If you create virtual machines in Microsoft Azure, you typically connect to them using RDP (if they are of course Windows machines). What you may not be aware of is the fact that you restrict, or whitelist, which remote IP addresses are allowed to RDP to these machines. Here’s how you configure this.

You login to you Microsoft Azure console as shown above.

In here is a Windows Domain Controller machine. What I want to do is restrict remote RDP access to this machine for security reasons (since it is a Domain Controller after all).

To do that select the Virtual Machine from the list and then the Endpoints option from the menu across the top as shown above.

At the moment there are only have two endpoints, one for PowerShell and one for Remote Desktop (i.e. RDP). Both of these services are accessible to the outside world via the Public port (which I have obscured for privacy reasons). These Public ports map to familiar Private ports at the virtual machine.

Thus, Remote Desktop connects via a random port from the Internet and this then mapped to the familiar port 3389 port internally at the machine.

To set security on an Endpoint, simply select it and then select the MANAGE ACL button at the bottom of the screen.

You will then see a dialog that allows you to enter a description as well as a remote subnet. You can then set the action to be either Permit or Deny. With RDP traffic the default is to allow all inbound traffic for that endpoint. All other ports are blocked for inbound traffic unless endpoints are created for those ports.

Points to consider:

1. No ACL – By default when an endpoint is created, Azure permits all for the endpoint.
2. Permit – When you add one or more “permit” ranges, you are denying all other ranges by default. Only packets from the permitted IP range will be able to communicate with the virtual machine endpoint.
3. Deny – When you add one or more “deny” ranges, you are permitting all other ranges of traffic by default.
4. Combination of Permit and Deny – You can use a combination of “permit” and “deny” when you want to carve out a specific IP range to be permitted or denied.

(Reference – http://msdn.microsoft.com/en-us/library/azure/dn376541.aspx)

You can of course configure these ACLs using PowerShell and the reference for that is here:

http://msdn.microsoft.com/en-us/library/azure/dn376543.aspx

more information about setting endpoints for virtual machines can be found at:

http://azure.microsoft.com/en-us/documentation/articles/virtual-machines-set-up-endpoints/

Microsoft Azure shares many commonalities with Office 365. When you sign up you are given a default .onmicrosoft.com domain but you can also add you own custom domain. here’s how to do just that.

Login to your Windows Azure portal at:

http://manage.windowsazure.com

From the menu on the left locate the Active Directory icon, which is near the bottom and select it.

You should then see a single entry called Default Directory displayed, select this.

From the menu that now appears across the top select DOMAINS. You’ll then see the above message indicating that you can add a custom domain.

Select ADD A CUSTOM DOMAIN.

In the field that appears, enter the custom domain you wish to use and then press the add button at the bottom.

You should now see a message at the top of the dialog saying that the domain has been successfully added.

Select the arrow in the bottom right to move to the next page in the process.

Much like Office 365 you’ll need to verify that you own this domain. You do that be adding a DNS record to your domain records and having Windows Azure verify it.

There are a number of verification options but the best is normally a simple TXT record. If you therefore select RECORD TYPE as TXT record at the top you’ll be provided with the DNS information you need to add to your domain.

You then got to the name records for you domain and add the supplied details to match the record selected in Windows Azure.

When you have updated your domain record return to Windows Azure and select the verify button at the bottom.

Windows Azure will then query the DNS records of your domain to verify that a matching record can be found. If so, you will receive a verification confirmation message at the top of the dialog as shown above.

Press the check mark in the lower right to complete the process.

You should now see the domain you just added listed in the domains option as shown above.

Again, much like Office 365 you can add multiple domains to Windows Azure as required.

With that done, now we can start utilizing this custom domain inside Windows Azure and I’ll cover that in upcoming blog posts.