Speaker A
[ Music ] Alexandra Zakharova: Hello, and thank you for joining me. Welcome to the second part of our second session in the AZ-900 Microsoft Azure Fundamentals Course.
Learn Azure storage options, redundancy, and identity management in this AZ-900 fundamentals session by Microsoft Learn.
Key Takeaways
- Azure storage accounts provide scalable, reliable, and secure data storage with multiple redundancy options.
- Choosing the right redundancy and access tier balances cost, availability, and performance needs.
- Azure offers diverse storage services tailored for different data types and workloads.
- Identity and access management with Microsoft Entra ID and RBAC are critical for securing Azure resources.
- Microsoft Defender for Cloud enhances security monitoring and threat protection in Azure environments.
What the video covers
- Introduction to AZ-900 Microsoft Azure Fundamentals Course and instructor background.
- Overview of Azure storage accounts and their unique namespace accessible globally via HTTP/HTTPS.
- Explanation of redundancy options including LRS, ZRS, GRS, and GZRS for data durability and availability.
- Description of Azure storage services: Blob, Disk, Queue, Files, and Tables with their use cases.
- Details on Azure storage access tiers: Hot, Cool, Cold, and Archive for cost-effective data management.
- Demonstration of creating and managing Azure Blob storage with access control and lifecycle management.
- Introduction to Azure Data Box and AzCopy for large-scale data migration and file synchronization.
- Transition to identity, access control, and security topics including Microsoft Entra ID and domain services.
- Discussion on conditional access, Azure RBAC roles, and layered security models to protect resources.
- Overview of Microsoft Defender for Cloud for security posture management and threat protection.
Chapters
- 00:00Introduction and Course Overview
- 02:22Azure Storage Accounts and Redundancy Options
- 04:39Azure Storage Services Overview
- 09:25Azure Storage Access Tiers Explained
- 11:18Demo: Creating and Managing Blob Storage
- 13:28Data Migration Tools: Azure Data Box and AzCopy
- 26:01Introduction to Azure Identity and Access Management
- 28:12Security Models, Conditional Access, and RBAC
- 31:17Microsoft Defender for Cloud and Security Posture
- 34:33Resource Organization and Cost Management
Full Transcript — Download SRT & Markdown
Speaker A
I'm Alexandra Zakharova, Senior Microsoft Technical Trainer, specializing in data and AI, and I'm excited to guide you through the next step in our learning.
Speaker A
Before we begin, let me share a little about myself. I have been teaching technology for over 10 years, I speak five languages fluently, and I have traveled to more than 50 countries.
Speaker A
If you would like to connect, you can find me on LinkedIn via aka.ms/alexandra. The AZ-900 certification is a fantastic way to demonstrate your understanding of core cloud concepts, Azure services and workloads, security and privacy in Azure, as well as pricing and support options.
Speaker A
It's designed to give you a strong foundation for working confidently with Microsoft Azure. In this part of the session, we will focus on two critical areas that every cloud professional needs to understand.
Speaker A
First, we'll dive into Azure storage, where you will learn about the different storage services available, redundancy options that ensure data durability, and strategies for managing and migrating files effectively.
Speaker A
Next, we'll move on to identity, access, and security, a cornerstone for any secure cloud environment.
Speaker A
We'll explore Entra ID authentication methods and security models that help protect resources and maintain compliance.
Speaker A
You'll see how identity management and access control work together to safeguard your applications and data.
Speaker A
By the end of this session, you will have a clear understanding of how Azure handles data storage and identity management and how these concepts fit into the broader cloud ecosystem to deliver secure, scalable, and reliable solutions.
Speaker A
So let's get started. Let's dive into our data storage, starting with storage accounts. A storage account provides a unique namespace for data in Azure storage services accessible from anywhere in the world via HTTP or HTTPS protocols.
Speaker A
An Azure storage account contains all the data objects of Azure storage services, large binary objects, blobs, files, queues, and tables.
Speaker A
Data in a storage account is protected, highly available, reliable, and scalable. When creating a storage account, you first need to choose an account type.
Speaker A
The account type influences the storage services and redundancy options, affecting the way you can use it.
Speaker A
But what do I mean by redundancy options, you might ask? Azure storage is designed to keep your data safe even when things go wrong.
Speaker A
Multiple copies of your data are always stored to protect against hardware failures, power outages, and even natural disasters.
Speaker A
This is called "redundancy," and it ensures your storage meets high availability and durability targets.
Speaker A
When you create a storage account, you choose a redundancy option. Local Redundant Storage, or LRS, keeps three copies in one data center.
Speaker A
It's cost-effective but only protects against hardware issues, not a full data center outage. Zone Redundant Storage, or ZRS, splits copies across multiple zones for extra resilience.
Speaker A
If you need even more protection, Azure offers geo-redundant options. GRS copies your data to a second region hundreds of kilometers away, while GZRS combines zone redundancy with geo-replication for the highest level of reliability and disaster recovery.
Speaker A
Microsoft recommends GZRS for apps that demand maximum consistency, resiliency, and performance. So when choosing redundancy, think about your balance between cost and availability, and pick the option that fits your scenario best.
Speaker A
Now let's visually compare our redundancy options. For regions supporting availability zones, locally redundant storage performs synchronous data replication across three Azure availability zones within the primary region.
Speaker A
Zone redundant storage replicates data within a single region across different data centers. And geo-redundant storage replicates data three times within a single physical location in the primary region using LRS.
Speaker A
Then the data is asynchronously copied to an additional physical location in a secondary region.
Speaker A
Geo-zone redundant storage copies data to three Azure availability zones in the primary region and replicates it to an additional geographical region using LRS.
Speaker A
Now that we have covered data redundancy, let's move on to data services. The Azure storage service platform includes the following data services, Azure Blob, Azure Disk, Azure Queue, Azure Files, and Azure Tables.
Speaker A
Azure Blob storage is a solution for storing objects in the cloud. It can store a large volume of data, such as text or binary data.
Speaker A
Azure Blob storage is unstructured, meaning it can contain various types of data. It can handle thousands of parallel uploads, large video or image data, constantly growing log files, and is universally accessible with an Internet connection.
Speaker A
The second type of data service is Azure Disk storage, or managed disks, which are block-level storage volumes managed by Azure for use with Azure virtual machines.
Speaker A
Essentially, they function like physical disks but are virtualized for added resilience and availability compared to physical disks.
Speaker A
With managed disks, you only need to prepare the disk, and Azure takes care of everything else.
Speaker A
The third type of storage is Azure Queue storage. It's a service for storing a large number of messages.
Speaker A
You can access messages from anywhere in the world via authenticated calls using HTTP or HTTPS.
Speaker A
A queue may contain millions of messages, up to the total capacity limit of a storage account.
Speaker A
Queues are commonly used to create a backlog of work to process asynchronously. The fourth type of data service is Azure Files, which provides fully managed shared file resources in the cloud, accessible via standard industry SMB or NFS protocols.
Speaker A
Azure Files can be simultaneously connected to cloud and on-premises deployments. SMB shares of Azure Files are available for Windows, Linux, and macOS clients, while NFS shares are available for Linux or macOS clients.
Speaker A
And finally, Azure Table storage is a service that stores non-relational structured data, also known as "structured NoSQL data," in the cloud, providing a key attribute store with a schemaless design.
Speaker A
You can use Table Storage to store flexible datasets like user data for web applications, address books, device information, or other types of metadata your service requires.
Speaker A
You can store any number of entities in a table, and a storage account may contain any number of tables up to the capacity limit of the storage account.
Speaker A
On the slide, you see the public endpoints of storage services, Blob Storage, Data Lake Storage Gen2, Azure Files, Queue Storage, and Table Storage.
Speaker A
Your storage account's flexibility doesn't stop there. It's also equipped with different access tiers tailored to accommodate a variety of data storage scenarios.
Speaker A
Azure storage gives you flexibility in access use so you can store data in the most cost-effective way.
Speaker A
These tiers are Hot, Cool, Cold, and Archive. The Hot tier is for data you use all the time, like images on a website, fast and ready whenever you need.
Speaker A
The Cool tier is for data you don't touch often but still need available, like invoices, and it's best for at least 30 days of storage.
Speaker A
Cold tier goes even further, created for data you rarely access or modify, store for at least 90 days.
Speaker A
It's cheaper to store but costs more to access. Archive is the lowest cost option for long-term storage.
Speaker A
Think backups or compliance data. It's offline, so you can't read or edit it until you rehydrate it back to an online tier.
Speaker A
This process can take up to 15 hours, so archive is for data you really don't need right away.
Speaker A
Hot is for active use, Cool and Cold for less frequent access, and Archive for long-term storage.
Speaker A
Choosing the right tier helps you balance cost and performance. Now let's jump into the Azure portal and see the storage options in action.
Speaker A
In this demo and exercise, we will create a storage blob to
Speaker A
If I want to create a storage account, I search for it. I found the storage account option, I hit "Plus" to create a new storage account, either select "Subscription" or "Resource Group" and which one I want to locate my storage account, and here I will need
Speaker A
to provide the unique storage account name. You see, from the message that just popped up, if it's already taken, I can't use this name, so it should be something unique.
Speaker A
As soon as I provide the unique name, the verification passes, we can select the region in which we want to locate our storage account, and after that select "Storage Type." You can use Gen2 for most of the scenarios, but also,
Speaker A
if you want, you can use the storage account only for files. You also have a performance option.
Speaker A
I highly recommend to use "Standard" for most scenarios, but if you want to go for premium access tier, you can, and if you go for premium, it's recommended for the block blobs, file shares, and page blobs if you need higher transaction rates
Speaker A
and very, very low latency. For most scenarios, standard is more than sufficient. You have also redundancy option, local redundant storage, geo-redundant storage, zone redundant storage, and geo-zone redundant storage.
Speaker A
In this option, it will copy our data in the region pair, and if I want, I can also decide if I want to have read access in our second region or not.
Speaker A
If I select "Make read access to data available" in the second region, it means I can also read the data in our region pair.
Speaker A
On the next step, we can select some security features like protocols that we allow or not, hierarchical namespace, if you activate it or not, if I want to have a cross-tenant replication option, and so on.
Speaker A
Very important, if you want to enable anonymous access on individual containers, you will need to activate it on this tab because by default there is no anonymous access to the content that you deploy.
Speaker A
It's done for security reasons, for sure. So if you want to access some files stored on your storage account via the public link, you will need to activate this feature at the beginning.
Speaker A
Also, we do have, on the same page, the possibility to replicate this data across tenants.
Speaker A
Select the access tier. Is it Hot, Cool, Cold tier? It depends how often you want to access your data.
Speaker A
We spoke about it. And you can select network options. If you enable public access or if you disable it and you store it in a private network, you can do it on this tab, as well as you can activate a private endpoint
Speaker A
to your storage account to fully isolate it. On the data protection part, you can decide if you want to enable or not soft delete and for how many days.
Speaker A
By default, it's enabled. For example, here, I will keep this data in the trash bin for a specific amount of dates.
Speaker A
You saw that they increased it from 7 to 14 just for security. This means that during 14 days I can restore, or during 7 days, I can restore my data.
Speaker A
I can also enable versioning for blobs and also versioning for changes if I want to recover my blobs from a specific version of it.
Speaker A
In the encryption part, I can specify encryption type and say if it's Microsoft platform that will manage the keys, or if I select customer-managed keys, I can also bring my own key vault.
Speaker A
I can add some tags for billing purposes and filtering and review the information about my storage account and hit "Create" after.
Speaker A
This will take up to a few minutes to deploy our storage account. As for previous deployments of VM, we saw it together, it starts deployment.
Speaker A
It has an option to download the template, to redeploy it later to simplify your time and life, and here you can track the deployment in real time, and this one, as it deployed, we will be notified via a pop-up message
Speaker A
and we can navigate now to our storage. When we open our storage account, here we can see all essential information about it, resource group, location, primary and secondary location as activated.
Speaker A
This geo-redundant storage is at the beginning, and on the left side, we will find our containers, file shares, queues, and tables as well as all settings available related to networking, data management, in which we can switch some setups
Speaker A
that we initially configured for our storage, like redundancy, for example, if you want to modify it.
Speaker A
To create a blob, we'll first need to go to containers and deploy a new container.
Speaker A
Let's just call it something simple. It should be -- start with letters or numbers and use only [inaudible].
Speaker A
I check access level, you can create it now, and as soon as it's created, we see that by default I set up private access, and if I want, I can add here some non-structured data.
Speaker A
Let's go for an image, for example. I just fill an image here, and as I select anonymous access for it, I will need to find a way to share this image that I just uploaded.
Speaker A
And to share this image, I have only a few ways, as it's fully protected by anonymous access.
Speaker A
If I decide that I need to send it, I will need to generate a SAS.
Speaker A
Generating a SAS will help me share securely any blob. I can select which permission I want to provide to this blob when the access opportunity starts and ends, expires, and then I generate the SAS token and I copy/paste access
Speaker A
to it in a browser, you see it can open now, my men here, and also SAS doesn't generate it for me, has all important information, including when the access starts and finishes and the name of our blob here.
Speaker A
So this is important to know. In the case if you want to share your blob, you need to set up permissions level and also just-in-time access.
Speaker A
What else can we do here? We can review other storage accounts that we have.
Speaker A
You'll see that I have multiple. They're all located in different groups or regions. And if I come back here to our storage account, it will be also visible in my recent resources.
Speaker A
On my left side, I will find something very interesting that is called "lifecycle management," and in lifecycle management, I can set up the rules for how my data navigates between Hot, Cold, and Cool access tiers.
Speaker A
So let's say I can add a rule, if my blobs were modified in more than 90 days, I want by default to move them into cold storage, and as well if my blobs were modified in more than 180 days, I want to move it to archives,
Speaker A
and I can also add information about rehydration here if I want to remove them after, from my archive tier.
Speaker A
So this is a good way of managing your blob lifecycle and also your cost savings, by deciding in which tier to keep them.
Speaker A
So we saw there are four data storage options, containers, file shares, queues, and tables, and I highly recommend that you review all these options on your own.
Speaker A
Let's come back now to our presentation. Transitioning from the exploration of storage access tiers, let's shift our focus to another pivotal facet, migration to Azure.
Speaker A
This seamless transition is empowered by the robust Azure Migration service, offering a unified solution for migrating, modernizing, and optimizing resources.
Speaker A
All pre-migration stages, such as discovery, assessment, and resizing on-premises resources, are incorporated into the infrastructure, data, and applications.
Speaker A
The scalable platform of the Azure Migration, or Azure Migrate service, allows for the integration of the third-party tools, expanding the range of supported use cases.
Speaker A
The Azure Migrate Service acts as a centralized management hub for assessing and migrating on-premises data centers to Azure.
Speaker A
It offers a single portal to initiate, execute, and track the progress of migration to Azure.
Speaker A
The Azure Migrate service integrates with other Azure services and tools as well as offerings from independent software vendors.
Speaker A
Through the Azure Migration center, you can access and move your on-premises infrastructure to Azure.
Speaker A
Azure Data Box is a physical migration service that enables fast and reliable transfer of large volumes of data with minimal costs.
Speaker A
The secure data transfer is facilitated by delivering the Data Box storage device with a maximum capacity of 80 terabytes.
Speaker A
Data Box is transported to and from the data center through regional transportation services, and its reinforced casing protects it from damage during transportation.
Speaker A
You can order Data Box on the Azure Portal to import and export data to and from Azure.
Speaker A
Once the device arrives at your data center, you can quickly set it up using a local user interface.
Speaker A
After completing the data transfer to or from Azure, simply return the Data Box. When transferring data to Azure, the data is automatically sent back to Microsoft after they receive the Data Box.
Speaker A
The entire process is managed through the Data Box service on the Azure Portal. Data Box is ideal for transferring data exceeding 40 terabytes when network connectivity is limited or unavailable.
Speaker A
Data movement can be one-time, periodic, or initial bulk data transfer operation followed by periodic transfers.
Speaker A
In addition to large-scale migration using services like Azure Migrate and Azure Data Box, Azure also provides tools for moving individual files or smaller file groups and interacting with them.
Speaker A
These tools include AzCopy, Azure Storage Explorer, and Azure File Sync. AzCopy is a command line utility that can be used to copy blobs or files to or from a storage account.
Speaker A
With AzCopy, you can upload, download, copy files between storage accounts, and even synchronize files.
Speaker A
AzCopy can also be configured to work with other cloud service providers to move files between clouds.
Speaker A
The second service, in the center of my screen, is Azure Storage Explorer, which is a standalone application that provides a graphical interface for managing files and large binary objects in your Azure storage account.
Speaker A
It works on Windows, macOS, and Linux and uses AzCopy on the server side to perform all file and blob management tasks.
Speaker A
With Azure Storage Explorer, you can upload data to Azure, download data from Azure, and move data between storage accounts.
Speaker A
And the third service, on the right side of my screen, is Azure File Sync.
Speaker A
This is a tool that centralizes shared folders in Azure Files while maintaining the flexibility, performance, and compatibility of a Windows file server.
Speaker A
It's almost like transforming your Windows file server into a miniature content delivery network. Once you install Azure File Sync on your on-premises Windows server, the service will automatically keep your files and sync them with your Azure files.
Speaker A
With Azure File Sync, you can maintain any number of caches you need in any region of the world and replace a failed on-premises server by setting up Azure File Sync on a new server in the same data center.
Speaker A
Additionally, Azure File Sync allows you to set up cloud tiering, where the most frequently accessed files are kept locally while less accessed files are stored in the cloud until requested.
Speaker A
In our next lesson, we'll discuss security, access control, and cost management in Azure. Let's begin with authentication and security methods, my favorite topics.
Speaker A
Security has become a very relevant subject in recent years, and during the COVID-19 period, the number of cyberattacks in some countries has more than doubled.
Speaker A
We'll start our learning in this session with Microsoft Entra ID. Microsoft Entra ID, previously known as "Azure Active Directory," is a cloud service for managing identities and access.
Speaker A
This service helps your employees access external resources, such as Microsoft 365, Azure Portal, and thousands of other SaaS applications.
Speaker A
Microsoft Entra ID also grants access to internal resources like applications on your corporate intranet as well as any cloud applications developed for your organization.
Speaker A
Microsoft Entra ID is a cloud-based identity and access management service from Microsoft. With Microsoft Entra ID, you manage the identity credentials, but Microsoft ensures the global availability of the service.
Speaker A
If you have worked with Active Directory, currently known as "Microsoft Entra Domain Services," Microsoft Entra ID will be familiar to you.
Speaker A
When you connect to Microsoft Entra ID, Microsoft protects you by detecting suspicious login attempts at no additional cost.
Speaker A
For example, Microsoft Entra ID can detect login attempts from an unexpected location or unknown device.
Speaker A
After selecting a Microsoft Entra ID license, you will gain access to all or some of the features for your organization, which you can see on the slide, authentication, self-service password reset, multi-factor authentication, business-to-business, B2B, application and device management.
Speaker A
We'll discuss these features in more detail in this session. Similar to how Microsoft Entra ID lets you use directory services without needing extra setup, Microsoft Entra Domain Services offers domain benefits in the cloud without the complexity of setting up
Speaker A
and managing domain controllers. Known as "Microsoft Entra DS," it handles tasks like joining domains and applying group rules.
Speaker A
It's useful for running older cloud apps that can't use modern logins or to avoid changing settings often.
Speaker A
You can move these older apps to the managed domain, avoiding the need for complex management.
Speaker A
It works with your Microsoft Entra ID, allowing users to use their credentials for logging in, and you can still use existing accounts and groups for security when accessing resources.
Speaker A
This helps make moving from on-premises to Azure smoother. Next, we'll talk about Microsoft Entra ID features, starting with authentication.
Speaker A
Authentication is the process of verifying the identity of a user, service, or device. So the user, service, or device needs to provide some credentials to confirm their identity.
Speaker A
Authentication is like presenting identification during travel, for example, at the airport check-in counter. It doesn't confirm the presence of a travel document.
Speaker A
It simply confirms that you are who you claim to be. Azure supports several authentication methods, including standard passwords, single sign-on, multi-factor authentication, and passwordless authentication.
Speaker A
While authorization influences the level of access granted to the authenticated entity, it also defines what data they can access and what actions they can perform.
Speaker A
In our airport example, it will be like checking your boarding pass to determine where exactly you can sit on the plane.
Speaker A
Another important feature of Microsoft Entra ID is multi-factor authentication. Remember how you log into websites, email, or online services.
Speaker A
Have you ever entered a code sent to your phone after entering your username and password?
Speaker A
If so, you have used multi-factor authentication, MFA, for login. MFA is the process of requesting additional data or an additional authentication factor or verification from the user during login.
Speaker A
MFA helps protect against password compromise. MFA provides extra credential security by requiring two or more elements for authentication.
Speaker A
These elements fall into the following categories. Something you know, this could be a complex question, something you have, this could be a code sent to your mobile phone, or something you are, usually some biometric characteristic, such as fingerprint or facial image.
Speaker A
Let's move now to the external identities. Surely you have worked with various companies that required access to your resources.
Speaker A
To secure this access, they have external identities. An external identity refers to users, devices, services, and etc., that are outside of your organization.
Speaker A
Microsoft Entra ID External Identities encompasses all the ways you can securely interact with users outside your organization.
Speaker A
If you want to collaborate with partners, distributors, suppliers, or vendors, you can grant them access to your resources and determine how your internal users can access external organizations.
Speaker A
If you are a developer creating a customer-facing application, you can manage your customers' use of credentials.
Speaker A
External identities can look similar to single sign-on. With external identities, external users can use their own credentials if they have a digital identity issued by a corporation or government entity or an unmanaged social identity such as Google or Facebook.
Speaker A
They're able to utilize their own credentials for signing in. Using the Microsoft Entra ID B2B, business-to-business feature, you can easily enable collaboration within your organization.
Speaker A
Administrators or other users can invite guest users from other customers. This feature also applies to social identities, such as Microsoft Accounts.
Speaker A
As we have a B2B offer, Microsoft provides as well a B2C one. External Identities B2C provides a service for corporate identity management for customers.
Speaker A
Your customers will have the ability to log into your application and APIs using selected social, enterprise, or local account credentials.
Speaker A
Microsoft Entra ID B2C is the customer identity and access management solution capable of serving millions of users and handling billions of authentication checks daily.
Speaker A
This solution takes care of scaling and securing the authentication platform, monitoring and automatically responding to various threats such as denial of service attacks and password spraying.
Speaker A
B2C is a separate service in Microsoft Entra ID. It is based on the same technology as Microsoft Entra ID but serves a different purpose, allowing you to build applications for customers and then let all users register for these applications
Speaker A
without restriction on user accounts. Another important feature of Microsoft Entra ID is conditional access.
Speaker A
Conditional access is a tool used by Microsoft Entra ID to allow or deny access to resources based on authentication signals.
Speaker A
These signals include user identity, user location, and the device from which the user is requesting access.
Speaker A
Conditional access helps IT administrators enable users to be productive from anywhere, anytime. Conditional access also provides more granular multi-factor authentication for users.
Speaker A
For example, users may not need to provide the second factor of authentication if they are in a known location.
Speaker A
However, if login signals are unusual or the user is in an unknown location, they may be prompted for a second factor.
Speaker A
When signing in, conditional access collects signals from the user, makes decisions based on those signals, and then applies that decision to allow or block access or require multi-factor authentication.
Speaker A
Managing access to cloud resources is a crucial function for any organization. Using this cloud role-based access control in Azure, also called "Azure RBAC," allows you to manage user access to Azure resources, including configuring permissions for performing operations on those resources
Speaker A
and defining access scopes. In a multi-team cloud environment, the principle of least privilege ensures access is granted only at the necessary level.
Speaker A
For instance, if you require read-only access to a specific blob in storage, then only read access should be provided for that particular object.
Speaker A
Write access should not be granted for that object, and read access should also not extend to other blobs in storage.
Speaker A
This guideline offers significant security recommendations. Azure RBAC includes over 70 built-in roles, can be assigned at different scopes, and allows you to create your own custom roles.
Speaker A
Each role has a set of access permissions associated with it. There are four fundamental Azure roles, Owner, Contributor, Reader, and User Access Administrator.
Speaker A
The Owner role wields complete control over resources. Owner can manage access, modify resources, and even delegate access to others.
Speaker A
The Contributor role maintains the ability to create and manage resources, excluding access management. The Reader role possesses the privilege to view existing resources but not modify or create new ones.
Speaker A
And finally, the User Access Administrator role specializes in managing user access to Azure resources, making it an indispensable role for access management tasks.
Speaker A
With the understanding of these fundamental roles, you will navigate the Azure RBAC landscape with clarity and ensure precise access control for your resources.
Speaker A
When it comes to safeguarding your data across various levels, the concept of defense in depth takes center stage.
Speaker A
The principle behind defense in depth is to implement a variety of measures that collectively restrain the progress of unauthorized access attempts to your data.
Speaker A
Just as Microsoft is committed to securing data, your dedication aligns with ensuring it's protected as well.
Speaker A
Let's turn our attention to the chart displayed on my screen which illustrates the layers of protection.
Speaker A
Each layer contributes to defense. Even if one layer is compromised, the subsequent layer acts as an additional barrier against further breach.
Speaker A
Turning our focus to the individual layers, we'll start with the physical security layer. This level is all about ensuring secure access to the building.
Speaker A
At Microsoft data centers, multiple security checkpoints and identity verifications are required for entry. This level is exclusively dedicated to physical security measures.
Speaker A
Transitioning to the identity level, the focus shifts to controlling access to the infrastructure. This level ensures that access is granted only to those who truly need it.
Speaker A
Moving on to the perimeter level, the primary objective is to prevent unauthorized users or services from gaining access to the network.
Speaker A
This layer serves as a frontline defense against threats like distributed denial of service attacks.
Speaker A
At this level, alerts are triggered, enabling the monitoring of potential attacks. Moving to the network level, the primary concern is the isolation of resource access.
Speaker A
This ensures that if an attack occurs, its spread to other services is contained. At the compute level, protective measures involve securing your environment by closing specific ports.
Speaker A
Comprehensive protection and necessary controls are pivotal at this stage. The application-level security requires integrating security into development projects, ensuring that applications are inherently secured by design.
Speaker A
And finally, we arrive at the data layer. Despite the contribution of the other layers, responsible data access holds immense significance.
Speaker A
This final layer ensures that those with authorized access adhere to data protection standards. Data layer security includes controls to manage access to business and customer data and encryption to protect data.
Speaker A
The Microsoft approach to defense in depth demonstrated through this multi-layer strategy fortifies its assets.
Speaker A
By embracing this approach, you too can effectively secure your resources and data. This layered methodology effectively combats a wide range of potential threats and should be a cornerstone of your security strategy as well.
Speaker A
Zero Trust is the security model that assumes the worst-case scenario and protects resources accordingly.
Speaker A
The Zero Trust model starts with the assumption of a breach, and every request is checked as if it were coming from an untrusted network.
Speaker A
Today, organizations need a new security model that effectively adapts to the complexities of the modern environment, supports workforce mobility, and protects people, devices, applications, and data wherever they are.
Speaker A
To address the challenges of the new world of computing, Microsoft strongly recommends using the Zero Trust security model which is based on three guiding principles.
Speaker A
First, verify explicitly, always authenticate and authorize based on all available data points. Secondly, use least privileged access.
Speaker A
Limit user access with just-in-time and just-enough access, risk-based adaptive policies, and data protection to protect both data and productivity.
Speaker A
And finally, a SimBridge. Segment access by network, user, devices, and application, use encryption to protect data, and use analytics to get visibility, detect threats, and improve your security.
Speaker A
Furthermore, we possess a strong tool aligned with this model known as "Microsoft Defender for Cloud." Microsoft Defender for Cloud is a monitoring tool that manages security posture and provides threat protection.
Speaker A
It monitors cloud, on-premises, hybrid, and multi-cloud environments, and offers recommendations and alerts to strengthen your security.
Speaker A
Defender for Cloud provides the necessary tools to protect resources, control security state, defend against cyber threats, and optimize security management.
Speaker A
Deploying Defender for Cloud is straightforward, as it's natively integrated into Azure. Defender for Cloud continually tracks new resources deployed for your workloads.
Speaker A
It assesses whether new resources are configured in accordance with security best practices. If not, they reflect and you receive a prioritized list of recommendations on what needs to be fixed.
Speaker A
These recommendations help reduce the likelihood of attacks on each of your resources. The list of recommendations is aligned with and maintained by the Azure Security Benchmark.
Speaker A
The Azure Security Benchmark provides guidelines with security and compliance recommendations for Azure prepared by Microsoft based on widely accepted compliance frameworks.
Speaker A
In this way, Defender for Cloud not only enables you to configure security policies, but also applies security configuration standards to your resources.
Speaker A
Let's take a moment to recap everything we covered in this second session of the AZ-900 Microsoft Azure Fundamentals Course.
Speaker A
In the first part, we explored the physical and management infrastructure of Microsoft Azure. You learned how Azure is built on a global network of regions and availability zones, designed to deliver resiliency and high availability.
Speaker A
We looked at how subscriptions and resource groups help your organization to organize resources, manage costs, and maintain governance.
Speaker A
Then we moved into compute options, virtual machines, app services, and containers, and discussed how each fits different workloads.
Speaker A
We also examined networking fundamentals including virtual networks, subnets, and how services communicate securely across Azure.
Speaker A
In the second part of this session, we shifted our focus to storage services. We discovered the different storage types, blob, file, queues, and tables, and learned how redundancy options like LRS, ZRS, GRS, and GZRS protect your data.
Speaker A
We also covered access tiers, Hot, Cool, Cold, and Archive, and how to choose the right tier based on cost and performance requirements.
Speaker A
Finally, we wrapped up with identity access and security. We explained Entra ID authentication methods such as single sign-on and multi-factor authentication and security models that keep your environment safe and compliant.
Speaker A
By now, you should have a solid understanding of Azure core services and how they work together to deliver a secure, scalable, and reliable cloud platform.
Speaker A
With that, our second session comes to the end. Your learning journey doesn't stop here.
Speaker A
There are many ways to keep building your skills. I encourage you to watch other videos in this course or explore your next favorite topics on Microsoft Learn at aka.ms/learn.
Speaker A
Thank you for joining me, and happy learning. Hope to see you again. Bye.
Topics:Azure storageAZ-900Microsoft Azure Fundamentalsdata redundancyAzure Blob storageAzure identity managementMicrosoft Entra IDAzure securityAzure access tierscloud storage
![[YTP] Jordan Peterson: Rat King — Transcript](https://i.ytimg.com/vi/0qUoznGIe1M/maxresdefault.jpg)
![Nick & Charlie ‣ their story [+heartstopper forever] — Transcript](https://i.ytimg.com/vi/p4TiW1TZM3w/maxresdefault.jpg)
