Azure Active Directory (Azure AD), part of 

, is an enterprise identity service that provides single sign-on, multifactor authentication, and conditional access to guard against cybersecurity attacks.

a cloud-based identity and access management service

. Azure AD enables employees access external resources, such as Microsoft 365, the Azure portal, and thousands of other SaaS applications.

Azure Active Directory comes in four editions

The hub is a virtual network in Azure that acts as a central point of connectivity to your on-premises network. The spokes are virtual networks that peer with the hub and can be used to isolate workloads. Traffic flows between the on-premises data center(s) and the hub through an ExpressRoute or VPN gateway connection.

The hub and spoke topology is a network design where we have a central device (the hub) that is connected to multiple other devices (the spokes). This is a cost effective solution except the hub is a single point of failure. One example of where we can use a hub and spoke topology is in a frame-relay network.

The original Visio file can be found here as I cleaned it up in my version here: 
https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli 


The Azure hub and spoke topology network design

Azure Hub-Spoke Network

In today's environment of "hybrid workfroce", providing capabilities of a secure remote desktop and application access virtually anywhere experience for employees.

I've seen many companies since 2020 look to modernize their 

 (VDI) or considering new ways of working by assessing how to bring resilience to an organization.

" to internal and external employees/consultants, and is often delivered through 

 (RDS). However, on-premises RDS solutions does not realize the full benefits and modernization that cloud desktop virtualization enables.

By migrating a Citric VDI, one can realize the benefits of modernization, including:

Improved security posture via built-in/integrated Azure Virtual Desktop security features

Reduced hardware and infrastructure costs, lowering overall capital expenditure

Simplified management that allows you to deploy and scale within minutes to meet your business needs

A seamless experience optimized for Windows 10 and Microsoft 365 apps, including Microsoft Teams

If Azure Virtual Desktop runs alongside the Citrix Virtual Apps and Desktops service, you take advantage of unified managemet

We first consider the prerequisites to migrate existing virtual machines (VMs) to Azure as well as those needed for the 

control plane, deploy and manage virtual desktops and applications within 

, and still embrace any existing on-premises resources.

We need to capture the management responsibilities of each party as we plan migrations. When running the 

is responsible for all components within the cloud control plane, including updates, reducing management responsibilities, and allowing operation teams to focus more on strategic imperatives. 

Our architecture foundation is based upon 

providing the underlining infrastructure, including compute, storage, and network, within 

is responsible for core desktop virtualization management, including the broker, gateway, management, diagnostics, load balancing, and client. Like a native

 deployment, a person/org is responsible for the desktop and remote apps, and management and policies.

 control plane enables the central management and orchestration of virtual desktops and apps in 

Depending on the OS selected, appropriate licenses for users connecting to the desktops and applications are also required. Ensure all users who are allowed access to these resources within the Citrix Virtual Apps and Desktops service have the required license.

RDS Client Access License (CAL) with Software Assurance

Windows 10 Enterprise multi-session or Windows 10 Enterprise:

As part of any migration journey to Azure, we must assess the on-premises workloads to measure cloud readiness, identify risks, and estimate costs and complexity.

We decide whether to run an assessment using sizing criteria based on server configuration data/metadata that's collected as-is on-premises, or on dynamic performance data.

 Assess based on server configuration data/metadata.

 Assess based on collected dynamic performance data.

: Whether VMs are suitable for migration to Azure.

: The estimated monthly compute and storage costs for running the VMs in Azure.

: Estimated costs for disk storage after migration.

If you discovered servers using the appliance, select 

Servers discovered from Azure Migrate appliance

If you discovered servers using an imported CSV file, select 

, set the necessary values or retain the default values such as Target and pricing settings.

Select the appliance, and select the VMs you want to add to the group. Then select 

, review the assessment details, and select 

 to create the group and run the assessment.

After the assessment is created, view it in 

For performance-based assessments, it's recommend to wait at least a day after starting discovery before creating an assessment. This provides time to collect performance data with higher confidence. Ideally, after starting discovery, wait for the performance duration you specify (day/week/month) for a high-confidence rating.

, select an assessment to open it. As an example (estimations and costs, for example, only)

Review the assessment summary. You can also edit the assessment properties, or recalculate the assessment.

: Used when Azure Migrate recommends a VM size and cost estimates, for VMs in the assessment.

: Shows issues and suggested remediation.

: Used when Azure Migrate can't assess readiness, because of data availability issues.

 status. You can view VM readiness details. You can also drill down to see VM details, including compute, storage, and network settings.

The assessment summary shows the estimated compute and storage cost of running VMs in Azure.

Review the monthly total costs. Costs are aggregated for all VMs in the assessed group.

Cost estimates are based on the size recommendations for a machine, its disks, and its properties.

Estimated monthly costs for compute and storage are shown.

The cost estimation is for running the on-premises VMs on Azure VMs. The estimation doesn't consider PaaS or SaaS costs.

Review monthly storage costs. The view shows the aggregated storage costs for the assessed group, split over different types of storage disks.

Drill down to see cost details for specific VMs.

Azure Migrate assigns a confidence rating to performance-based assessments. Rating is from one star (lowest) to five stars (highest). The confidence rating helps estimate the reliability of size recommendations in the assessment. The rating is based on the availability of data points needed to compute the assessment.

81%-100% (5-stars) is a good target to look for

Migration Guide for Citrix to Azure Virtual Desktop

 I recently finished a project that required replacement of an on-prem version of Mashery or take the path of the Tibco Cloud API Management. I ended up pushing towards Azure based on cost savings and ability to meet requirements.

Azure API Management (APIM) and Tibco's Mashery are in the business capability category of 

"Full API Lifecycle Management and API Hub/Gateway"

- Sign In and discover new APIs from our open data commons of RESTful APIs or contributed from our open source I/O Docs GitHub Project

- Developer Connect matches API developers with API projects.

- The Mashery API Status monitor provides this transparency with third-party real-time and historical performance issues.

Azure provides a Hybrid, multi-cloud management platform for APIs with a single place for managing APIs. It is classified as a platform-as-a-service, and supports the complete API lifecycle. 

You can use API Management to provide a Gateway to any service residing on-premise, in a container or cloud (back-end services). It can help you securely expose your APIs to third parties, partners or internally.

 - administrative interface where you set up API program to:

Set up policies like quotas or transformations on the APIs.

Accepts API calls and routes them to your backends

Verifies API keys, JWT tokens, certificates, and other credentials

Transforms your API on the fly without code modifications.

Logs call metadata for analytics purposes.

 - serves as the main web presence for developers to:

Try out an API via the interactive console.

Create an account and subscribe to get API keys.

 - works well out of the box, while a little rough around the edges and provides a fairly nice UI for externalizing APIs. Developers can register themselves and request and manage subscriptions to products/APIs. The site is customizable though that process cumbersome. The sign-up process even has customizable email templates for verification.

- there are tons of customizations that are possible through API policies. This could be transforming XML to JSON or vice versa, modifying headers, restricting parameters, redirecting to different end-points depending on the message body.

- the structure of how APIs are managed is well thought-out. It makes it quick to start standing up new APIs and versioning them. Additionally, the analytics provided are also very helpful in diagnosing possible bottlenecks or unusual usage.

- the upfront cost is flexible. If you're just starting out with API management, it can be an expensive proposition. Value increases as you add additional APIs. If you're using Azure B2C for the developer portal, you'll require Standard or Premium since they support AAD integration however it's only identity-based tokens.

 - at time of writing, APIM doesn't support breaking out operations to products. For example, if you have an API that has a GET and a POST operation, and you want the POST operation to require a different subscription. There is a work around, but it makes management a bit messy.

 - it's a bit strange at first. Microsoft hasn't migrated all the publisher portal functionality into the "native" Azure portal. So some of it feels a little weird - especially when working with the content management side of things for the developer portal.

- while it's easy to scale up, the cost of APIM ramps up very quickly and you will want to have budget alerts setup. Standard -> Premium is a 4x jump.

These are a few of the notible alternatives to Azure and Tibco.

- API management, design, analytics, and security are at the heart of modern digital architecture. The Apigee intelligent API platform is a complete solution for moving business to the digital world.

- Aimed at people using .NET running a micro services/service oriented architecture that need a unified point of entry into their system. However it will work with anything that speaks HTTP and run on any platform that ASP.NET Core supports. It manipulates the HttpRequest object into a state specified by its configuration until it reaches a request builder middleware where it creates a HttpRequestMessage object which is used to make a request to a downstream service.

also known as an API Gateway, or API Middleware)

. Kong controls layer 4 and 7 traffic and can be extended via Plugins that provide extra functionality and services beyond the core platform.

How I replaced Tibco Mashery With Azure API Management

Replacing Mashery With Azure API Management

I orchestrated a transition from legacy on-prem data center to Azure and M365 while adhering to strict industry regulations in Healthcare. The transition-state architecture included a Hybrid-cloud deployment model with on-prem data centers while integrating a new Identity Management system.

Reduce time to market by avoiding manual migration and minimizing custom development.

Orchestrating a transition from legacy on-premise data center to Azure and M365

Digital Transformation Journey to The Cloud

Involved replace of Mashery using Azure API Management.

Involved replacement of Mashery using Azure API Management.

Replaced Mashery With Azure API Management

A client was hosting a Citrix solution in a 3rd party on-premises datacenter and was looking to modernize that solution by leveraging the Microsoft Azure cloud. I led the design, planning, and migration of the on-premises solutions to the Azure cloud and provided on-going managed support services.

The migration of Citrix VDI to Azure Virtual Desktop

Migration of Citrix to Azure Virtual Desktop

Cloud computing architecture refers to the components and subcomponents required for cloud computing. These components typically consist of a front end platform, back end platforms, a cloud based delivery, and a network. Combined, these components make up cloud computing architecture. 

Cloud Architecture

Cloud computing is the on-demand availability of computer system resources, especially data storage and computing power, without direct active management by the user. Large clouds often have functions distributed over multiple locations, each of which is a data center.

Cloud Computing

Cloud services are application and infrastructure resources that exist on the Internet. Third-party providers contract with subscribers for these services, allowing customers to leverage powerful computing resources without having to purchase or maintain hardware and software.

Cloud Services

Cloud monitoring is the practice of measuring, evaluating, monitoring, and managing workloads inside cloud tenancies against specific metrics and thresholds. It can use either manual or automated tools to verify the cloud is fully available and operating properly.

Cloud Monitoring

Multifactor authentication is a layered approach to securing data and applications where a system requires a user to present a combination of two or more credentials to verify a user's identity for login.

Multi-factor authentication is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more pieces of evidence to an authentication mechanism: knowledge, possession, and inherence.

Multi-Factor Authentication

Microsoft Azure, often referred to as Azure, is a cloud computing platform run by Microsoft, which offers access, management, and development of applications and services through global data centers.

Azure

Cyber security can be described as the collective methods, technologies, and processes to help protect the confidentiality, integrity, and availability of computer systems, networks and data, against cyber-attacks or unauthorized access.

Cyber Security

Cloud networking is a type of IT infrastructure in which some or all of an organization's network capabilities and resources are hosted in a public or private cloud platform, managed in-house or by a service provider, and available on demand.
Companies can either use on-premises cloud networking resources to build a private cloud network or use cloud-based networking resources in the public cloud, or a hybrid cloud combination of both. These network resources can include virtual routers, firewalls, and bandwidth and network management software, with other tools and functions available as required.

Cloud Networking

Cryptography is the practice and study of techniques for secure communication in the presence of adversarial behavior and is about constructing and analyzing protocols that prevent third parties or the public from reading private messages.

Cryptography

A modern workplace is characterized by a combination of technological, physical, and psychological factors aimed at balancing employee satisfaction and business efficiency. The definition of a modern workplace is constantly evolving to meet the changing needs of both employees and businesses.

Modern Workplace

Cloud Infrastructure is the collection of hardware and software elements such as computing power, networking, storage, and virtualization resources needed to enable cloud computing. Cloud infrastructure types usually also include a user interface (UI) for managing these virtual resources.

Cloud Infrastructure

Cloud security is a collection of procedures and technology designed to address external and internal threats to business security. Organizations need cloud security as they move toward their digital transformation strategy and incorporate cloud-based tools and services as part of their infrastructure.

Cloud Security

In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Compliance has traditionally been explained by reference to the deterrence theory, according to which punishing a behavior will decrease the violations both by the wrongdoer and by others

Everyday is great to be alive!

Contact Me

Technology Details

TECHNOLOGY SELECTED:

Additional Info

Category:

Product Name: