Azure Stack Migrate
Whiteboard design session trainer guide
July 2020
Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
The names of manufacturers, products, or URLs are provided for informational purposes only and Microsoft makes no representations and warranties, either expressed, implied, or statutory, regarding these manufacturers or the use of the products with any Microsoft technologies. The inclusion of a manufacturer or product does not imply endorsement of Microsoft of the manufacturer or product. Links may be provided to third party sites. Such sites are not under the control of Microsoft and Microsoft is not responsible for the contents of any linked site or any link contained in a linked site, or any changes or updates to such sites. Microsoft is not responsible for webcasting or any other form of transmission received from any linked site. Microsoft is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement of Microsoft of the site or the products contained therein.
© 2020 Microsoft Corporation. All rights reserved.
Microsoft and the trademarks listed at https://www.microsoft.com/en-us/legal/intellectualproperty/Trademarks/Usage/General.aspx are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners.
Contents
Thank you for taking time to support the whiteboard design sessions as a trainer!
An amazing trainer:
Creates a safe environment in which learning can take place.
Stimulates the participant’s thinking.
Involves the participant in the learning process.
Manages the learning process (on time, on topic, and adjusting to benefit participants).
Ensures individual participant accountability.
Ties it all together for the participant.
Provides insight and experience to the learning process.
Effectively leads the whiteboard design session discussion.
Monitors quality and appropriateness of participant deliverables.
Effectively leads the feedback process.
Each whiteboard design session uses the following flow:
Step 1: Review the customer case study (15 minutes)
Outcome
Analyze your customer’s needs.
Customer’s background, situation, needs and technical requirements
Current customer infrastructure and architecture
Potential issues, objectives and blockers
Step 2: Design a proof of concept solution (60 minutes)
Outcome
Design a solution and prepare to present the solution to the target customer audience in a 15-minute chalk-talk format.
Determine your target customer audience.
Determine customer’s business needs to address your solution.
Design and diagram your solution.
Prepare to present your solution.
Step 3: Present the solution (30 minutes)
Outcome
Present solution to your customer:
Present solution
Respond to customer objections
Receive feedback
Wrap-up (15 minutes)
Before conducting your first whiteboard design session:
Read the Student guide (including the case study) and Trainer guide.
Become familiar with all key points and activities.
Plan the point you want to stress, which questions you want to drive, transitions, and be ready to answer questions.
Prior to the whiteboard design session, discuss the case study to pick up more ideas.
Make notes for later.
Refer to the Trainer guide to stay on track and observe the timings.
Do not expect to memorize every detail of the whiteboard design session.
When participants are doing activities, you can look ahead to refresh your memory.
Adjust activity and whiteboard design session pace as needed to allow time for presenting, feedback, and sharing.
Add examples, points, and stories from your own experience. Think about stories you can share that help you make your points clearly and effectively.
Consider creating a “parking lot” to record issues or questions raised that are outside the scope of the whiteboard design session or can be answered later. Decide how you will address these issues, so you can acknowledge them without being derailed by them.
Have fun! Encourage participants to have fun and share!
Involve your participants. Talk and share your knowledge but always involve your participants, even while you are the one speaking.
Ask questions and get them to share to fully involve your group in the learning process.
Ask first, whenever possible. Before launching into a topic, learn your audience’s opinions about it and experiences with it. Asking first enables you to assess their level of knowledge and experience, and leaves them more open to what you are presenting.
Wait for responses. If you ask a question such as, “What’s your experience with (fill in the blank)?” then wait. Do not be afraid of a little silence. If you leap into the silence, your participants will feel you are not serious about involving them and will become passive. Give participants a chance to think, and if no one answers, patiently ask again. You will usually get a response.
In this whiteboard design session, you will work with a group to design a hybrid cloud architecture using a combination of the Azure public cloud and Azure Stack. This functional architecture will enable customers to leverage their investments in Azure as a “cloud platform,” rather than Azure as a “place.”
At the end of the session, you will be able to determine which systems are good candidates for the Azure public cloud, and which are better suited on Azure Stack.
Outcome
Analyze your customer’s needs.
Timeframe: 15 minutes
Directions: With all participants in the session, the facilitator/SME presents an overview of the customer case study along with technical tips.
Meet your table participants and trainer.
Read all of the directions for steps 1-3 in the student guide.
As a table team, review the following customer case study.
Contoso Finance is one of the largest banks in the United States with a significant amount of their revenue coming from their residential mortgage business. Their mortgage business is headquartered in Dallas, Texas. During a meeting with the newly appointed CTO Doreen Newton, the IT team learned that Contoso is shifting to a cloud first strategy after seeing firsthand the advantages of the cloud from Doreen’s previous role leading her prior company through a digital transformation. Her message, “I have seen how applications and infrastructures are deployed and run using Microsoft Azure with both PaaS and IaaS services. These capabilities can transform Contoso with more agility and long-term cost effectiveness.” resonated with other members of the IT organization.
Contoso’s current workloads run in their Dallas based datacenter using VMWare based virtual machines. One of the primary applications the company is interested in modernizing to take advantage of the cloud is a consumer facing mortgage application. This application is handling new mortgage requests and facilitating access of consumers to their current mortgage information. The current implementation of the mortgage application is hosted in a public facing website on Microsoft Internet Information Server (IIS) with a backend database using SQL Server 2012. The application has several modules that run as Windows Services. These modules are responsible for running credit checks and generating PDFs for transactions. The application uses Microsoft Message Queue (MSMQ) for interacting between modules. The application also allows customers to download several publicly accessible PDF files that provide an overview of the bank’s mortgage related products.
As the result of a recent acquisition of a financial analytics company named Fabrikam, based in Houston, Texas, Contoso IT management team plans to integrate a number of Fabrikam’s internally developed applications to process and analyze the customer data being used by the Contoso’s customer facing mortgage application. Fabrikam has skilled development and infrastructure teams, with extensive Azure experience and its own Azure Active Directory tenant. Contoso is very interested in leveraging that experience and plans to offer the Fabrikam IT team sufficient level of autonomy when working on the integration tasks. That autonomy should include the ability of the Fabrikam IT team to offer to their users cloud resources required for application development, implementation, and maintenance. At the same time, Contoso wants to ensure proper governance and facilitate implementation of corporate standards via centralized control of the service catalog content and through automation.
During the planning stages, Contoso realized they would not be able to move their customer, on-premises resident data to US based Azure regions due to corporate compliance policies and regulatory issues. “This was a cause for great concern, as this means Contoso may not be able to move to cloud-based services as fast as we initially envisioned” says Max Rubin, VP of Network Engineering. Doreen Newton took on the challenge to investigate alternatives to allow Contoso to proceed with getting the benefits of the cloud while not breaking rules for corporate compliance.
To help design a solution using Azure technologies, Contoso has engaged a Microsoft Cloud Partner and Service Provider FusionTomo (FT). FT is a full-service hosting provider in North America certified to deliver Azure services with connectivity solutions and partnerships to provide ExpressRoute and other telecom services. They have datacenters located in Denver, London, Las Vegas, Dallas and Hong Kong SAR.
Contoso has expressed to FT the need to embrace Microsoft Azure technologies as well as technologies that will help their organization with a more agile continuous integration and continuous deployment model for application deployment. Contoso also underscored the need for cooperation with Fabrikam’s integration teams, including the intent to delegate some of the infrastructure management tasks.
With these goals in mind, Contoso has challenged FT to implement a hosted environment that will accommodate requirements regarding integration work to be carried out by Fabrikam. In addition, as internal workloads are transitioned to the hosting environment, Contoso’s internal audit team must retain its ability to track all of the infrastructure changes. For compliance purposes, the delegation model that will provide Contoso and Fabrikam staff with insight into the hosted environment must comply with the principle of least privilege. To satisfy Contoso governance requirements, FT must document standard operating procedures that will be carried out within the hosted infrastructure.
Contoso is looking for FT to provide the following for their expansion into North America:
Design a hybrid-cloud architecture that is native Azure end-to-end without the need for hosting the application in a Contoso owned datacenter.
The design should ensure that customer data is not stored in the Azure Cloud while also allowing future applications to be easily deployed in Azure with access to custom data regardless of where they are deployed.
Deploy the application in a secure manner as to allow for the frontend applications to access the backend customer data.
Establish direct connectivity from the new regional headquarters in Dallas to the deployments. This will allow communication with existing systems and reporting until the rest of Contoso’s services are moved to Azure in the future.
Allow for a consistent application deployment model using Azure ARM templates and CI/CD.
Detail the taxonomy that will be leveraged for the hybrid-cloud including the Resource Providers (RP) This includes tenants, regions, subscriptions, offers, plans, services and quotas.
Design an integration model that would allow resource access for both Contoso and Fabrikam users.
Propose a self-service approach that will allow Contoso and Fabrikam developers to provision their own resources from the service catalog offered by infrastructure teams. The scope of resources available in service catalog must be controlled centrally, with an oversight by designated Contoso and Fabrikam administrators.
Recommend a procedure for delegation of permissions that would not only allow designated Fabrikam IT admins to manage Contoso infrastructure but also account for the need to provide limited access to the Contoso internal audit team.
Suggest a methodology that would facilitate implementing corporate standards by automating the process of resource provisioning and configuration.
Document standard operational tasks such as infrastructure backup and log collection.
The Mortgage SQL DB cannot be hosted in the public cloud.
Contoso staff is already stretched thin, so minimizing patching of systems and day-to-day management is very important.
The developer team acknowledges that the existing application architecture is designed for running on Windows Virtual Machines, but PaaS is the future they envision. How can they move this application forward?
One of the key reasons Contoso wants to go to the cloud is to take advantage of tools and services for automated deployments and application development. Will Azure Stack make it to where we must use two skillsets?
Fabrikam already has its own Azure Active Directory tenant. Will it be necessary to create duplicate accounts for Fabrikam users?
Outcome
Design a solution and prepare to present the solution to the target customer audience in a 15-minute chalk-talk format.
Timeframe: 60 minutes
Business needs
Directions: With all participants at your table, answer the following questions and list the answers on a flip chart:
Who should you present this solution to? Who is your target customer audience? Who are the decision makers?
What customer business needs do you need to address with your solution?
Design
With all participants at your table, respond to the following questions on a flip chart:
Design a hybrid-cloud architecture using Azure services that will make up the implementation for Contoso.
Identify the overall application design you would propose for modernizing their existing application into Azure.
List the services and components that will be deployed to Azure public cloud. For each, provide their basic function in the system. Determine which Azure Region will be best suited for the deployment.
List the services and components that will be deployed to Azure Stack. For each, provide their basic function in the system.
Determine which identity provider and which identity topology you will use to facilitate authentication and authorization of the Azure Stack environment.
Describe different delegation mechanisms can be employed to facilitate controlled access to Azure Stack resources.
Establish which common infrastructure management tasks must be implemented and maintained by designated Azure Stack operators.
Identify how applications such as the Mortgage App and other infrastructure workloads could be deployed in a consistent manner between Azure Public and Azure Stack.
Plan and document Azure Stack taxonomy for this deployment.
Document each of the following areas of the taxonomy with details on how it will be setup:
Cloud Operator
Region
Tenant
Subscriptions
Plans and quotas
Offers
Services / Resource Providers
Diagram your taxonomy.
Create a network design.
Prepare
Directions: With all participants at your table:
Identify any customer needs that are not addressed with the proposed solution.
Identify the benefits of your solution.
Determine how you will respond to the customer’s objections.
Prepare a 15-minute chalk-talk style presentation to the customer.
Outcome
Present a solution to the target customer audience in a 15-minute chalk-talk format.
Timeframe: 30 minutes
Presentation
Directions:
Pair with another table.
One table is the Microsoft team and the other table is the customer.
The Microsoft team presents their proposed solution to the customer.
The customer makes one of the objections from the list of objections.
The Microsoft team responds to the objection.
The customer team gives feedback to the Microsoft team.
Tables switch roles and repeat Steps 2-6.
Time frame: 15 minutes
Directions: Tables reconvene with the larger group to hear the facilitator/SME share the preferred solution for the case study.
Check in with your table participants to introduce yourself as the trainer.
Ask, “What questions do you have about the customer case study?”
Briefly review the steps and timeframes of the whiteboard design session.
Ready, set, go! Let the table participants begin.
Check in with your tables to ensure that they are transitioning from step to step on time.
Provide some feedback on their responses to the business needs and design.
Provide feedback for their responses to the customer’s objections.
Determine which table will be paired with your table before Step 3 begins.
For the first round, assign one table as the presenting team and the other table as the customer.
Have the presenting team present their solution to the customer team.
Have the customer team provide one objection for the presenting team to respond to.
The presentation, objections, and feedback should take no longer than 15 minutes.
If needed, the trainer may also provide feedback.
Doreen Newton, CTO
Max Rubin, VP of Networks
Contoso teams:
Fabrikam teams:
FT Teams
After being engaged by Contoso and gathering the requirements from the client, FT has put forward a design which embraces the Azure platform and DevOps for development and deployment, as well as addresses multi-tenant identity and data sovereignty requirements discovered by Contoso (no customer data in the public cloud). The solution consists of using Azure public cloud in the South-Central Region and Azure Stack running in a FT Dallas datacenter.
Design a hybrid-cloud architecture using Azure services that will make up the implementation for Contoso:
Identify the overall application design you would propose for modernizing their existing application into Azure.
Azure Web Apps and API Apps will replace the IIS servers for hosting the website and associated APIs.
Azure Blob Storage will be used for storage of private and public PDF files.
Azure Storage Queues would replace passing messages using MSMQ.
Azure Functions will replace the Windows Services.
Azure SQL Database will replace the existing SQL Servers.
Azure Traffic Manager will be configured in Priority mode to route web traffic to either the Azure public Web App or the Web App on Azure Stack.
Azure Content Deployment Network (CDN) to allow public files such as PDFs to be routed closer to customers for a faster download experience.
List the services and components that will be deployed to Azure public cloud. For each, provide their basic function in the system. Determine which Azure Region will be best suited for the deployment.
Azure public cloud: The South-Central Region will be used for public facing applications allowing the reuse of all of the code currently being run in production in Europe and Australia. The following applications will be deployed to Azure Global Cloud:
Mortgage Application Web App
Azure Storage for publicly accessible PDF files.
Azure CDN for hosting publicly accessible PDF files.
List the services and components that will be deployed to Azure Stack Cloud. For each, provide their basic function in the system.
A new Azure Stack Region will be deployed into the FusionTomo datacenter in Dallas, TX. The following applications and VMs will be deployed into Azure Stack:
Azure Stack SQL Database for the Web App DB and Customer Data. This will require the Azure Stack SQL DB Resource Provider to be installed.
Mortgage Applications and Mortgage Admin: Offers API, and Function App will be deployed to Azure App services in an Azure App Service Environment (due to ExpressRoute integration with Azure Stack). This will require the Azure Stack Azure App Resource Provider to be installed.
Azure Blob Storage for PDFs.
Azure Queue Storage for the Mortgage Application messaging.
Determine which identity provider and which identity topology you will use to facilitate authentication and authorization of the Azure Stack environment.
In order to facilitate authentication and authorization requirements (and given the cloud first strategy embraced by Contoso), FT will implement Azure Active Directory as the identity provider in the multi-tenant topology, with the Contoso Azure Active Directory serving as the primary tenant (providing access to both the Azure Stack Admin and User portal) and the Fabrikam Azure Active Directory serving as a guest tenant (allowing its users to access the Azure Stack User portal only).
Describe different delegation mechanisms can be employed to facilitate controlled access to Azure Stack resources.
FT will rely on the two primary delegation mechanisms in order to accommodate the need to provide restricted access to the Azure Stack environment:
Role Based Access Control (RBAC): Allows assigning users to built-in or custom roles that determine actions which these users will be able to carry out within the scope of an assignment (such as a subscription or a resource group). FT can use RBAC to provide designated members of Contoso and Fabrikam IT staff with limited access to the Default Provider Subscription (for example, assign them to the built-in Reader role on the subscription level or use a custom role that restrict their access further, allowing them only to view the Activity Log).
Delegated Provider model: Allows members of Contoso and Fabrikam IT staff designated as delegated providers to control the process of their respective end-users signing up for subscriptions. With delegation, the delegated provider manages an offer (called a delegated offer), and end users obtain subscriptions under that offer without involvement from the FT Azure Stack operator.
Establish which common infrastructure management tasks must be implemented and maintained by designated Azure Stack operators.
FT will be responsible for implementing the following common Azure Stack management tasks:
Creating plans, quotas, and offers
Creating Marketplace items
Backing up Azure Stack Infrastructure
Monitoring infrastructure health
Managing network and storage resources
Replacing failed hardware
Identify how applications such as the Mortgage App and other infrastructure workloads could be deployed in a consistent manner between Azure public cloud and Azure Stack.
Azure Resource Manager templates can be used to deploy supported services to both Azure public cloud and Azure Stack.
A hybrid continuous integration/continuous delivery(CI/CD) pipeline enables you to build, test, and deploy your app to multiple clouds. A hybrid CI/CD pipeline can help you:
Initiate a new build based on code commits to your Azure DevOps repository.
Automatically deploy your newly built code to Azure for user acceptance testing.
Once your code has passed testing, automatically deploy to Azure Stack.
Plan and Document Azure Stack Taxonomy for this deployment.
Cloud operator: The primary responsibilities associated with this role will be handled by FT. As the Service Provider, FT will provision and maintain the Azure Stack Infrastructure, including building out the hardware, software, and managing plans, offers and services via the Azure Stack Admin portal. Contoso and Fabrikam end users and IT staff will have access to the Azure Stack environment via the User Portal to build, manage and secure their deployments. Through the delegated providers model, Contoso and Fabrikam IT staff will also be able to create delegated offers and plans based on offers and plans controlled centrally by FT Azure Stack operators. This, in turn, will allow Contoso and Fabrikam end users to subscribe to offers and provision Azure Stack resources through self-service. In addition, FT will be able to leverage built-in and custom Role Based Access Control roles to provide restricted access to the Azure Stack Admin portal to Contoso and Fabrikam staff in order to satisfy audit, security, and governance requirements.
Region: One Azure Stack region would be created in the FT datacenter for Contoso’s operations in North America.
Tenant: Contoso will be setup as the primary tenant for their US based operations. To accommodate requirements for integration with Fabrikam Azure Active Directory, FT will implement multi-tenant Azure Stack topology. The same topology can be further extended to include other tenants as Contoso grows its business. All tenants can be granted access to all of the offers and services detailed in the rest of this taxonomy. (If further separation is required, then another Region would have to be deployed.)
Subscriptions: The Azure Stack environment will contain multiple subscriptions. Their creation would be coordinated with Contoso and Fabrikam, but considering the intended self-service model, users will be able to create their own subscriptions based on public or private offers available to them. Distinct subscriptions will facilitate cost allocation and chargeback processes.
Plans and quotas: Plans are groupings of one or more services, with quotas restricting resources available when provisioning these services. In Azure, services are designed, deployed and offered to various regions by Microsoft engineers and operators. In Azure Stack the cloud operator deploys these services and makes them available to subscribed users using quotas, plans, and offers. This needs to be carefully designed in order to take into account capacity planning and growth/usage patterns as each of these elements are connected and define both the capabilities and quantities that users can consume. As the provider, FT will create plans to offer to the Contoso and Fabrikam tenants. Each service added to a plan can be configured with quota settings.
Offers: Offers make plans available to users or delegated providers. FT will implement the delegated provider model, allowing designated members of the Contoso and Fabrikam staff serve the role of delegated providers and to create offers to their respective end-users based on FT-defined plans and offers.
Services/Resource Providers (RP): The base Resource Providers: Compute RP, Network RP, Storage RP and KeyVault RP will all be enabled. The SQL Server RP will be enabled and configured. The Azure App RP will be enabled and configured (The Windows Server 2016, SQL Server 2017, SQL IaaS Extension for Azure Stack).
Create a networks design.
Design Network connectivity between the Contoso Regional HQ in Dallas to Azure and Azure Stack that will allow future applications to be deployed in the public cloud or Azure Stack and still provide connectivity to customer or On-Premises data.
The initial proof of concept will start with providing a S2S VPN between the virtual network the Azure Web App is connected to and Azure Stack and another S2S Gateway between the Azure Stack datacenter in FT and the Contoso Regional HQ.
For the future, both S2S and ExpressRoute will be configured for routing using BGP ensuring the best connections possible and one set of configurations for routing. FT will provide the Public ASN number for the routes from their datacenter network in Dallas. FT will also configure the BGP connections between their datacenter and the new routers On-Premises at the Contoso Dallas office. Contoso’s Public IP Space will be leveraged along with the addition of Public IP space from FT.
The Mortgage SQL DB cannot be hosted in the public cloud.
Potential Answer:
The SQL Database containing the customer information will be hosted in Azure Stack in the FT datacenter. This will require the SQL DB Resource Provider to be running on Azure Stack. The data will never reside in the Azure Global Cloud.
Contoso will have a very limited staff to manage the US based operations, so minimizing patching of systems and day-to-day management is very important.
Potential Answer:
All of the services that are used for this application in both Azure Global and Azure Stack leverage PaaS services. As a result, there is very limited need for management of the platforms beyond the application.
The developer team acknowledges that the existing application architecture is designed for running on Windows Virtual Machines, but PaaS is the future they envision. How can they move this application forward?
Potential Answer:
The application code base can be modernized by converting the Windows Services to Azure Functions, messaging based code could use Azure Storage Queues or Service Bus, and code that reads and writes from the file system could be updated to use Azure Storage. Finally, application code that writes to SQL Server could be updated to use SQL Database.
One of the key reasons Contoso wants to go to the cloud is to take advantage of tools and services for automated deployments and application development. Will Azure Stack make it to where we must use two skillsets?
Potential Answer:
While there will be minor differences with connectivity/environment information, if the resources are supported in both clouds, the developer and tooling experience will be consistent.
Fabrikam has already its own Azure Active Directory tenant. Will it be necessary to create duplicate accounts for Fabrikam users?
Potential Answer:
There is no need for creating duplicate accounts for Fabrikam users. When using Azure Active Directory as the identity provider, Azure Stack supports multi-tenant topology. Once implemented, the topology allows users from different Azure Active Directory tenants provision and access Azure Stack offers directly from the Azure Stack User portal. If there is a need for a Fabrikam IT staff to access the Azure Stack Admin portal, this can be accomplished by inviting that user into Contoso Azure Active Directory tenant and using Role Based Access Control to implement authorization. When using Active Directory Federation Services (AD FS) as the identity provider, multi-tenancy can be provided through federation trusts.
“Our plans to enter the North American Mortgage market were enabled by our Partner, FusionTomo helping us to leverage our investment in Azure as a platform with Azure Stack. We can move forward with our project timelines.”