIpConfiguration $FEConfig


II.2.2- Create the BackEnd Address pool

The Backend Address pool will contain the target objects (IPs) targeted by the Load Balancer. If you want to redirect (via NAT) a packet using the Load Balancer to a VM , The VM’s NIC should be part of Backend pool

The following is a Powershell code to create a Backend Address Pool


$BEPoolName : The name of the Backend Address Pool

1# Create the Backend Address Pool

New-AzureRmLoadBalancerBackendAddressPoolConfig -Name $BEPoolName

2# Add the Backend Address pool to the created Load Balancer

Add-AzureRmLoadBalancerBackendAddressPoolConfig -LoadBalancer $ELB -Name $BEPoolName |  Set-AzureRmLoadBalancer


II.2.3- Create a NAT rule

A NAT rule is a very simple and logic rule :

  • Frontal Port or External port : This is the port on which the Load Balancer will listen to incoming requests. It’s the port you will send packets to, when you are connecting from the external.
  • Frontal IP : This is the IP (Public IP) on which the Load Balancer will listen. In fact, this is mandatory since a Load Balancer can have multiple Front End IPs. This is the FrontEnd configuration of the Load Balancer
  • Protcol : tcp or udp
  • Backend Port : This is the Private port on which the service is really listening, and to which the Load Balancer will redirect the traffic

The following is a Powershell code to create a NAT rule and associate it to the Load Balancer


$NATName : The name of the NAT rule

$Prot : tcp or udp

$FEport : The frontal port o the public port

$BEPort : The Backend port or the Private port

# Create and add a NAT rule to the Load Balancer

$ELB | Add-AzureRmLoadBalancerInboundNatRuleConfig -Name $NATName -FrontendIpConfiguration $FEconfig -FrontendPort $FEport  -BackendPort $BEPort -Protocol $Prot

$ELB | Set-AzureRmLoadBalancer

II.2.4- Associate a VNIC with a NAT rule

This is the final step. You can notice that during all the previous step, the Backend IP was not set. The Backend IP is the IP of the VM. With Azure Resource Manager, it actually means the VNIC.

The following is a Powershell code to get a VNIC resource, add it to the Backend address pool and add it as a target of the NAT rule

$VNIC = Get-AzureRmNetworkInterface –id ‘VNIC id’

$VNIC.IpConfigurations[0].LoadBalancerBackendAddressPools = $BEPool

$VNIC.IpConfigurations[0].LoadBalancerInboundNatRules = $NATRule

$SetVNIC = Set-AzureRmNetworkInterface -NetworkInterface $VNIC


As a BONUS, I uploaded here a ‘preview’ script containing all the previous commands. This script is interactive, and will let you create an End to End NAT rule using an Azure Load Balancer or assign a Public IP address to a VM’s NIC

Download it and just run it –>

NB : Please, read the release note of the script

Azure Active Directory integration with Salesforce Sandbox

The main goal of this blog is to show how to integrate Salesforce Sandbox environment with Azure Active Directory, using the Windows Azure AD single Sign-On configuration option.

Before continuing, you should meet the following requirements:

  • A valid Azure Active Directory Subscription
  • A Sandbox environment on Salesforce .com with a System Admin user on this environment.

NB: In this blog, i used the ‘.uisandbox’ as a suffix. You should replace it by the suffix attributed to your sandbox platform

1- Why do not use the same integration procedure with Salesforce (non-Sandbox) ?

A question one may ask is why not use the same Azure Active Directory integration procedure with a (non-Sandbox) Salesforce environment (Described here in a Microsoft Article). The reason is simple : When you get a Salesforce Sandbox environment, your Salesforce production user accounts are cloned to  the Salesforce Sandbox environment (Automatically on the refresh process), but a ‘.uisandbox’ suffix is added to the UserName for each user. This is intentional since a user will know that he is using a Sandbox environment and to avoid confusion just by looking to his username. The email address is also modified to a strange format : Example : –> I personally recommend modifying the email address of a user to match its real email address, but it’s not a must. So, the integration procedure for a production SalesForce environment is not valid for the Sandbox one (The users identifiers changed) . A tuning must be brought in order to achieve the integration. This is the blog’s purpose.


There is an Official Microsoft article about configuring salesforce ‘sandbox’ environment with Azure AD, but, it seems that the content is not accurate and you will not be able to successfully configure the integration.

2- How this will work ?

It’s simple. Thanks to the Azure Active Directory new SAML attributes option (Currently In preview) , we will tell Azure Active Directory to add, every time that an authentication is requested, the suffix ‘.uisandbox’ to the UserName claim. Great !

3- Steps for Integrating Salesforce Sandbox environment with Azure Active Directory

3.1- Configure the Salesforce ‘Sandbox’ application on Azure AD

Where : Azure Management portal

A- Deploy the Salesforce sandbox application

First, connect to the Azure Management portal with an Active Directory tenant administrator account. Go to Active Directory –> Domain Name –> Applications and Click on the Add button

Snap 2015-09-07 at 11.37.03

Choose Add an application form the gallery

Snap 2015-09-07 at 11.37.44

On the Search bar, type salesforce. Choose the Salesforce Sandbox. Type a Display Name for this application (Example : MySalesforceSandbox) and click Okay

Snap 2015-09-07 at 11.39.41

Wait for the application to be successful added. Now we can begin configuring our SSO with Azure AD

B- Configure Single Sign-ON

In this phase, we will configure Azure AD to ‘accept’ authentication requests from Salesforce. In other words, we will configure Azure AD as an identity Provider for Salesforce ‘sandbox’.

Click on Configure Single sign-ON

Snap 2015-09-07 at 11.42.29

Select ‘Microsoft Azure AD single sign-On’

Snap 2015-09-07 at 17.04.57

Type the Sign ON URL. The sign-on URL is the Salesforce ‘custom’ Sandbox domain URL. Go to step ‘3.2.A- Create and switch to a custom domain’ if you are not aware of this information. The URL must begin with https:// and ends with

Snap 2015-09-07 at 17.14.08

This step is very important, since it contains ‘required information’ for setting up the SAML settings in Salesforce. Keep the following information:

  • Download the Certificate in a local location. You can name it ‘AzureADSalesforcesandboxsso.cert’
  • Save the following URL to a text file for example (Of course you can retrieve them later)
    • Issuer URL
    • Remote Login URL
    • Remote Logout URL

Snap 2015-09-07 at 17.16.11

Click Next

Type an Email address to receive information about SSO events with this application.

Snap 2015-09-07 at 17.16.47

This phase is completed, now we will pass to the next step, a very crucial configuration.

C- Change the SAML attributes claims to match the Salesforce ‘Sandbox’ users settings

Go to Attributes (Even if this feature is currently on preview, it works as expected)

Snap 2015-09-07 at 17.24.23

The goal is tell Azure AD that the Name it will receive during the SAML handshake, is not the UserName is AzureAD, but it’s a concatenation of the UserName is AzureAD and the ‘.uisandbox’ expression.

For this, we will edit the ‘’ attribute like the following.

Click on the Edit symbol for the ‘’ attribute

Snap 2015-09-07 at 17.28.43

Change it like the following:

Attribute Value : Join()

STRING1 : User.userPrincipalName

String2 : uisandbox

Separator : .

Snap 2015-09-07 at 17.29.51

Click OK then Click Apply Changes

NB: In my example, I used the Name as a claim attribute, you can use the email address if you want. But, you have to also to change it in the SAML settings configuration on salesforce on Step ‘3.2.B- Create a new SAML SSO settings’

3.2- Configure the Salesforce ‘Sandbox’ SSO on Salesforce

Where : Salesforce Sandbox portal

Go to and login with a ‘sandbox’ user account (This user must have System Admin rights on this environment). NB: As discussed, The sandbox user account by default ends with .uisandbox

Snap 2015-09-07 at 11.46.11

A- Create and switch to a custom domain

First step to do is to switch to the sandbox domain if it’s already created, or create a new domain for your environment (For users not familiar with Salesforce domains, a Salesforce domain is just a domain name to be used when connecting to your Salesforce environment, this will make you use a domain name like ‘’ instead of ‘’).

Go to Setup –> Domain Management –> Domains

Snap 2015-09-07 at 12.01.02

If you did not already  created a domain, create a new one.

Now, go to Setup –> Domain Management –> My Domain and login to your domain by clicking on Click here to login

Snap 2015-09-07 at 12.52.42

Once connected, you will be switched to the custom domain

Snap 2015-09-07 at 12.52.58

B- Create a new SAML SSO settings

Now, it’s the main part, where we will configure the settings that will allow the SSO to Azure AD and the matching between the user in Azure AD and in the Salesforce ‘sandbox’.

Go to Setup –> Security Controls –> Single Sign-On Settings and click New

Snap 2015-09-07 at 12.54.12

You will have to provide the following information:

Snap 2015-09-08 at 16.58.03




Name A name for your SSO configuration (Will be shown for users so choose a descriptive  Name) AzureADSSOSandbox
API Name Used by SalesForce, keep it the same as the Name AzureADSSOSandbox
Identity Provider Certificate The Certificate that you bring from the Azure AD SSO configuration (AzureADSSOSalesforce.cert) AzureADSSOSalesforce.cert
Entity Id Used by Salesforce, need to set it to
Issuer Paste here the Issuer URL got from Azure ADD SSO configuration wizard
Request Signing Certificate Which Certificate to use to sign the request Default Certificate
Request Signature Method The method for the Request signing certificate RSA-SHA1
Assertion Decryption Certificate If your assertion is encrypted, choose a certificate to decrypt it with. Otherwise, choose Assertion not encrypted Assertion not encrypted
SAML Identity Type Which identity type will be used Assertion contains User’s username
SAML Identity Location Where the identity is located Identity is in an Attribute element
Attribute Name Which attribute will be used. In our configuration, the name will contain the name that will match the user name in Salesforce ‘sandbox’. In fact, we have to set this attribute in Azure AD to add the ‘.uisandbox’ suffix to the user name
Name ID Format leave it blank
Service Provider Initiated Request Binding HTTP POST
Identity Provider Login URL Paste here the Identity Provider Login URL copied from the Azure AD SSO config wizard
Identity Provider Logout URL Paste here the Identity Provider Logout URL copied from the Azure AD SSO config wizard
Custom Error URL Leave it blank
User Provisioning Enabled Check this box if you want to enable the User Provisioning feature on Azure AD

C- Enable the SSO settings for the ‘salesforce’ domain

This is the last step in this configuration walkthrough. We have now to enable the configured SSO authentication for the ‘salesforce’ sandbox domain.

Go to Go to Setup –> Domain Management –> Domains

Select your ‘sandbox’ domain and click Edit

Snap 2015-09-04 at 12.18.06

Affect the SSO configuration which was created during the previous steps to this domain then click Save


  • You can affect more than one SSO configuration to your domain
  • If you uncheck the ‘Login page’, users will not be able to use local ‘salesforce’ users to login to the domain

3.3- Test the configuration

Now, we can test our configuration.

First, you must assign users or groups to be be authorized to use this application (to use the Azure AD Authentication).

In Azure AD, go to the Application –> Users and Groups. Choose the ‘All Users’ or ‘Groups’ filter and assign the desired users.

Snap 2015-09-07 at 18.08.43

Now connect to the ‘Salesforce’ sandbox URL (sign-on URL ie your Salesforce ‘sandbox’ domain name ). And choose your ‘AzureAD SSO’ that you already configured.

Snap 2015-09-07 at 18.10.52

You have successfully logged using SSO to Salesforce ‘sandbox’ environment.

Azure Virtual Machines introduction

This post aims to introduce Microsoft Azure IaaS (Virtual Machines service) to folks who were not involved from the beginning with Azure and who would like to rapidly understand how it works, and if it can convince them start or even think use it. In this post, I will not detail the IaaS features in Microsoft Azure, since we have hundreds of them, and there is books and long articles describing in details the Azure fundamentals.

This post is divided like below:

  1. Introduction : I will rapidly introduce the Azure Virtual Machines service (IaaS)
  2. Components : This is the principal part of this post, I will detail the components and bricks of the Azure Virtual Machines services. It will help you understand how the Azure IaaS can be used and what to consider before deciding to go with the Azure Virtual Machines service.
  3. Networking : I will explain the networking concept in Azure
  4. Storage : I will explain the storage concept in Azure
  5. Pricing : I will explain how the Azure pricing works
  6. Design considerations : I will put some design considerations and must-remember points
  7. Further Reading : I will post some interesting resources and readings to go deep and dive into Azure.


Azure Virtual Machines is one of the central features of Azure’s IaaS capabilities. Azure Virtual Machines supports the deployment of Windows Server or Linux virtual machines (VMs) in a Microsoft Azure datacenter. You have total control over the configuration of the VM. You are responsible for all server software installation, configuration, and maintenance, as well as operating system patches. All the resources are running within the Microsoft Datacenters, the only link to them will be networking. Think of it like you have your own datacenter in another location or region from you on-premise. You create all your workloads there and you access them remotely. The only difference here is :

– The Datacenter belongs to Microsoft

– All the underlying management, updates, maintenance are  Microsoft’s responsibility (Hardware, Networking, Cooling, Power…)

– The physical security are Microsoft responsibility

The result is : Microsoft offers you a feature ( A service) that enables you to create virtual machines and use them freely, just like they were yours, and they are yours.

I would loved to continue introducing the Azure Virtual machines feature, because it’s amazing and very interesting. I will dedicate a full post just for discussing the ‘what and why ‘about Public Cloud Platforms (Iaas Offer) and is it reasonable to go forward toward this new concept.



The compute component is the heart of Azure VM. Compute mean  the virtual machine resources : CPU, Memory and Operating System

When you create a virtual machine in Azure, you will choose first the VM configuration : Hardware and Software (Example : I want to deploy a Windows Server 2012 R2 Datacenter VM with 4 GB of RAM and 2 CPU). Look that I’m not mentioning the storage configuration (OS disk size, number and size of data disks). This is intentionally and will be explained further.

Azure does not give you the possibility of freely choosing the hardware configuration. In fact, Azure exposes predefined templates to choose from. These templates are classified into Virtual Machine series and sizes. The complete Virtual Machine sizes list can be found here and it’s regularly updated by Microsoft in case of a change. LINK1 : Azure Virtual Machine Series and Sizes

The Virtual Machines in Azure can be classified by :


The tier is a categorization of the virtual machine type. There are two Tier types in Azure : Basic tier and Standard tier. Basic tier VMs are generally used for test/dev and less important VMs. Basic Tier VMs are spreadly used for production environment. The difference resides in the following things:

– Basic Tier VMs do not support Azure load balancing capabilities (you cannot load balance traffic between two basic VMs using the Azure load balancing feature)

– Basic Tier VMs do not support the Azure ‘Autoscale’ feature. ‘Autoscale’ allows Azure to automatically scale the number of virtual machines to meet resource requirements (CPU usage for example) and then scale down by shutting down VMs when scale conditions are no longer crossed

– Not all the hardware configurations are given with the Azure Basic tier VMs. Advanced hardware configurations (more and faster CPU, more and faster memory, more disks, faster temporary disks,  more performance…) are just provided with Standard tier VMs

– Basic VMs data disks IOPS is capped a 300 IOPS per disk, less than the 500 IOPS for the standard tier ( storage will explained in details  later in this article)


The series is classification to help the customer rapidly find and choose between tens of virtual machines types. It’s like the classification that we find in car vendors : Mercedes Class A, B, C, E and S or BMW  Series 1, 3, 5 and 7 Smile. Till today, there are 4 Azure Virtual Machines Series : The A-Series, D-Series, DS-Series and G-Series:

  • A-series: A-Series presents ‘normal’ and ‘classic’ virtual machine class. They are intended to the majority of workloads. Only the A-Series provide the Basic tier classification
  • D-Series: D-Series presents enhanced VM’s underlying hardware. VMs are provisioned on  top of better physical servers using faster processors, faster disk cache and more storage support. They provide also the capability of using offloading network technologies to communicate over a low latency, high throughput network in Azure.    LINK2 : D-Series Virtual Machines Sizes
  • DS-series: DS-series is the only Azure VM series that let you benefit form the Azure Premium Storage (Storage in Azure will be discussed later). It mainly intended for workloads that need high performance and low latency  storage.
  • G-series: This is the last announced Azure Series, it provides powerful VM’s hardware configurations (High specifications). Underlying hardware  uses better CPU and memory brands. It is mainly intended for giant workloads (can provide hundreds of GB of RAM). LINK 3 : G-Series Virtual Machines Sizes


The Size of a virtual machine means its hardware configuration. In Azure, the hardware configuration counts 4 elements :

CPU : The virtual processor count

Memory : The amount of RAM allocate do the virtual machine

Temporary or Local storage : The size of a temporary storage allocated to the virtual machine. It’s an attached disk that can be used for storing temporary (volatile) data during the virtual machine running time. The content is lost in any case the virtual machine is stopped (Planned or unplanned)

Number of supported data disks : Each virtual machine size has a maximum data disk count. For example, you can attach a maximum of 4 data disks (Data VHDs) to a Standard A2 VM while you can attach 16 to a A4 VM. This is very important since the maximum size of a data disk is 1 TB (1023 MB), for example you cannot have have a 5 TB volume using an A2 VM (4 disks of 1 TB with stripping will give you a maximum of 4 TB volume)

Operating system

Microsoft provides a wide range of operating system images. Both Windows and Linux are supported. In addition, pre-configured images can be found like Windows + SQL or Linux + Apache. Images can be found on the Azure VM ‘Library’ or on the VM depot. Moreover, Azure allows you to bring your VMs and run them in Azure. You can upload VHDs to Azure and then use and deploy them (Of course, the VM OS need to be supported by Azure). There is no maintained link that list the supported operating systems in Azure. However, till the writing time of this article, here the actual supported OS :

Cloud Service

When you create a virtual machine in Azure, this virtual machine is provisioned as part of a cloud service. Several virtual machines can be part of the same cloud service, this will let you create load balanced services between virtual machines. You will not be able to use Azure ILB (Internal Load Balancing) if your VMs are not within the same cloud service and the same virtual network

Important notice : With the introduction of Azure Resource Manager that goes GA on  June 30 (ARM GA Announcement) for a set of Azure features, Cloud Services are no longer needed if you use the ARM stack for your VM deployments.

Load Balancing

Azure provides load balancing features for its virtual machines services. You can  use the load balancing features to distribute traffic between VMs whether these VMs are internet facing or not. The load balancing features can load balance level 4 traffic and support only tcp and udp traffic. As discussed earlier, the load balancing is only supported on VMs part of the same cloud service. The following link gives a good description of the Azure Load Balancing feature LINK 5 : Azure load balancing

Important notice : With the introduction of Azure Resource Manager that goes GA on  June 30 (ARM GA Announcement) for a set of Azure features, Cloud Services are no longer needed if you use the ARM stack for your VM deployments.

Affinity groups

Affinity groups are a way to point to a fixed set of physical servers located near each other in the same region. In the past, affinity groups were a requirement for creating virtual networks (VNets). At the time, the network manager service that managed VNets could only work within a set of physical servers or scale unit. Recent architectural improvements have increased the scope of network management to a region. As a result of these architectural improvements, affinity groups are no longer recommended or required for virtual networks. The use of affinity groups for VNets is being replaced by regions. Virtual networks that are associated with regions are called regional VNets. Affinity groups are deprecated, this is why I will not explain their usability.

Availability Set

There are two types of Azure platform events that can affect the availability of the virtual machines: planned maintenance and unplanned maintenance. Planned maintenance does not generally affect the availability of the Azure virtual machines, but my sometimes require you to reboot your VMs. Unplanned maintenance may not be referred to maintenance but to unplanned service disruption caused generally by the underlying hardware failure. To guarantee the Azure SLA (actually 99.95 % service time), it’s highly recommended to always create highly available workloads that can be achieved by redundant services. Clustering, Built-in clustering and Load balancing are sort of high availability paths. However, it’s important to guarantee, that at a given time, a set of highly available VMs (clustered, Load balanced…) are not under the same fault domain (A fault domain is a set of resources that share the same Single-point-of-failure), this is why the Availability Set configuration was provided. Two or more VMs under the same ‘availability set’ will be placed on different fault domains. In case of planned or unplanned maintenance, at least one VM is guaranteed to be kept up and running. VMs must be under the same cloud service to be able to join an availability set configuration. More information can be found here LINK 6 : Azure virtual machines high availability

To resume

When you plan to create a virtual machine in Azure, you need to know the target virtual machine specification and then choose between the different Tier/Series/Size. Keep in mind the following points:

  • You can at anytime change the virtual machine type. You can scale up or scale down (from a hardware configuration perspective) the configuration at any time. But you need to respect the target VM’s type requirements. For example, you cannot change from a DS-Series to another series if you are using Premium Storage or you cannot pass from an A4 VM with 16 disks to an A3 VM, because A3 supports a maximum of 8 data disks. You can rarely encounter issues with the VM configuration changes, you can refer to this post for more information LINK 5 : Azure VMs sizes considerations
  • Only few Azure VMs support more than one network adapter : [ 4 NICs : A4, A7, A9, D4, D13, G4] [2 NICS : A3, A6, A8, D3, D12, G3]
  • VM pricing depends on the three classification: Tier, Series and Size. The more the configuration and options are better, the more the VM is expensive (Pricing will be discussed later in this post)
  • Notice that the storage usage and network throughput is not part of the VMs classification, and hence on pricing. Storage and network usage are billed separately
  • For all your ‘normal’ virtual machines that do not require load balancing and special performance, use the Basic tier VMs : It’s more affordable



Virtual Networks

Virtual networks (VNets) are used in Azure to provide a layer of security and isolation to your services. VMs and services that are part of the same virtual network can access each other. By default, services outside the virtual network cannot connect to services within the virtual network. You can, however, configure the network to allow access to external services:

  • A virtual network is a closed logical network boundary ( It’s like a network in a physical network architecture)
  • 2 virtual networks cannot natively communicates even if they are within the same region. A Vnet to Vnet connection must be configured to let they communicate (Using VPN)
  • All traffic within the same virtual network is by default permitted. However, Azure provides a security layer that let you configure ACLs between virtual machines or  subnets (will be discussed later)
  • VLANs are not supported nor understood by virtual networks, in fact Azure virtual networks are layer 3 networks for the tenant perspective.
  • Only tcp, udp and icmp protocols are supported within Azure virtual networks
  • Virtual networks support cross premises connection : You will be able to connect you on-premises network to an Azure virtual network for example
  • Virtual Networks are regional scoped, and hence, your virtual network can span all the datacenters within the same region (In the past, Virtual Network are datacenter scoped, and you can be in the situation when you want to provision a virtual machine on the same region but you can’t connect it to a virtual network, even if it created on the same region)

You can read the TechNet FAQ for more information: LINK 6 : Azure Virtual Networks FAQ


When creating a virtual network the following information should be provided :

– Location [Mandatory] : In which region the virtual network will be created

– DNS Servers [Optional] : Azure will be responsible for assigning the IP addresses for your VMs (Of course it will pick up IP addresses from a pool that you provide). You can hence provide the DNS servers that will be configured for this virtual network and that the VMs within it will use. DNS servers are configured per virtual network.

– Address Space [Mandatory] : Each created virtual network must be configured with at least one virtual network address space. The virtual network address spaces contain the IP addresses fields that this virtual network  provides. You cannot assign a virtual machine, an IP address that is not included in the virtual network address spaces ranges (Imagine like you are defining a network on your switch where you assign it a network address)

– Subnet [Mandatory] : The Address Space range cannot be used directly by Azure. At least one subnet must be defined per Address Space. You can choose to divide the address space into several subnets or use a single subnet per address space (a subnet range that will fit the entire virtual space).

NB: Azure Virtual Networks support both Public and Private IP addresses ranges (CIDR notation), this will permit you to bypass the RFC-1918 limitation. However, cross-premises virtual networks (that will be connected to on-premise or to another virtual network using VPN or Express route) must respect the RFC1918 IP ranges. In other words, only the Cloud-Only virtual networks can use non RFC-1918 IP addresses

When creating a virtual machine, you can choose to connect it to a virtual network, and choose which subnet will be used to pick up an IP address from. Azure will configure this IP address for your VM, and it will appear as a static IP address on your guest OS (Not a DHCP_reservation-like). On the same time this IP address is not static, that means it can be cases where the IP address will change. Discussing the cases and how to fix  permanently and IP address will be discussed later in the Design considerations

Cross-Premise connection

Azure provides different ways for interconnecting the Azure virtual network to the local on-premise network. The following are the actual options provided by Microsoft:

  • Site-to-Site VPN : S2S VPNs can be established between an Azure Virtual Network and an On-premise network (called Local Network). The S2S VPN is established between two parties, between an Azure Gateway and on-premise VPN device. Establishing a site to site VPN will allow your on-premise resources to communicate with your Azure resources. Actually, Microsoft provides 3 Azure gateways that offer different features and different prices. On-premises VPN devices should  respect the minimum gateway requirements presented here. Microsoft also maintain a lit of known compatible devices
  • Point-to-Site VPN : Azure supports establishing VPNs from a client perspective. A Point to Site VPN will allow individual clients to connect from anywhere to the Azure resources. actually, only Windows clients can establish a point to site VPN to Azure
  • ExpressRoute: Azure ExpressRoute enables you to create private connections between Azure datacenters and infrastructure that’s on  premises. ExpressRoute do not use public internet to transmit  data. Unlike VPNs, ExpressRoute uses a private circuit. ExpressRoute offers many benefits specially  speed and SLA. For additional information, you can read more here LINK7 : Azure ExpessRoute

Security in Azure Networking

Azure provides different options to secure the inter and intra communication within the Azure virtual networks. However, there are many considerations to better chose which option to use :

  • When a virtual machine is created and connected to a virtual network, it is able to communicate with all the virtual machines within the same virtual network.
  • When a virtual machine is created and connected to a virtual network, external inbound connections (external to the virtual network) are not allowed except for two services (configured by default) : Remote Desktop Connection and Remote PowerShell. Allowing/Denying inbound traffic is conducted via two options :
    • Endpoint : An endpoint is a mapping relation between  two ports, a Public port and a Private Port. The Public port is the port on which the virtual machine will listen for traffic from external networks, the Private port is the port on which the service is really listening on the virtual machine. The Public/Private couple is a port redirection rule. Of course Public and Private ports can be the same.
    • ACL : When an Endpoint is configured for a virtual machine (Example :  Public Port A, Private Port A), an access rule is automatically added to the access rule list for that virtual machine allowing external communication on that Public port. To limit access from different external sources, access rules can be added to limit the inbound connection form defined sources.  Access rules can be explicit allow or explicit deny rules (Example : Allow only inbound connections on Public Port A from the external subnet and Deny inbound connections on Public Port A from the external subnet  ).

The following link shows how to set up endpoints for Azure virtual machines  LINK8 : Azure VM’s Endpoints. More information about Azure Virtual Machine’s security can also found here

There is another option that was added and that leverage more flexibility that the Endpoints and ACL concepts. In fact, as discussed, Endpoints are only applicable for external inbound traffic. The second feature allow you to create rules within the virtual network. It’s called Network Security Groups (NSG).

NSG is a powerful feature that allows you to :

  • Define security rules for a single virtual machine
  • Define security rules for a virtual network subnet

To resume, you can create ACLs using a 5   pattern (Source IP, Source port, Destination IP, Destination port, protocol) and apply them to a single virtual machine or to an entire subnet. This is similar to rules that you define for an inter-VLAN communications. This permits the creation of different security zones within the same virtual network (like a DMZ zone). NSG is supported with the local networks (On-Premise networks). The following link describes better the Azure Network Security Groups feature. LINK 9 : Azure Network Security Groups


By default, any virtual machine that is connected to a virtual network can access Internet. If you do not specify DNS server names on your virtual network configuration, default Azure DNS servers will be configured to permit name resolution. If your virtual network uses custom DNS servers, those DNS servers should resolve internet names if internet access is desired. If you want to restrict internet connection on your virtual network, you can use Network Security Groups to set per VM or per subnet denying rules.


Storage is the third key component  in the Azure IaaS infrastructure. Storage includes any sort of service where we can store data (Tenant data). There are many storage services in Azure (Look here for the complete documentation)  but for an Iaas perspective only one or two services are involved : Blob storage and File storage.

Blob Storage

To avoid reinventing the wheel, I picked up the following introduction from this link. Azure Blob storage is a service for storing large amounts of unstructured data, such as text or binary data, that can be accessed from anywhere in the world via HTTP or HTTPS. You can use Blob storage to expose data publicly to the world, or to store application data privately.

Common uses of Blob storage include:

  • Serving images or documents directly to a browser
  • Storing files for distributed access
  • Streaming video and audio
  • Performing secure backup and disaster recovery
  • Storing data for analysis by an on-premises or Azure-hosted service

There are tow types o Blob storage:

  • Block blob storage : For streaming and storing documents, videos, pictures, backups, and other unstructured text or binary data.
  • Page blob storage : Optimized for random read and write operations, page blobs are ideal for VHD images. This blob type is used for the virtual machine storage and will be discussed on this section

Page Blob storage is commonly used to store Azure virtual machine files including operating system disks and data disks. There are two types of storage provided for virtual machines today : The Standard Storage and the Premium Storage. The difference between the two types is performance.

  • To be able to use the storage, a storage account need to be created. The storage account is just an account that permits you access the Azure storage. Each storage type (Standard or Premium) needs a different storage account. So to be able to use both storage types, two storage accounts should be owned. You can have more than one storage account per subscription and the maximum is 100.
  • Like any Azure resource, the storage account is region limited. You can’t provision a VM in a region and its storage resource in another region
  • Azure storage offers different redundancy options categorized into 4 variants : LRS, ZRS, GRS and RA-GRS. The following Link provides description for each variant. The minimum redundancy in Azure is LRS which creates 3 copies of the data on the same facility.
  • Standard Storage : Storage performance is limited in term of IOPS an throughput. The reference IO UNIT size is 8 KB. The maximum IOPS per disk (VHD) is 300 for a basic tier and 500 for a standard tier, the maximum throughput is 60 MB/s. Of course higher IOPS and throughput can be achieved using disk aggregation (stripping). This link explains more the IOPS and throughput for Azure storage. LINK10 : Azure Storage IOPS and throughput
  • Premium Storage : Storage performance is the main key of this storage type that let you achieve 64.000 IOPS an more than 512 MB/s  per virtual machine. More detailed information can be found on the following link LINK 11 : Azure Premium Storage overview
  • Blob storage can be accessed via the Azure PowerShell or Azure Storage APIs for common management tasks.

File Storage

File storage is a new Azure storage service (In preview till the writing time of this post). File storage offers shared storage for applications using the standard SMB 2.1 protocol. Microsoft Azure virtual machines and cloud services can share file data across application components via mounted shares, and on-premises applications can access file data in a share via the File storage API. Applications running in Azure virtual machines or cloud services can mount a File storage share to access file data, just as a desktop application would mount a typical SMB share. Any number of Azure virtual machines or roles can mount and access the File storage share simultaneously. Since a File storage share is a standard SMB 2.1 file share, applications running in Azure can access data in the share via file I/O APIs. Developers can therefore leverage their existing code and skills to migrate existing applications. IT Pros can use PowerShell cmdlets to create, mount, and manage File storage shares as part of the administration of Azure applications. This guide will show examples of both.

Common uses of File storage include:

  • Migrating on-premises applications that rely on file shares to run on Azure virtual machines or cloud services, without expensive rewrites
  • Storing shared application settings, for example in configuration files
  • Storing diagnostic data such as logs, metrics, and crash dumps in a shared location
  • Storing tools and utilities needed for developing or administering Azure virtual machines or cloud services

More information can be found here LINK 12 : Azure File storage overview


This section describes the pricing basics for the Azure IaaS components. Pricing is a very important when designing the Azure platform, since in the Azure model, the components granularity can let you create different similar designs with different costs. You should be aware of every components that you will include in your design, to perfectly estimate the total platform cost.

Compute Pricing

  • Each virtual machine type has a cost. The cost is for compute resources (Not storage and Network) and depends on the 3-Tuple : (Tier, Series, Size). Check the following link for the most recent Virtual Machine pricing LINK 13 : Azure Virtual Machines price list
  • The consumption is calculated in a per-minute usage. So if you use you VM for 1 hour, you will be charged for 60 minutes, if you use it for 30 seconds, you will be charged for 1 minute
  • Prices are different from a region to another. In general, the most expensive is in the Australia and Brazil regions
  • A virtual machine is always billed unless it’s deleted or Deallocated (stopped and deallocated)
  • Storage and network resources are billed separately.  The temporary storage shipped with the virtual machine is however free.
  • There are taxes applied to the virtual machine usage. These taxes are not included in the Azure virtual machine prices, and are added separately to the bill. I have no idea how these taxes are calculated. I will be glad if someone leave me a comment with this precious, hidden information
  • For the Azure virtual machine pricing details, follow this link. LINK 13 : Azure virtual machine pricing

Storage Pricing

  • Virtual machine storage (except the temporary disk) is  billed in a per GB/Month basis. For example, if you use 100 GB in the first 15 days, and 0 GB in the second 15 days, you will be billed for the usage of 50 GB per month. Every day, Azure will pick up a value of the consumed storage for that day. By the end of the month, these value will be used to calculate the monthly usage value ( DAY1 + DAY2 + … + DAY30)/30
  • Storage cost depends on the location (Region) and the redundancy type. The more the storage is redundant, the more it’s expensive ( LRS > ZRS > GRS < RA-GRS)
  • The storage cost decrease with storage consumption. The more you use storage, the cheaper the GB/month pricing unit will be
  • Only really consumed storage is billed. For example, if you create a 200 GB vhd, with only 50 GB content, only 50 GB will be billed by the end of the month.
  • Storage transactions are billed. Every write/read operation is charged. The actual price is a fixed amount per 100.000 transactions. The question is why ? The answer is : Imagine a person copying 50 GB of data to a location, and leaving it till the end of the month, and another person, copying 50 GB of data to a location, but everyday, it replaces them by 50 GB of new data. At the end of the month, the two persons used 50 GB of data, but it’s clearly that the second one was continuously soliciting the storage subsystem, and hence, amortizing the system. It’s obvious to charge it a way more than the first one.
  • Premium storage billing is different from the standard storage billing, you should be aware of the difference :

For the Azure storage pricing details, follow this link. LINK 15 : Azure storage pricing

Network Pricing

  • Network traffic and data transfer inside the same Azure region is free (Intra-VNET, Inter-VNET in the same region)
  • Microsoft will charge outbound data transfers(Egress data), that means that data leaving the Azure datacenters will be charged. Inbound data (Data uploaded to Azure) is free. The first outbound 5 GB of data is free.
  • Like the other pricing models, prices decrease with usage increase.
  • Prices are different from one zone to another. Prices in Zone1 are lower than Zone 2, which prices are lower than Zone 3. Of course, things can change on the future, and it will change.
  • In addition to the data transfer charge, there are charges applied to the IP addresses that may be assigned to virtual machines and related services (Per hour basis)
      • PIP : PIP addresses are not free, and are charged per hour basis (however, one PIP costs around 3 Euros per month, per VM)
      • VIP : VIP is free. But if you want to have multiple VIP for the same cloud service (up to 5 VIP), you can have them at a nominal charge, at the same cost then PIP.
      • Reserved IP: If you want to reserve the VIP address (set it to static), the first 5 will be free and additional reserved VIP will be charged. Even unused reserved IP addresses will be charged too (For example you reserve an IP and you don’t use it for a service)
      • Address remap : Address remap is free if you remap up to 100 address per month. If you cross this limit, a fee will be applied per additional remap (remap mean that you assign an IP already assigned to a cloud service to another cloud service)
  • When you establish a cross-premise connection using VPN or a Vnet-to-Vnet connection, an Azure gateway is used. There are many Azure gateway types that offer different performances and scalability values and with different costs. The following link shows the Azure gateway types. Pricing can be found in this link
  • Express Route : Azure ExpressRoute enables you to create private connections between Azure datacenters and infrastructure that’s on your premises or in a colocation environment. ExpressRoute connections do not go over the public Internet, and offer more reliability, faster speeds, lower latencies and higher security than typical connections over the Internet. Express route has many advantages:
    • Detected circuit between Azure and on-premise
    • Private circuit that do not go through internet
    • SLA (Availability and performances)
  • There is a hidden information that is not exposed to Azure users, but will add a little dollars to you bill. It’s the tax cost. In fact, a tax applyes when using Azure (or in genral any service). The tax cost is not included in the features or services pricing and added later to the bill. Unfortunately, Microsoft do not provide information about how much this tax is really is. (Look for this TechNet thread)

Express route pricing can be found here

For the Azure network pricing details (Data transfers), follow this link. LINK 16 : Azure data transfers pricing

For the Azure network pricing  details (IP addresses), follow this link. LINK 17 : Azure IP addresses pricing

Design Consideration ad recommendations

This section will describe some design considerations and recommendations when planning to use Azure IaaS and specially Virtual Machines.

Design Consideration:


  • There are 3 virtual machine states: Running, Stopped (Allocated) and Stopped (Unallocated)
      • Running: This is when the virtual machine is up and running : All the virtual machine resources are billed —-> Compute, Network and Storage
      • Stopped (Allocated) : This is when the virtual machine is stopped using the operating system (The machine is stopped from inside the operating system) —-> All the virtual machine resources are billed : Compute, Network and Storage
      • Stopped (Unallocated) : This when the virtual machine is stopped using the Azure portal shutdown button or Azure PowerShell/API —-> Only the storage used by the VM is billed
  • Always start with the minimal virtual machine size that fit your needs. You can upgrade the virtual machine configuration, later needed
  • High availability (fault domain and upgrade e domain to achieve SLA)


  • By default, a dynamic IP address is picked from  the virtual network’s IP pool is assigned to any provisioned virtual machine. This IP address is dynamic, that means it ‘may’ change in some conditions (Look HERE). Its’ recommended to set the IP address to static via the following option:
      • Set the IP address to static during the virtual machine provisioning : Only with PowerShell on the Azure management portal or via the portal in the Azure Preview portal
      • Set the IP address to static after the virtual machine creation : Only with PowerShell on the Azure management portal or via the portal in the Azure Preview portal (You can use the following script to fix an IP address for a single virtual machine or this one for a group of virtual machines)
  • If you  plan to use cross-premises connection with Azure, the address space and subnets of your virtual network must be within the RC1918 IP addresses ranges
  • Network security groups is the best option for creating security zones in your virtual networks. Security groups allow you to create ACL rules inter and intra-subnet. NSG and Endpoints are not supported together, you should use either one or the other.
  • You should carefully prepare your virtual network design, in fact, changing the network design of an existing Azure platform is not straight forward and require downtime.
  • You cannot change the IP address of a Virtual Machine without downtime (VM reboot)
  • You can move a VM within the same virtual network between subnets (Require reboot). But you cannot change the virtual network without rebuilding the virtual machine (You should delete the virtual machine and rebuild it using its VHDs)
  • For cross-premises connection using VPN, if you plan (And I think it always will be) to connect more than one site or P2S clients, you must use dynamic routing, that means your on-premise VPN devises must support dynamic routing.
  • Azure virtual machines do not support acting as Layer 3 (IP) gateways or routers. You cannot for example use a 2-NIC virtual machine as a software router. Read here more about Multi-NIC Azure VMs
  • There are different IP addresses types in Azure, you should be aware of them
      • Internal IP address : Also known as DIP, This is the private internal IP address of the virtual machine, this is the local IP address assigned to a virtual machine from the VNet’s address space pool. This IP address cannot be reached from the external network. This IP address is by default dynamic unless you set it to static (See below)
      • Internal virtual IP address  : Also know as LIB. When we say virtual, we say load balancer. The internal virtual IP address is an IP address assigned by the Azure Internal load balancer to be used by internal services to access load balanced workloads. Look to the Load Balance feature described earlier in this post. Internal virtual IP address  is not reachable from external network
      • External virtual IP address : Also know as VIP. This is the IP address of load balanced services that can be accessed from the external network, and can only target the same cloud service. This VIP is dynamic but since it’s public, it’s highly recommended to set it to static. Microsoft allows you to reserve up to 5 VIP by subscription, we call them reserved VIP.
      • Instance level IP : Also know as PIP. This is a public IP that can be directly be assigned to a virtual machine. This will permit you to directly access a virtual machine from the external network without the need of configuring endpoints. Microsoft allows you to reserve up to 5 PIP by subscription


  • To obtain the desired IOPS/Throughput on the data disks, you can use disks stripping. Today, Microsoft recommends using Storage Spaces inside an Azure virtual machine for disk aggregation.
  • Using and managing Premium storage is only possible via the Azure preview portal. If you want to deploy DS-Series, you should use the Azure preview portal
  • As discussed below (Storage section), to obtain the desired IOPS/Throughput with the Premium storage, you should select the adequate VM_Size/P_Disk couple, otherwise you will not achieve the desired performance. Do not forget that each virtual machine size (DS-Series) has a maximum IOPS/Throughput limit. In addition, each P-disk type has also a maximum IOPS/Throughput


Managing Azure and specially Azure virtual machines is today possible via the Azure management portals:

  • Azure Management portal ( : This is the classic portal, where you can make almost all the management tasks. There are many actions and features that you can’t do/use via this portal. You will have to use the second portal
  • Azure portal ( : This is the new metro-style portal. Even if it’s actually in preview, you can make all the management tasks using it.

–> I personally use and recommend using the new Azure portal since (surprisingly unlike the community), since :

  • The classic management portal will be deprecated with time, and one day, you will use it anyway. So it’s a good idea to start and take the habitude and the hand on it.
  • It’s more oriented to touch screen, tablets and phones.
  • Many features are only possible via this portal : DS-Series virtual machines, resetting VM passwords, RBAC…
  • IaaS V2 (ARM objects) can only be shown and used on the new portal
  • I personally like colorful portals Smile

Azure service Quota and limits :

Further reading

We live in the internet Era, and thanks to search engines like Bing and Google, nothing cannot be not found. If you want to learn more about Azure, where to go:

  1. There is two Microsoft free eBooks that you can download right here : The first to read is Microsoft Azure Essentials: Fundamentals of Azure. The second  is Introducing Windows Azure for IT Professionals. Although the latter dates from October 2013, it contains many useful labs to begin manipulating Azure
  2. Microsoft Azure blog :  For whom who want to be stay always tuned about the last Azure updates and news, this is the official Microsoft Azure blog
  3. You favorite search engine + the Key word : This is my preferred and  most used learning method


The goal of this post is to demystify the Azure virtual machines service and Ito explain the different relayed features and components. The information provided are just a start point, and may become deprecated on few months (some of them of course). Azure is under continuous enhancements and fast features growth. I highly recommend you to always check the Microsoft links for the last updates and news. Do not hesitate at asking your questions via the comments, I will be glad to answer, wherever I have the answer.

Azure Active Directory Connect Health : Installation guide

Hi all,

Microsoft released Azure Active Directory Connect Health, an Azure service that allow you to monitor and gain insight into the on-premises identity infrastructure. It will provide you with precious information like alerts, performance, infrastructure configuration…

AAD Connect Healt Logo

AAD Connect Health logo

This blog post will guide you through a complete installation step by step. AAD Connect health supports both ADFS 2.0 and 3.0. This post is applicable to both versions, but steps are conducted on a Windows 2012 R2 server (ADFS 3.0). There are extra steps for ADFS 2.0 that will be explained and detailed.

NB : Until the writing time of this blog, Azure Active Directory Connect Health is in Public Preview version. Active Directory Federation Services is the only service that can be monitored with Azure AD Connect Health. This includes AD FS servers, AD FS Proxy servers, and Web Application Proxy servers. Microsoft will be adding additional services to Azure AD Connect Health during the preview with future updates. I have no information about the final release date.

Azure AD Connect Health is now GA

This blog will be organized like the following:

Introduction : I will introduce Azure AD Connect Health

Requirements : I will present the different requirements to prepare to be able to use Azure AD Connect health

Deployment : I will present and detail the different steps to successfully deploy Azure AD Connect Health



Azure AD Connect Health is an Azure Service. It’s running and maintained in Azure. It’s agent based. Agents have to be installed on the servers to be monitored. Those agents will collect information and send them back to the Azure endpoints. The Azure AD Connect Health view and configuration panes  are accessed via the Azure Preview portal.



  • Azure Active Directory Premium license

You should own an Azure Active Directory Premium license to be able to use Azure AD Connect Health. To verify that your Azure Active Directory license is premium, connect to the Azure portal (, sign in and go the Directory View (AzureDirectory). Go to the LICENSES tab and look to your LICENCE PLANS. Verify that your LICENCE PLAN includes the Azure Active Directory Premium feature (The following picture shows the LICENSES tab view, and we can see that the License plan is EMS (Enterprise Mobility Suite), that includes AAD Premium.

Snap 2015-04-30 at 16.34.40

(Picture Credit: SAMIR FARHAT)

  • Azure AD Global administrator account and assigned license

The user account you will use to register the AAD Connect health agents must be part of the global administrator role, on your Azure Active Directory Premium tenant. In addition, it must be assigned a license.

To verify that your account is a global administrator , connect to the Azure portal (, sign in and go the Directory View (AzureDirectory). Go to the USERS. Find your user account and enter its Properties.  Verify that the Organization role is set to Global Admin. If not, tell your Azure Active Directory administrator to add you to this role, or to provide you with a Global admin account.

Snap 2015-05-02 at 18.02.48

(Picture Credit: SAMIR FARHAT)

To verify that the user account is assigned a license,  Go to the LICENSES tab, enter the Properties of your License Plan, select All users, and find the user account. Verify that the Assignment Status is Enabled. If not, you can assign it a license using the Assign button on the bottom of the page.

Snap 2015-05-02 at 18.13.57

(Picture Credit: SAMIR FARHAT)

  • AAD Connect Health Agent requirement : For ADFS servers, ADFS auditing must be enabled to use Usage Analytics

To be able to use Usage Analytics for ADFS, ADFS auditing must be enabled on the ADFS Federation servers. Enabling Auditing is not applicable on ADFS Proxy servers and ADFS Web Application servers. If you have a load balanced ADFS farm, some configuration will be  made only on the Primary server (I will note it), so if it’s your case, connect first to the Primary server.

|||| The following steps should be done on all your ADFS federation farm servers (or in the unique federation server if you are not in a farm configuration)

Logon to your ADFS federation server with a domain user with local administrative privileges. Open the Local Security Policy console (SECPOL.mmc)

Snap 2015-04-30 at 14.53.07

(Picture Credit: SAMIR FARHAT)

Navigate to the Security Settings\Local Policies\User Rights Assignment folder, and then double-click Generate security audits.

Snap 2015-04-30 at 14.54.34

(Picture Credit: SAMIR FARHAT)

On the Local Security Setting tab, verify that the AD FS service account is listed. If it is not present, click Add User or Group and add it to the list, and then validate by clicking OK

 Snap 2015-04-30 at 14.55.05

(Picture Credit: SAMIR FARHAT)

Open a command prompt with elevated privileges and run the following command to enable auditing: auditpol.exe /set /subcategory:"Application Generated" /failure:enable /success:enable

Snap 2015-04-30 at 14.56.12

(Picture Credit: SAMIR FARHAT)

Verify that the command was successfully executed.

|||| The following steps should be done on the primary  ADFS federation  server (if you are in a farm configuration) or in the unique federation server if you are not in a farm configuration

Open the AD FS Management snap-in by going to  Server Manager, Tools. Select AD FS Management

Snap 2015-04-30 at 14.56.47

(Picture Credit: SAMIR FARHAT)

Go to the Actions pane, click Edit Federation Service Properties

Snap 2015-04-30 at 15.36.18

(Picture Credit: SAMIR FARHAT)

In the Federation Service Properties dialog box, click the Events tab. Check the Success audits and Failure audits check boxes and validate by clicking OK

Snap 2015-04-30 at 15.36.35

(Picture Credit: SAMIR FARHAT)

Now, you can locate the ADFS audit logs. Open Event Viewer, Go to Windows Logs and select Security, On the right, click Filter Current Logs.

Snap 2015-04-30 at 15.37.08

(Picture Credit: SAMIR FARHAT)

Under Event Source, select AD FS Auditing then click OK

Snap 2015-04-30 at 15.37.35

(Picture Credit: SAMIR FARHAT)

If your ADFS server is processing requests, you will see events logged and scrolling

Snap 2015-04-30 at 15.37.46

(Picture Credit: SAMIR FARHAT)

  • Allowing Azure endpoints (websites) on Internet Explorer

|||| The following steps should be done on all your ADFS  servers : Federation servers, Proxy servers and WAP servers

AAD connect health agents communicates with Azure services via different endpoints (During installation and registration). If Internet Explorer Enhanced Security is enabled, add the following websites on the IE trust Zone.

Open Internet Explorer, go to Internet Options, Security, Trusted Sites and click Sites

Snap 2015-05-03 at 23.02.37

(Picture Credit: SAMIR FARHAT)

Add the Azure sites to the trusted list then click Close

Snap 2015-04-30 at 15.42.39

(Picture Credit: SAMIR FARHAT)

|||| Inbound connection to Azure Endpoints services

AAD Connect Health agents will communicate with Azure services endpoints. You must be sure that all your ADFS servers can reach the following targets :

  • DNS: * – TCP Port: 5671 (New)
  • https://*
  • https://*
  • |||| Update .NET Framework, Windows Management Framework and Internet Explorer (Only For Windows Server 2008 R2 SP1 ie ADFS 2.0)

    This steps are only applicable if you are using ADFS 2.0 on top of Windows Server 2008 R2 SP1. 3 steps are required if they not already done :

    • Update the .NET Framework to version 4.5 : You can download the offline .NET Framework 4.5 installer HERE 
    • Update the Windows Management Framework to version 4 : Powershell version 4.0 is mandatory for the AAD connect health agents. Powershell 4.0 comes with Windows Management Framework  version 4.  You can download the Windows Management Framework 4.0 HERE. Please read carefully the system requirements before proceeding.
    • Update Internet Explorer to version 10 or later : If your IE version is not already IE 10 or 11, then you should update it to Internet Explorer 11. Download HERE

    NB :  Each update discussed below will require the server reboot, so install them in one shot to  reboot your server only once

    Agents installation and configuration

    After preparing your environment to AAD Connect Health (See requirements below), you can install the agents and configure them to communicate with Azure.

    Tip : Install your agents and configure them in a the order you want to see your servers in. In fact, the first registered server will appear first on the Azure AAD Connect Health portal. Ordering the servers is not possible in the current release (Public Preview)

    • First download the agent source and copy it to all your ADFS servers. You can get the agent from HERE.
    • Install the agent on your ADFS server

    Snap 2015-04-30 at 15.46.01

    (Picture Credit: SAMIR FARHAT)

    • Verify that the three following services are present on the Services list. The services state should be ‘Stopped’ and set to ‘Automatic’

    | Microsoft AD Health Diagnostic Agent

    | Microsoft AD Health Insights Service

    | Microsoft AD Health Monitoring Service

    Snap 2015-04-30 at 15.47.03

    (Picture Credit: SAMIR FARHAT)

    • Now, open an elevated Powershell window, and run the following command : Register-ADHealthAgent. A Signing in window will prompt you for your Azure AD credentials (Global Admin account). Just a tip : The credentials will only be used to register the host with Azure, it will not be used for further authentication. The registration process will generate a certificate to be used for the agent authentication with Azure.

    Snap 2015-04-30 at 15.52.00

    (Picture Credit: SAMIR FARHAT)

    You should check that the registration was successful.

    Snap 2015-04-30 at 16.38.28

    (Picture Credit: SAMIR FARHAT)

    Proceed with the agents installation on the remaining servers.

    Adding Azure Active Directory Connect Health to the Azure portal

    To verify and to begin using the AAD Connect Health on the Azure portal, you can check my next blog post : Azure Active Directory Connect Health : User Guide