Microsoft Cloud Workshops

Azure Stack Migrate

Whiteboard design session trainer guide

July 2020

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

The names of manufacturers, products, or URLs are provided for informational purposes only and Microsoft makes no representations and warranties, either expressed, implied, or statutory, regarding these manufacturers or the use of the products with any Microsoft technologies. The inclusion of a manufacturer or product does not imply endorsement of Microsoft of the manufacturer or product. Links may be provided to third party sites. Such sites are not under the control of Microsoft and Microsoft is not responsible for the contents of any linked site or any link contained in a linked site, or any changes or updates to such sites. Microsoft is not responsible for webcasting or any other form of transmission received from any linked site. Microsoft is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement of Microsoft of the site or the products contained therein.

© 2020 Microsoft Corporation. All rights reserved.

Microsoft and the trademarks listed at https://www.microsoft.com/en-us/legal/intellectualproperty/Trademarks/Usage/General.aspx are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners.

Contents

Trainer information

Thank you for taking time to support the whiteboard design sessions as a trainer!

Role of the trainer

An amazing trainer:

Whiteboard design session flow

Each whiteboard design session uses the following flow:

Step 1: Review the customer case study (15 minutes)

Outcome

Analyze your customer’s needs.

Step 2: Design a proof of concept solution (60 minutes)

Outcome

Design a solution and prepare to present the solution to the target customer audience in a 15-minute chalk-talk format.

Step 3: Present the solution (30 minutes)

Outcome

Present solution to your customer:

Wrap-up (15 minutes)

Before the whiteboard design session: How to prepare

Before conducting your first whiteboard design session:

During the whiteboard design session: Tips for an effective whiteboard design session

Refer to the Trainer guide to stay on track and observe the timings.

Do not expect to memorize every detail of the whiteboard design session.

When participants are doing activities, you can look ahead to refresh your memory.

Have fun! Encourage participants to have fun and share!

Involve your participants. Talk and share your knowledge but always involve your participants, even while you are the one speaking.

Ask questions and get them to share to fully involve your group in the learning process.

Ask first, whenever possible. Before launching into a topic, learn your audience’s opinions about it and experiences with it. Asking first enables you to assess their level of knowledge and experience, and leaves them more open to what you are presenting.

Wait for responses. If you ask a question such as, “What’s your experience with (fill in the blank)?” then wait. Do not be afraid of a little silence. If you leap into the silence, your participants will feel you are not serious about involving them and will become passive. Give participants a chance to think, and if no one answers, patiently ask again. You will usually get a response.

Azure Stack Migrate whiteboard design session student guide

Abstract and learning objectives

In this whiteboard design session, you will work with a group to design a hybrid cloud architecture using a combination of the Azure public cloud and Azure Stack. This functional architecture will enable customers to leverage their investments in Azure as a “cloud platform,” rather than Azure as a “place.”

At the end of the session, you will be able to determine which systems are good candidates for the Azure public cloud, and which are better suited on Azure Stack.

Step 1: Review the customer case study

Outcome

Analyze your customer’s needs.

Timeframe: 15 minutes

Directions: With all participants in the session, the facilitator/SME presents an overview of the customer case study along with technical tips.

  1. Meet your table participants and trainer.

  2. Read all of the directions for steps 1-3 in the student guide.

  3. As a table team, review the following customer case study.

Customer situation

Contoso Finance is one of the largest banks in the United States with a significant amount of their revenue coming from their residential mortgage business. Their mortgage business is headquartered in Dallas, Texas. During a meeting with the newly appointed CTO Doreen Newton, the IT team learned that Contoso is shifting to a cloud first strategy after seeing firsthand the advantages of the cloud from Doreen’s previous role leading her prior company through a digital transformation. Her message, “I have seen how applications and infrastructures are deployed and run using Microsoft Azure with both PaaS and IaaS services. These capabilities can transform Contoso with more agility and long-term cost effectiveness.” resonated with other members of the IT organization.

Contoso’s current workloads run in their Dallas based datacenter using VMWare based virtual machines. One of the primary applications the company is interested in modernizing to take advantage of the cloud is a consumer facing mortgage application. This application is handling new mortgage requests and facilitating access of consumers to their current mortgage information. The current implementation of the mortgage application is hosted in a public facing website on Microsoft Internet Information Server (IIS) with a backend database using SQL Server 2012. The application has several modules that run as Windows Services. These modules are responsible for running credit checks and generating PDFs for transactions. The application uses Microsoft Message Queue (MSMQ) for interacting between modules. The application also allows customers to download several publicly accessible PDF files that provide an overview of the bank’s mortgage related products.

As the result of a recent acquisition of a financial analytics company named Fabrikam, based in Houston, Texas, Contoso IT management team plans to integrate a number of Fabrikam’s internally developed applications to process and analyze the customer data being used by the Contoso’s customer facing mortgage application. Fabrikam has skilled development and infrastructure teams, with extensive Azure experience and its own Azure Active Directory tenant. Contoso is very interested in leveraging that experience and plans to offer the Fabrikam IT team sufficient level of autonomy when working on the integration tasks. That autonomy should include the ability of the Fabrikam IT team to offer to their users cloud resources required for application development, implementation, and maintenance. At the same time, Contoso wants to ensure proper governance and facilitate implementation of corporate standards via centralized control of the service catalog content and through automation.

During the planning stages, Contoso realized they would not be able to move their customer, on-premises resident data to US based Azure regions due to corporate compliance policies and regulatory issues. “This was a cause for great concern, as this means Contoso may not be able to move to cloud-based services as fast as we initially envisioned” says Max Rubin, VP of Network Engineering. Doreen Newton took on the challenge to investigate alternatives to allow Contoso to proceed with getting the benefits of the cloud while not breaking rules for corporate compliance.

To help design a solution using Azure technologies, Contoso has engaged a Microsoft Cloud Partner and Service Provider FusionTomo (FT). FT is a full-service hosting provider in North America certified to deliver Azure services with connectivity solutions and partnerships to provide ExpressRoute and other telecom services. They have datacenters located in Denver, London, Las Vegas, Dallas and Hong Kong SAR.

Contoso has expressed to FT the need to embrace Microsoft Azure technologies as well as technologies that will help their organization with a more agile continuous integration and continuous deployment model for application deployment. Contoso also underscored the need for cooperation with Fabrikam’s integration teams, including the intent to delegate some of the infrastructure management tasks.

With these goals in mind, Contoso has challenged FT to implement a hosted environment that will accommodate requirements regarding integration work to be carried out by Fabrikam. In addition, as internal workloads are transitioned to the hosting environment, Contoso’s internal audit team must retain its ability to track all of the infrastructure changes. For compliance purposes, the delegation model that will provide Contoso and Fabrikam staff with insight into the hosted environment must comply with the principle of least privilege. To satisfy Contoso governance requirements, FT must document standard operating procedures that will be carried out within the hosted infrastructure.

The Contoso Dallas Data Center diagram shows the flow between Contoso Mortgage customers and Contoso’s web servers, application servers, and SQL servers.

Customer needs

Contoso is looking for FT to provide the following for their expansion into North America:

  1. Design a hybrid-cloud architecture that is native Azure end-to-end without the need for hosting the application in a Contoso owned datacenter.

  2. The design should ensure that customer data is not stored in the Azure Cloud while also allowing future applications to be easily deployed in Azure with access to custom data regardless of where they are deployed.

  3. Deploy the application in a secure manner as to allow for the frontend applications to access the backend customer data.

  4. Establish direct connectivity from the new regional headquarters in Dallas to the deployments. This will allow communication with existing systems and reporting until the rest of Contoso’s services are moved to Azure in the future.

  5. Allow for a consistent application deployment model using Azure ARM templates and CI/CD.

  6. Detail the taxonomy that will be leveraged for the hybrid-cloud including the Resource Providers (RP) This includes tenants, regions, subscriptions, offers, plans, services and quotas.

  7. Design an integration model that would allow resource access for both Contoso and Fabrikam users.

  8. Propose a self-service approach that will allow Contoso and Fabrikam developers to provision their own resources from the service catalog offered by infrastructure teams. The scope of resources available in service catalog must be controlled centrally, with an oversight by designated Contoso and Fabrikam administrators.

  9. Recommend a procedure for delegation of permissions that would not only allow designated Fabrikam IT admins to manage Contoso infrastructure but also account for the need to provide limited access to the Contoso internal audit team.

  10. Suggest a methodology that would facilitate implementing corporate standards by automating the process of resource provisioning and configuration.

  11. Document standard operational tasks such as infrastructure backup and log collection.

Customer objections

  1. The Mortgage SQL DB cannot be hosted in the public cloud.

  2. Contoso staff is already stretched thin, so minimizing patching of systems and day-to-day management is very important.

  3. The developer team acknowledges that the existing application architecture is designed for running on Windows Virtual Machines, but PaaS is the future they envision. How can they move this application forward?

  4. One of the key reasons Contoso wants to go to the cloud is to take advantage of tools and services for automated deployments and application development. Will Azure Stack make it to where we must use two skillsets?

  5. Fabrikam already has its own Azure Active Directory tenant. Will it be necessary to create duplicate accounts for Fabrikam users?

Infographic for common scenarios

In the Infographic for Common scenarios, Microsoft Azure (public) is connected to the Microsoft Azure Stack (private / hosted) through Developers and IT.

Step 2: Design a proof of concept solution

Outcome

Design a solution and prepare to present the solution to the target customer audience in a 15-minute chalk-talk format.

Timeframe: 60 minutes

Business needs

Directions: With all participants at your table, answer the following questions and list the answers on a flip chart:

  1. Who should you present this solution to? Who is your target customer audience? Who are the decision makers?

  2. What customer business needs do you need to address with your solution?

Design

With all participants at your table, respond to the following questions on a flip chart:

Design a hybrid-cloud architecture using Azure services that will make up the implementation for Contoso.

  1. Identify the overall application design you would propose for modernizing their existing application into Azure.

  2. List the services and components that will be deployed to Azure public cloud. For each, provide their basic function in the system. Determine which Azure Region will be best suited for the deployment.

  3. List the services and components that will be deployed to Azure Stack. For each, provide their basic function in the system.

  4. Determine which identity provider and which identity topology you will use to facilitate authentication and authorization of the Azure Stack environment.

  5. Describe different delegation mechanisms can be employed to facilitate controlled access to Azure Stack resources.

  6. Establish which common infrastructure management tasks must be implemented and maintained by designated Azure Stack operators.

  7. Identify how applications such as the Mortgage App and other infrastructure workloads could be deployed in a consistent manner between Azure Public and Azure Stack.

  8. Plan and document Azure Stack taxonomy for this deployment.

  9. Create a network design.

Prepare

Directions: With all participants at your table:

  1. Identify any customer needs that are not addressed with the proposed solution.

  2. Identify the benefits of your solution.

  3. Determine how you will respond to the customer’s objections.

Prepare a 15-minute chalk-talk style presentation to the customer.

Step 3: Present the solution

Outcome

Present a solution to the target customer audience in a 15-minute chalk-talk format.

Timeframe: 30 minutes

Presentation

Directions:

  1. Pair with another table.

  2. One table is the Microsoft team and the other table is the customer.

  3. The Microsoft team presents their proposed solution to the customer.

  4. The customer makes one of the objections from the list of objections.

  5. The Microsoft team responds to the objection.

  6. The customer team gives feedback to the Microsoft team.

  7. Tables switch roles and repeat Steps 2-6.

Wrap-up

Time frame: 15 minutes

Directions: Tables reconvene with the larger group to hear the facilitator/SME share the preferred solution for the case study.

Additional references

Description Links
Azure Stack overview https://azure.microsoft.com/en-us/overview/azure-stack/
Azure Stack use cases https://azure.microsoft.com/en-us/overview/azure-stack/use-cases/
Azure Stack features https://docs.microsoft.com/en-us/azure/azure-stack/azure-stack-key-features
Azure Stack planning considerations https://docs.microsoft.com/en-us/azure/azure-stack/azure-stack-planning-considerations
Azure Stack documentation https://docs.microsoft.com/en-us/azure/azure-stack/
Azure Stack Operator documentation https://docs.microsoft.com/en-us/azure/azure-stack/
Azure Stack networking https://docs.microsoft.com/en-us/azure/azure-stack/user/azure-stack-network-overview/
Azure Stack to Azure Global VPN https://docs.microsoft.com/en-us/azure/azure-stack/azure-stack-connect-vpn
Register Azure Stack with your subscription https://docs.microsoft.com/en-us/azure/azure-stack/azure-stack-register
Deploy the Azure App Service resource provider https://docs.microsoft.com/en-us/azure/azure-stack/azure-stack-app-service-deploy
Deploy the Azure Stack SQL resource provider https://docs.microsoft.com/en-us/azure/azure-stack/azure-stack-sql-resource-provider-deploy#deploy-the-resource-provider
Deploy apps to Azure and Azure Stack https://docs.microsoft.com/en-us/azure/azure-stack/user/azure-stack-solution-pipeline
Azure Stack: An extension of Azure https://azure.microsoft.com/en-us/resources/azure-stack-an-extension-of-azure/
PowerShell for Azure Stack https://docs.microsoft.com/en-us/azure/azure-stack/user/azure-stack-powershell-install
Azure Stack marketplace https://docs.microsoft.com/en-us/azure/azure-stack/azure-stack-marketplace-azure-items
Azure Stack Identity Architecture https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-identity-architecture
Delegate offers in Azure Stack https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-delegated-provider

Azure Stack Migrate whiteboard design session trainer guide

Step 1: Review the customer case study

Step 2: Design a proof of concept solution

Step 3: Present the solution

Wrap-up

Preferred target audience

Preferred solution

After being engaged by Contoso and gathering the requirements from the client, FT has put forward a design which embraces the Azure platform and DevOps for development and deployment, as well as addresses multi-tenant identity and data sovereignty requirements discovered by Contoso (no customer data in the public cloud). The solution consists of using Azure public cloud in the South-Central Region and Azure Stack running in a FT Dallas datacenter.

Both Traffic manager and VPN connect Azure Public (South Central) with the Azure Stock FusionTomo Dallas Datacenter, which in turn connects via VPN to On-Premises.

Design a hybrid-cloud architecture using Azure services that will make up the implementation for Contoso:

  1. Identify the overall application design you would propose for modernizing their existing application into Azure.

  2. List the services and components that will be deployed to Azure public cloud. For each, provide their basic function in the system. Determine which Azure Region will be best suited for the deployment.

  3. List the services and components that will be deployed to Azure Stack Cloud. For each, provide their basic function in the system.

  4. Determine which identity provider and which identity topology you will use to facilitate authentication and authorization of the Azure Stack environment.

    In order to facilitate authentication and authorization requirements (and given the cloud first strategy embraced by Contoso), FT will implement Azure Active Directory as the identity provider in the multi-tenant topology, with the Contoso Azure Active Directory serving as the primary tenant (providing access to both the Azure Stack Admin and User portal) and the Fabrikam Azure Active Directory serving as a guest tenant (allowing its users to access the Azure Stack User portal only).

  5. Describe different delegation mechanisms can be employed to facilitate controlled access to Azure Stack resources.

    FT will rely on the two primary delegation mechanisms in order to accommodate the need to provide restricted access to the Azure Stack environment:

  6. Establish which common infrastructure management tasks must be implemented and maintained by designated Azure Stack operators.

    FT will be responsible for implementing the following common Azure Stack management tasks:

  7. Identify how applications such as the Mortgage App and other infrastructure workloads could be deployed in a consistent manner between Azure public cloud and Azure Stack.

    Azure Resource Manager templates can be used to deploy supported services to both Azure public cloud and Azure Stack.

    A hybrid continuous integration/continuous delivery(CI/CD) pipeline enables you to build, test, and deploy your app to multiple clouds. A hybrid CI/CD pipeline can help you:

  8. Plan and Document Azure Stack Taxonomy for this deployment.

    The Azure Stack Taxonomy displays as previously described.
  9. Create a networks design.

    Design Network connectivity between the Contoso Regional HQ in Dallas to Azure and Azure Stack that will allow future applications to be deployed in the public cloud or Azure Stack and still provide connectivity to customer or On-Premises data.

Checklist of preferred objection handling

  1. The Mortgage SQL DB cannot be hosted in the public cloud.

    Potential Answer:

    The SQL Database containing the customer information will be hosted in Azure Stack in the FT datacenter. This will require the SQL DB Resource Provider to be running on Azure Stack. The data will never reside in the Azure Global Cloud.

  2. Contoso will have a very limited staff to manage the US based operations, so minimizing patching of systems and day-to-day management is very important.

    Potential Answer:

    All of the services that are used for this application in both Azure Global and Azure Stack leverage PaaS services. As a result, there is very limited need for management of the platforms beyond the application.

  3. The developer team acknowledges that the existing application architecture is designed for running on Windows Virtual Machines, but PaaS is the future they envision. How can they move this application forward?

    Potential Answer:

    The application code base can be modernized by converting the Windows Services to Azure Functions, messaging based code could use Azure Storage Queues or Service Bus, and code that reads and writes from the file system could be updated to use Azure Storage. Finally, application code that writes to SQL Server could be updated to use SQL Database.

  4. One of the key reasons Contoso wants to go to the cloud is to take advantage of tools and services for automated deployments and application development. Will Azure Stack make it to where we must use two skillsets?

    Potential Answer:

    While there will be minor differences with connectivity/environment information, if the resources are supported in both clouds, the developer and tooling experience will be consistent.

  5. Fabrikam has already its own Azure Active Directory tenant. Will it be necessary to create duplicate accounts for Fabrikam users?

    Potential Answer:

    There is no need for creating duplicate accounts for Fabrikam users. When using Azure Active Directory as the identity provider, Azure Stack supports multi-tenant topology. Once implemented, the topology allows users from different Azure Active Directory tenants provision and access Azure Stack offers directly from the Azure Stack User portal. If there is a need for a Fabrikam IT staff to access the Azure Stack Admin portal, this can be accomplished by inviting that user into Contoso Azure Active Directory tenant and using Role Based Access Control to implement authorization. When using Active Directory Federation Services (AD FS) as the identity provider, multi-tenancy can be provided through federation trusts.

Customer quote (to be read back to the attendees at the end)

“Our plans to enter the North American Mortgage market were enabled by our Partner, FusionTomo helping us to leverage our investment in Azure as a platform with Azure Stack. We can move forward with our project timelines.”