Microsoft Azure Security – Study Notes

A collection of all my study notes and lab work while working towards passing the badge Microsoft Certified Security Engineer Associate by passing the AZ-500 exam

These notes are in no order and are not focused towards any exam content other than sharing my experience of configuring and automating security within Azure in the run up to the final exam.

  1. Azure – Setup Azure Blueprints
  2. Azure – Advisor
  3. Azure – AD Identity Protection
  4. Azure – Install and Configure Antimalware On A Virtual Machine
  5. Creating Security Baselines In Microsoft Azure
  6. Azure – Log Analytics Workspace and AzureVirtual Machine Agent Install
  7. Azure – Access Control and Role Assignment
  8. Azure – Configure Management Locks – Prevent Accidental Deletion Of Core Resources
  9. AZURE – Control Storage Access by Networks
  10. Azure – Update Management
  11. Azure – Monitoring Alert On Virtual Machine CPU Usage
  12. Azure – Register An Application in AD and Generate App Password
  13. Azure – Activity Log
  14. Azure – Route Tables – How To Force Traffic Down A Specific Route
  15. Azure – Content Trust in ACR and Roles
  16. Azure – Creating Key Vaults
  17. Azure – Create Kubernetes Cluster with ACR Integration
  18. Azure – Monitor / Alerts – Create Action Group to Notify Admin/User by SMS & Email
  19. Azure – Security Center and Pricing
  20. Azure Conditional Access Policies – Greyed Out
  21. Azure – Configure Web App Custom Domain and TLS
  22. Azure – Configure Web App and Licenses
  23. AZ-500: Microsoft Azure Security Technologies – EXAM PASSED!!!

Azure – Create Kubernetes Cluster with ACR Integration

How to create a Kubernetes Cluster with ACR Integration and Service Principal Authentication.

Create Kubernetes Cluster, Select the Kubernetes Services Blade> Cloud Shell

You will be prompted for storage if not already configured

Type “az” to use Azure CLI

Run script from Microsoft docs here

Create a new AKS cluster with ACR integration. If you haven’t got a service principal created, skip to the next section before creating the AKS cluster

# set this to the name of your Azure Container Registry. It must be globally unique

$MYACR=myContainerRegistry

# Run the following line to create an Azure Container Registry if you do not already have one

az acr create -n
$MYACR -g myContainerRegistryResourceGroup –sku basic

# Create an AKS cluster with ACR integration

az aks create -n myAKSCluster -g myResourceGroup –generate-ssh-keys –attach-acr
$MYACR

To configure Registry authentication service principals – MS doc guide to create Service Principal, (script is formatted for the Bash shell)

Create a service Principal

#!/bin/bash
# Modify for your environment.
# ACR_NAME: The name of your Azure Container Registry
# SERVICE_PRINCIPAL_NAME: Must be unique within your AD tenant
ACR_NAME=<container-registry-name>
SERVICE_PRINCIPAL_NAME=acr-service-principal
# Obtain the full registry ID for subsequent command args
ACR_REGISTRY_ID=$(az acr show --name
				$ACR_NAME --query id --output tsv)
# Create the service principal with rights scoped to the registry.
# Default permissions are for docker pull access. Modify the '--role'
# argument value as desired:
# acrpull:     pull only
# acrpush:     push and pull
# owner:       push, pull, and assign roles
SP_PASSWD=$(az
				ad
				sp create-for-rbac --name http://$SERVICE_PRINCIPAL_NAME --scopes $ACR_REGISTRY_ID --role acrpull --query password --output tsv)
SP_APP_ID=$(az
				ad
				sp
				show --id http://$SERVICE_PRINCIPAL_NAME --query appId --output tsv)
# Output the service principal's credentials; use these in your services and
# applications to authenticate to the container registry.
echo "Service principal ID: $SP_APP_ID"
echo "Service principal password: $SP_PASSWD"

The author does not verify any of the scripts are test and everything should be done in Dev only.

AZ-103: Microsoft Azure Administrator – EXAM PASSED!!!

Jan 16, 2020

AZ-103: Microsoft Azure ADMINISTRATOR

EXAM PASSED!!!

#Azure #Administrator #CertifiedProfessional #MicrosoftAzure #MicrosoftCloud #Microsoft #alwaysbelearning #AZ103 #EXAM #PASSED