AZ-600 Configuring and Operating a Hybrid Cloud with Microsoft Azure Stack Hub Questions and Answers

Box 1: 3

3 registered, and one in need of an update.

Note: Update the Azure Stack Hub directories

When an Azure Stack Hub directory update is required, a status of Update Required is shown. For example:

Graphical user interface, application Description automatically generated

To update the directory, select the Directory name checkbox, and then select Update.

Box 2: global administrator of ITHCSubAS2021.onmicrosoft.com

The guest directory ITHCSubAS2021.onmicrosoft.com needs an update.

Update the guest directory

An Azure Stack Hub operator should also inform the guest directory owner that they need to update their directory by using the URL shared for registration.

Instead: Solution: From a privileged endpoint (PEP) session, you run the Install-AzsUpdate cmdlet.

You can use the Azure Stack Hub administrative endpoints to monitor and manage your updates. They're accessible with PowerShell. For instructions on getting set up with PowerShell on Azure Stack Hub.

You can use the following PowerShell cmdlet to manage your updates:

* Install-AzsUpdate

Apply a specific update at an update location.

Step 1: Connect to the Hardware Lifecycle Host (HLH)

Create the OAW VM using a script

The following script prepares the virtual machine as the Operator Access Workstation (OAW), which is used to access Microsoft Azure Stack Hub.

• Sign in to the HLH with your credentials. (Step 1)
• Download OAW.zip and extract the files. (Step 2)
• Open an elevated PowerShell session. (Step 3)
• Navigate to the extracted contents of the OAW.zip file.
• Run the New-OAW.ps1 script.

Step 2: From microsoft.com, download the OAW.zip file and extract the contents

Download files

Because of the stateless nature of the solution, there are no updates for the OAW VM. For each milestone, a new version of the VM image file is released. Use the latest version to create a new OAW VM. The image file is based on the latest Windows Server 2019 version. After installation, you can apply updates, including any critical updates, using Windows Update.

Validate the hash of the downloaded OAW.zip file to make sure it hasn't been modified before using it to create the OAW VM.

Step 3: From an elevated PowerShell session, run the New-OAW.ps1 script.

Graphical user interface, text, application Description automatically generated

Step 1: Run Get-AzsRegistrationToken

Change the Azure Stack Hub integrated system registration to use an Azure subscription named Subscription3 that has a GUID of 12345678-1234-1234-1234-222222222222.

Get-AzsRegistrationToken

Get-AzsRegistrationToken generates a registration token from the input parameters.

To register the Azure Stack Hub resource provider with Azure, start PowerShell ISE as an administrator and use PowerShell cmdlets with the EnvironmentName parameter set to the appropriate Azure subscription type.

Step 2: Run the Register-AszEnvironment cmdlet and specify the –RegistrationToken $Token parameter.

Step 3: Run the Select-AzSubscription cmdlet and specify the –Subscription 12345678-1234-1234-1234-222222222222 parameter.

To change the azure subscription using PowerShell, we can use the Select-AZSubscription command. When you use this command, you can use either the subscription ID, Subscription Name, or the Tenant ID.

Step 4: Run Set-AszRegistration.

Before proceeding, in the same PowerShell session, verify again that you're signed in to the correct Azure PowerShell context.

This context is the Azure account that was used to register the Azure Stack Hub resource provider. In the same PowerShell session, run the Set-AzsRegistration cmdlet:

$CloudAdminCred = Get-Credential -UserName -Message "Enter the cloud domain credentials to access the privileged endpoint."

$RegistrationName = ""

Set-AzsRegistration `

-PrivilegedEndpointCredential $CloudAdminCred `

-PrivilegedEndpoint `

-AgreementNumber `

-BillingModel Capacity `

-RegistrationName $RegistrationName

Integrate Azure Stack Hub with monitoring solutions using syslog forwarding

The syslog channel exposes audits, alerts, and security logs from all the components of the Azure Stack Hub infrastructure. Use syslog forwarding to integrate with security monitoring solutions and to retrieve all audits, alerts, and security logs to store them for retention.

Cmdlets to configure syslog forwarding

Configuring syslog forwarding requires access to the privileged endpoint (PEP). Two PowerShell cmdlets have been added to the PEP to configure the syslog forwarding:

### cmdlet to pass the syslog server information to the client and to configure the transport protocol, the encryption and the authentication between the client and the server

Set-SyslogServer [-ServerName ] [-ServerPort ] [-NoEncryption] [-SkipCertificateCheck] [-SkipCNCheck] [-UseUDP] [-Remove]

### cmdlet to configure the certificate for the syslog client to authenticate with the server

Set-SyslogClient [-pfxBinary ] [-CertPassword ]

Create a new cloudadmin user named User2.

Add a new Azure Stack Hub user account in Azure Active Directory (Azure AD)

Before you can test offers and plans and create resources, you'll need a user account for the Azure Stack Hub user portal. You create a user account in your Azure AD tenant, by using the Azure portal or PowerShell.

Use the Azure Stack Hub Readiness Checker tool to validate that generated public key infrastructure (PKI) certificates which are suitable for pre-deployment. Validate certificates by leaving enough time to test and reissue certificates if necessary.

The Readiness Checker tool performs the following certificate validations:

* Parse PFX

Checks for valid PFX file, correct password, and whether the public information is protected by the password.

* Expiry Date

Checks for minimum validity of seven days.

* Signature algorithm

Checks that the signature algorithm isn't SHA1.

* Private Key

Checks that the private key is present and is exported with the local machine attribute.

* Etc.

Note: Perform core services certificate validation

Use these steps to validate the Azure Stack Hub PKI certificates for deployment and secret rotation:

1. Install AzsReadinessChecker from a PowerShell prompt (5.1 or above) by running the following cmdlet:

Install-Module Microsoft.AzureStack.ReadinessChecker -Force -AllowPrerelease

2. Create the certificate directory structure.

3. Etc.

Box 1: 4

The infrastructure of the integrated system must be backed up as frequently as possible.

Enable backup for Azure Stack Hub from the administrator portal

The frequency in hours determines how often backups are created. The default value is 12. Scheduler supports a maximum of 12 and a minimum of 4.

Box 2: Azure key vault

The integrated system backups must be retained for 28 days.

Online retention policy. This specifies the time period during which daily, weekly, monthly, and yearly backups are retained in the Azure Site Recovery vault that's associated with the local MABS instance.

Graphical user interface, text, application, chat or text message Description automatically generated

Box 1: The Default Provider Subscription

A default Microsoft SQL Server instance will host the database of the App Service resource provider.

In Azure Stack Hub Subscriptions, select the Default Provider Subscription. Azure App Service on Azure Stack Hub must be deployed in the Default Provider Subscription.

Box 2:

Enter the SQL Server details for the server instance used to host the App Service resource provider database and then select Next. The installer validates the SQL connection properties.

Graphical user interface, website Description automatically generated

Graphical user interface, text, application Description automatically generated

Table Description automatically generated

When deploying Azure Stack Hub in disconnected mode it is recommended to use certificates issued by an enterprise certificate authority. This is important because clients accessing Azure Stack Hub endpoints must be able to contact the certificate revocation list (CRL).

Box 1: Administrator management endpoint

Note: The developers report high chargeback costs for the dev1 region.

Two integrated systems that are dedicated to application development and have the following configurations:

• The integrated systems are disconnected from the Internet. The workloads in the user subscriptions have Internet access.
• One integrated system has a region name of dev1, and the other has a region name of dev2.
• Both regions are used only by developers at Northwind Traders.

The request gets consumption details for the requested subscriptions and for the requested time frame. There is no request body.

This usage API is a provider API, so the caller must be assigned an Owner, Contributor, or Reader role in the provider's subscription.

Method, Request URI

GET https://{armendpoint}/subscriptions/{subId}/providers/Microsoft.Commerce.Admin/subscriberUsageAggregates?reportedStartTime={reportedStartTime} &reportedEndTime={reportedEndTime}&aggregationGranularity={granularity}&subscriberId={sub1.1}&api-version=2015-06-01-preview&continua

Arguments

* armendpoint

Azure Resource Manager endpoint of your Azure Stack Hub environment. The Azure Stack Hub convention is that the name of the Azure Resource Manager endpoint is in the format https://adminmanagement.{domain-name}. For example, for the Azure Stack Development Kit (ASDK), if the domain name is local.azurestack.external, then the Resource Manager endpoint is https://adminmanagement.local.azurestack.external.

* subId

Subscription ID of the user who makes the call.

* Etc.

Box 2: Get-AzsSubscriberUsage

Retrieve usage information

PowerShell

To generate the usage data, you should have resources that are running and actively using the system; for example, an active virtual machine (VM), or a storage account containing some data. If you're not sure whether you have any resources running in the Azure Stack Hub Marketplace, deploy a VM, and verify the VM monitoring blade to make sure it's running. Use the following PowerShell cmdlets to view the usage data:

• Install PowerShell for Azure Stack Hub.

• Configure the Azure Stack Hub user or the Azure Stack Hub operator PowerShell environment.

• To retrieve the usage data, call the Get-AzsSubscriberUsage PowerShell cmdlet:

Get-AzsSubscriberUsage -ReportedStartTime "2017-09-06T00:00:00Z"

Graphical user interface, text, application, chat or text message Description automatically generated

Step 1: Notify all the users in the int1 region and schedule a maintenance window.

Step 2: Select the subscription that was used to perform the initial registration.

Note: You need to change the int1 region to use the capacity model.

Change the billing model and registration name of the int1 region.

The int1 region runs a high number of Windows virtual machines that use pay-as-you-use images.

Change billing model, how features are offered, or re-register your instance

This section applies if you want to change the billing model, how features are offered, or you want to re-register your instance. For all of these cases, you call the registration function to set the new values. You don't need to first remove the current registration.

# select the subscription used during the registration

Select-AzSubscription -Subscription ''

# rerun registration with new BillingModel (or same billing model in case of re-registration) but using other parameters values from portal

Set-AzsRegistration -PrivilegedEndpointCredential $YourCloudAdminCredential -PrivilegedEndpoint $YourPrivilegedEndpoint -BillingModel '' -RegistrationName '' -ResourceGroupName ''

Step 3: Run the Set-AzsRegistration cmdlet.

You can use Set-AzsRegistration to register Azure Stack Hub with Azure and enable or disable the offer of items in the marketplace and usage reporting.

To run the cmdlet, you need:

A global Azure subscription of any type.

To be signed in to Azure PowerShell with an account that's an owner or contributor to that subscription.