Need to Know podcast–Episode 127

In this episode we are joined by Alessandro Cardoso, Technology strategist at Microsoft to talk about his upcoming Microsoft Ignite Australia sessions:

Managing Red Hat on Azure with OMS [OPEN312]

With the capability to deploy a Red Hat supported Virtual Machine in Azure, you may be asking: “What else can I do with my Azure Red Hat VM?” We will introduce Microsoft Operations Management Suite (OMS), walking you through the incredible analytic power of the system for Linux and Windows Azure VMs. With Linux, OMS allows you to collect Syslog events, Performance data, and Nagios/Zabbix alerts

And

Deploying Linux on Microsoft Public and Private cloud [OPEN323]

Heterogeneous environments with Microsoft Windows Clients, Microsoft Windows Server, Linux, FreeBSD, and the cloud are the norm. Being able to run all of your virtualized workloads on a single hypervisor simplifies management and optimizes server capacity. Learn how to deploy Linux VM to Hyper-V or Windows Azure.

You can listen to this episode directly at:

http://ciaops.podbean.com/e/episode-127-alessandro-cardoso/

or on Soundcloud here:

or subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.

Resources

@cloudtidings

@marckean

@directorcia

Microsoft OMS

Azure news from Marc

New features in Microsoft Flow

Using Flow for event registration

Project Osaka

Issues with Azure File Backup on SBS

One of the initial steps that I have been advocating when it came to migrating SBS servers to Azure was the installation of the Azure backup agent (marsagentinstaller.exe) on the SBS box in order to backup files and folders. It was the first step before moving onto more complex operations. After further research, it turns out that doing this will break “other SBS” things.

The reason is that the Azure Backup agent needs at least PowerShell V3.0 per:

https://docs.microsoft.com/en-us/azure/backup/backup-client-automation

Now it turns out that installing PowerShell V3 or higher on an SBS breaks per this:

https://blogs.technet.microsoft.com/sbs/2012/12/15/windows-management-framework-3-0-applicability-on-windows-small-business-server-20082011-standard/

which concludes:

Our guidance at this time is that Windows Management Framework 3.0 should not be deployed on a server running Windows Small Business Server 2008 Standard or Windows Small Business Server 2011 Standard.

Windows Management Framework 3.0 contains PowerShell v3.0.

The bottom line is that you shouldn’t install the Azure files backup agent on an SBS box from what I can determine, because it doesn’t support the minimum required version of PowerShell.

However, the Azure files backup agent will actually install and run on an SBS server. However, it will also as part of that installation install PowerShell v 3.0 which can cause lots of other issues. Thus, even if it can be installed DON’T install it because the components will cause other issues on SBS.

Unfortunately, the Azure file backup agent can only backup files on the host that it is installed on. This means you can’t install it on a members server and backup files across the network that are on the SBS box. However, the way you can do this (in theory) is using Azure application backup, which I’ll now have to go out and check actually operates in an SBS environment.

Makes things tough when your production OS doesn’t support the latest software eh?

Need to Know podcast–Episode 126

For our continued focus on speakers at the upcoming Microsoft Ignite event on the Gold Coast we speak with Andrew McMurray from Microsoft about Azure Information Protection. Andrew’s presentation is:

Prevent unwanted and embarrassing leakage with Azure Information Protection

Microsoft Azure Information Protection helps you safeguard your data throughout the complete data lifecycle. Data is “born” protected and carries the protection wherever it travels. So you don’t need to worry where it’s stored or with whom it’s shared – you can rest assured it’s always protected. Join us to learn more about the technology and how it can solve your information protection challenges.

Marc and I also do our usual wrap up of the latest Microsoft cloud news.

You can listen to this episode directly at:

http://ciaops.podbean.com/e/episode-126-andrew-mcmurray/

or on Soundcloud here:

or subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.

Resources

andrew.mcmurray@microsoft.com

@marckean

@directorcia

AIP Slides: https://aka.ms/IPdeck
AIP video of slides: https://aka.ms/IPvideo
News: https://aka.ms/aipnews
Blogs: https://aka.ms/aipblogs
Security Overview: https://aka.ms/rmssec
Web: https://aka.ms/aip
Overview: https://aka.ms/aipoverview
Forum: https://www.yammer.com/AskIPteam
AAD Sync: https://aka.ms/aipaadsync

Azure news from Marc

Azure AV2 machines now available

Microsoft Staffhub is here

Study says Teams to pass Slack

Azure Av2 machines now available

image

https://azure.microsoft.com/en-us/pricing/details/cloud-services/?WT.mc_id=azurebg_email_Trans_33675_1284_Tier_2_Release_MOSP

The latest generation of A-series, Av2 Standard, has similar CPU performance and faster disk to standard A series. Suitable for development workloads, build servers, code repositories, low-traffic websites and web applications, Av2 Standard also works for micro services, early product experiments, and small databases.

Need to Know podcast–Episode 125

We are back for 2017! Marc and I do our usual news and cloud updates followed by a returning guest, MVP Troy Hunt. Troy chats to us about his upcoming Microsoft Ignite Australia presentation – Applied Azure: Building a Large Scale Real World Application on a Coffee Budget, which makes for real interesting listening.

You can listen to this episode directly at:

https://ciaops.podbean.com/e/episode-125-troy-hunt/

or on Soundcloud here:

 

or subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send us any feedback or suggestions you may have for the show.

Resources

@troyhunt

@haveibeenpwned

@marckean

@directorcia

Have I been Pwned

Azure updates from Marc

Updated SharePoint Team Sites move beyond first release

Microsoft Partner services being revamped

New unified DLP in Office 365

Microsoft Connect car platform

Replacement to Azure RemoteApp coming soon

Azure Backup protects against ransonware

Using Azure DNS with Office 365

One of the tasks that you need to perform when you adding a custom domain to Office 365 is to firstly verify that you actually own the domain name.

image

The Office 365 domain setup wizard, as shown above, will give you a TXT record you need to insert into your DNS zone so ownership can be verified by Office 365 before proceeding further.

Azure has the ability to host DNS records for you rather than using a hosting provider, so let’s see how you configure this.

image

Open your Azure Resource Manager Portal and select to add a DNS Zone from the market place.

image

The name of your new DNS zone has to match the domain you wish to host. Here azlab01.net. I have also elected to place this new DNS zone into a Resource Group for easy management.

image

After a few moments, the new DNS zone will be created and you can navigate to it in the Azure Resource Manager Portal to manage it.

Simple select the new DNS Zone to view its details.

image

You should see something similar to the above

You will notice two DNS records have already been created shown in the lower half of the screen.

image

In the top right of the blade you’ll find the name servers as shown above.

image

You’ll need to update the domain registration for that domain to point to these name servers instead of where they are currently pointing as shown above.

image

In top left of the blade select Record Set to create a new DNS record in this zone.

image

A new blade will appear, as shown. To verify our Office 365 domain we need to add a TXT record with the string provided as shown above.

When complete, save the new record.

image

If we now look at our DNS zone we see an additional TXT record as expected.

image

If we return to Office 365 and select Verify, our domain should successfully be verified thanks to Azure DNS. We can now proceed onto managing the individual domain records ourselves in Azure DNS. To do this select the option I’ll manage my own DNS records and select Next to continue.

image

As expected, and shown above, we get a long list of DNS records to add to our zone. Now here’s were the benefits of using Azure DNS shine through.

We can use PowerShell with Azure DNS to set all our records using a script. Thus, instead of adding them manually one by one via a browser, we simply run a script that does all the work for us.

get-azurermdnsrecordset –zonename –resourcegroup

To view the existing Azure DNS zone information run the above command once you are connected to Azure.

image

As you can see from the above, one of the entries is the TXT record entered into the Azure DNS zone manually via the portal.

To add an MX record for instance to the zone, execute the following command:

New-azurermdnsrecordset -name “@” -recordtype MX –zonename –resourcegroupname -ttl 3600 -DNSrecords (new-azurermdnsrecordconfig –exchange domain-com.mail.protection.outlook.com -preference 0)

That should produce the following record in your zone:

image

If you now execute the appropriate commands that add the remaining records to your zone, you can then return to Office 365 and complete the wizard.

image

If everything is in order you should now get confirmation that your domain has been successfully configured for Office 365 as shown above.

The huge benefit here that Azure DNS provides is the ability to totally script this. Most of the DNS records you need to add for Office 365 are identical or derived from the custom domain you wish to add. Thus, all you need to do is set some parameters at the top of your script and the remainder remains identical. Thus, you can use one PowerShell script to set the DNS Zone records for EVERY custom domain you wish to add to Office 365! How much time is that going to save you if you need to set up lots of custom domains?

Another benefit Azure provides is that ability to assign different rights to different users in you Azure portal. Maybe only a few users can update records, while other can only view them.

image

As you can see from the Azure pricing calculator above, Azure DNS is not a free service. There is a small fee based on the number of zones and DNS queries on those domains you have. In this case, for 1 zone with 1 million queries the cost is AU$1.15 per month, which is really pretty cheap.

I think Azure DNS has a lot of benefits for IT Professionals managing domains. They could aggregate them all under their own partner tenant and become like a hosting business. They could also host the zone records in the individual customer’s Azure tenant, which of course could use the same logins as Office 365 because Office 365 comes with a free Azure tenant. I also like the idea of bringing this sort of thing back to a single supplier rather than using multiple hosting providers.

However, I think the real killer benefit is simply the ability to script everything thanks to PowerShell. This alone is going to save me so much time when I set up test domains and labs. It also means I won’t make spelling mistakes when entering the records for Office 365. All I’ll need to do is change the variable at the top of my script to match the domain I want to work with and then the script is good to go. How easy is that?

Focus on adding value

This is part eight of my presentation “Making money from the cloud”. You can find the full slides at:

https://doc.co/LyrxvF/qcihGm

and the previous parts are at:

We live in exponential times

Consider the following

Major Trends

Macro Trends

Software will eat the world

The phone is the desktop

Build a tailored service

image

In a world of common cloud services like Office 365 and Azure, that anyone can buy at any time from the web, how do you make your IT reseller business stand out from the crowd? Simple. Add value.

As with many things, the answer is simple but executing on that is challenging. This is because the traditional model for IT resellers was basically, buy from distributor, add some margin and resell. That worked until the products became commodities where margins were driven to zero. Strike one.

The next ‘solution’ that resellers adapted was managed services. Basically, for a flat monthly free, a reseller agreed to fix any broken IT issues. Exactly the same thing then happened. Managed services became something that everyone was offering. Thus, with no point of real differentiation it became a commodity and once again margins were driven to zero. Strike two.

For small providers in the cloud world both the traditional reseller and managed service provider model are fading into oblivion. If you keep pursuing them you are going to go down swinging. The reason is that few providers can, or are, differentiating themselves from their competitors. Many providers are still locked into these old world models and trying to apply them to products like Office 365, Azure, etc and unsurprisingly they are failing to make them profitable. In short, they are striking out.

The reason for this is they are failing to add value in what they do. If you migrate emails from on premises to the cloud, what real value have you provided the customer? To their mind, nothing. What point of differentiation can you create with email migrations? Generally not much thanks to automated tools like Migrationwiz and Skykick. The only way to be profitable going forward is to focus on providing value.

Specifically, it must be value to the customer, not the IT reseller. Simply moving emails to the cloud doesn’t provide much value in the customers mind as I have highlighted. However, showing customers how to create rules to filter emails, enable enhanced security like encryption and data loss prevention certainly do. Again, value in the customers mind, not your own.

This means IT resellers needs to focus on what matters to the business. The hardest technical challenge may indeed need to be solved but it may not provide much perceived value to the business. Conversely, the simplest thing technically can provide enormous business benefit and value to a business. In short, you need to look using the customers eyes and understand what they see as valuable.

For most customers, value is added by making things simpler. Less steps, less choices, less options and so on. Less also means that there is less than can break and go wrong. Many technical people believe that being simple is somehow being inadequate. In fact, it is quite the opposite. Simplifying something is far more challenging than adding unwanted overhead. Complicating things just because you can doesn’t add value, in many cases it destroys value in the customers mind.

Apart from simplification, customers are looking for end to end solutions. This, to me, is one of the standard out features that Office 365 brings to the table that sets it apart from its competition. For example, there is one Azure AD user login for Office 365, Azure, Intune, CRM, Project Online, etc, etc. One end to end user identity to access everything. When you also combine that with Windows 10 on the desktop, where you can again login to machines using the same identity, life becomes a whole lot simpler for the customer. Value added.

I continually harp on the fact that Office 365 is more than just hosted email, yet the vast majority of installations I see are email only enabled even though they have paid for the full Office 365 suite. That isn’t the customers fault, it’s the reseller who has implemented something they don’t know enough about!

image

If all you are doing is simply lifting and shifting emails and or files then:

1. You aren’t really adding any value from the way things currently are and

2. You are potentially allowing someone else to easily add value and push you out of the equation.

Not a smart or sustainable strategy at all.

image

As the above slide indicates, there is just so much more that can be done with Office 365 email alone, not to mention SharePoint, Yammer, Skype, Teams and so on. Yet all I see, time after time, is resellers focused on simple email migrations. Lift and shifting while adding no value. Doing so adds zero value to the customer OR to the reseller’s own business. Why? Because just about anyone can do an email migration to Office 365 these days. Where’s the point of differentiation there? And of course, no differentiation means its a commodity and being a commodity means the only way you make money is in large volumes. And that is something a small reseller can’t do. They can never scale to a size that it becomes economically viable. So why limit your options to those that won’t help you win? Strangely, many resellers do.

You need to turn the whole model around and put value at the forefront of everything you do. My aim with this blog post is to provide value to readers in lifting their knowledge. My aim when doing a demo of Office 365 is to show customers how Office 365 services could help their business get things done better and more profitably. When I follow up with someone about Office 365 I send them a list of links with further information about the product. Value, value, value. In short, what can I do that adds value at every transaction point?

Value is your unique differentiation point. You need to understand and develop what you can bring to the table for the customer. Not just at installation time, but at every point through the engagement process. The act of adding value is a process that is never complete. There is always more value you can add. Importantly, no matter how small you are, you can still add value.

You know that you are getting your value offerings right when customers seek you out. The point at which people start asking you to provide your offerings without you even telling them is a clear indication that what you have is unique and is something they want. Perfect.

To have a successful value proposition you need to move beyond the technology. As an IT reseller you have to help the customer transform their business with technology. You have to help them do things better, faster and cheaper using the technology. Technology needs to be the centre piece of the way they run their business and at that centre is you guiding them and adding value every step of the way. You need to understand their business rather than merely selling ‘stuff’ to it as the old model dictated.

Take a look at what existing processes a customer may have that can have technology applied to it in order to improve it. Where are in inefficiencies? Where are the opportunities to help your customer reach more customers and serve their customers better? With tools like Office 365 and Azure there are virtually an unlimited number of opportunities to do just that for customers.

Changing your business model from that of a traditional IT reseller and managed services provider into a business that is focused on adding value through technology won’t happen overnight. It takes discipline and dedication as well as constant focus but the rewards are tremendous. Once you commence down the value path you’ll find that the world starts beating a path to your door step. Why? Because customers buy on value not on price, and you have the products that are most valuable to them.

Joining Windows 10 machines to Office 365

image

One of the great things that Windows 10 Professional and above provide is the ability to connect directly to Azure AD. Hopefully, as you are aware Office 365 identity is built on Azure AD. Thus, if we connect Windows 10 to an Azure AD that is part of an Office 365 tenant we get simplified sign on. This basically means when users open Microsoft browsers (IE or Edge) and navigate to the Office 365 portal they are automatically logged on because their credentials are already part of Windows 10 thanks to Azure AD join. This simplified login also works with desktop applications like Word, Excel, PowerPoint etc plus some third party applications. In short, users get logged directly into applications once they login to their desktop thanks to Azure AD join.

Now there are a couple of ways of joining Windows 10 to Azure AD. I’ve previously covered how to basically ‘add’ your Azure AD/Office 365 credentials to an existing Windows 10 installation here:

Connect Windows 10 to Azure AD

That method isn’t quite as full featured as if you set up your Windows 10 machine to join Office 365 during the setup of Windows 10.

image

The process for doing that configuration, is that during the installation of Windows 10 onto a machine you’ll receive a prompt like that show above asking you to Join Azure Active Directory or Join a local Active Directory domain.

So what I’m going to assume here is that I want this Windows 10 machine to be only joined to Office 365/Azure AD because there no local AD. So I select the Join Azure Active Directory option.

image

I’m then prompted to enter my Azure AD credentials. Remember, these credentials are what you use to login to Office 365.

image

I enter the user’s Office 365 details and select Sign in. Now it is also important to note here that this new user will also be, by default, an administrator of the local Windows 10 machine. If you don’t want to allow your users to be administrators of the local desktop then you’ll need to remove this account after setup has completed.

image

The Windows 10 setup process will continue and eventually you’ll be prompted to login to the machine. You should login with your Office 365 credentials as shown when prompted.

image

The Windows 10 desktop will then do a little more setup as shown above.

image

In this case I’m also then prompted to create a 4 digit pin for this machine. I’ll show you more about why this happens shortly but basically because I am joining this machine to Office 365 the Mobile Device Management (MDM) policies I have established are now being applied to this device. One of the policies I have configured is to require a PIN.

image

If we dig into the local machine name as seen above,

image

We now see that same machine in the MDM for Office 365 as shown above.

image

This means it will have the MDM security policies applied to it that I have configured. In this case, as you can see from the above configuration, I require devices to have at least a 4 digit pin password.

Don’t forget that Office 365 MDM is a free and included part of the service.

image

If I now look at the properties of the user on the directly joined machine just set up, I see the above, basically a single user with an Office 365 identity.

image

If I then look in the work and school account I see that it is connected to my Azure AD as shown above. Therefore, here I have only one account that logs me into the local machine and my Office 365.

image

Compare that situation to when I already have a functioning Windows 10 machines and I associate it to Azure AD. When I do that I only see the local user as the identity as shown above. Thus, I am actually logging into this Windows 10 machine with a local account rather than my Office 365 account.

image

When I look in the work or school account area I again see a connection to my Azure AD. Thus, I login to this Windows 10 device with a local account which is then associated to an Office 365 account. Therefore I have two accounts in operation now, a local account and an Office 365 account.

The big difference here is that by using an Office 365 login during the installation of Windows 10 I get an Office 365 login to my box, whereas if I connect to Azure AD after my Windows 10 is installed I only get a local account login.

In both cases, when I visit a site in an Microsoft browser (IE or Edge) such as the Office 365 portal, I am not prompted to login because these credential are furnished directly from Windows 10.

It is my experience that having just the one Office 365 login associated with a Windows 10 device is more reliable when it comes to this same sign on than if you merely associate an Office 365 login with an existing Windows 10 box. The trade off is, of course, that you only get this single Office 365 login to the box if you install Windows 10 from scratch, which may not always be possible.

So can you add an Office 365 to an existing Windows 10 machine and achieve browser and application same sign on? Yes. However, I would suggest a better option is to actually setup Windows 10 from scratch using an Office 365 account. You’ll get much better same sign on and be prepared for further integration down the track. You also remove the complexity of multiple accounts on the one desktop.

The main reason that you want to join your Windows 10 machines to Office 365/Azure AD is probably to eliminate the need for any local AD. This will also mean the elimination of on premises equipment and ensuing cost savings.

The main reason for retaining a local AD these days is simply for group policy, but in my experience is that most of what needs to be done with group policy can either be done with Office 365 MDM (which is free) out of the box or upgrading to Windows Intune or Azure AD Domain Services. That, in essence, now suggests that there is no real need for a local domain controller on premises at all. It can easily be eliminated with the integration of Windows 10, Office 365 and Azure AD as shown.