Azure – Page 10 – Get Practical

Creating a Storage Account using PowerShell

Hey everyone,

Today we are going to create a Storage Account for any kind of use and inside this storage account we are going to create a blob for logs and a file share.

In the last post we created a resource group, where we will provision resources during this and the next posts.

Open the Azure Cloud Shell, then choose your subscription, if the cloud shell is already open, we will add the following variables, with the information:

$RGNAME= “RG_GETPRACTICAL”
$LOCATION= “UKSOUTH”
$STRGACCNAME= “strggetpractical01”
$TypeSTRG= “Standard_LRS”

Then we will execute the command “New-AZStorageAccount” to create the storage from the variables assigned above.

New-AzStorageAccount -ResourceGroupName $RGNAME -Name $STRGACCNAME -Type $TypeSTRG -Location $LOCATION

The storage was successfully created.

With the storage created, we are going to create a container to allocate the “Logs” of our environment, for that we are going to assign some variables as well.

$STORAGEACCOUNT = Get-AzStorageAccount -ResourceGroupName $RGNAME -Name $STRGACCNAME
$CONTAINERNAME = “logs”
$CTX = $storageAccount.Context

After assigning the variables, let’s run the following command “New-AzStorageContainer” to create the container.

New-AzStorageContainer -Name $containerName -Context $ctx -Permission blob

Your container was successfully created.

Last but not least let’s create a “File Share” with the following variables.

$STORAGEACCOUNT = Get-AzStorageAccount -ResourceGroupName “RG_GETPRACTICAL” -Name “strggetpractical01”

$storageKey = (Get-AzStorageAccountKey -ResourceGroupName $storageAccount.ResourceGroupName -Name $storageAccount.StorageAccountName | select -first 1).Value

$storageContext = New-AzStorageContext -StorageAccountName $storageAccount.StorageAccountName -StorageAccountKey $storageKey

New-AzureStorageShare -Name “getpracticalshare” -Context $storageContext

The File Share was created successfully, now let’s check the container and the file share that were created.

Container for Logs:

File Share for files:

That’s all for today guys, until the next post!

Joao Costa

Creating Resource Group using Powershell

Hey guys, how are you?

The idea is to learn how to create the resources and finally create an environment with all the resources together.

To start the configuration we have two ways, use the “Azure Cloud Shell” or install the “AZ Module” of powershell.

AZ Module Installation: Powershell Configuration

Access to Azure Cloud Shell: //shell.azure.com/

For this articles I will use the Azure Cloud Shell.

Let’s start by accessing Cloud Shell, then type in your subscription credentials.

Now let’s create two variables, one indicating the name for the resource group and another indicating the region where we will create the resources.
We will work with variables to facilitate the creation of command lines, in this way we can create complex scripts based on variables.
Let’s create two variables, one with the name of the resource group and the other with the region where we will create the resource group.

$RGNAME= “RG_GETPRACTICAL”
$LOCATION= “UKSOUTH”

After creating the variable, let’s create the command line.

New-AzResourceGroup -Name $RGNAME -Location $LOCATION

As you can see, we are executing the command to create a new resource group with the name given in the variable and with the location we put, in my case I am creating it in “UK South“.

Now you can create the group directly with the “Tag” or make an update on the created group.

To create or update the resource group and assign “Tags“, we will give a name and a value to this tag, according to the command below.

New-AzResourceGroup -Name $RGNAME -Location $LOCATION -Tag @{Department=”IT”}

In the image below, only the update was executed, it asks to confirm if you are going to do the update or not.

Your resource group is now created and tagged.

Thanks guys and until the next post!

Azure Arc – How to add a server into it

Hey guys!

Today I’m going to talk about Azure Arc. This is a very useful tool nowadays, after all we have to work with more complex and heterogeneous environments. Therefore, the idea of being able to manage an entire infrastructure from a single access point saves many hours of work.

Well then, that is the role of Azure Arc. In it you can add Azure or non-azure resources, that is, other resources from other public clouds, on-premises, databases, etc.

Again, this is an intuitive and practical resource to use, let’s get right to the practice again.

Log in with your Azure account on the portal and type in the search bar “Azure Arc”. Open Azure Arc and you should see the Azure Arc Center.

On the home screen you have three tiles options, such as: Add your infrastructure for free, Deploy Azure Services and View Azure Arc Resources.

For this demo, we will use the first tile, so in “Add your infrastructure for free” click Add and then on the next screen, in the Servers tile click Add again.

On the next screen you can choose if you want to add one or more servers, add servers using Azure Migrate or Update Management (Still in preview).

In the tile add a single server, click Generate Script.

From now on I believe you already understand what will happen, Azure will open a wizard that will help you configure and generate a script that will do everything for you, such as downloading the agent, installing the agent and registering the server in Azure. You will only need to run the script on the server you intend to add to Azure Arc.

After clicking on Generate Script, you will see the following screen:

On this screen, you will need to pay attention to the basic requirements for the script to work.

Firewall requirements, you will need port 443 to perform this task.
You will need permission as a local administrator on the server or servers.
Finally, what is the means of communication between Azure and machine, public internet, proxy server or a private endpoint (VPN or Express Route).

Click next and select the options according to your environment.

Click on next and if that’s the case you can add tags to better identify your environment. Or just skip to the next screen.

Or just skip to the next screen.

Now you need to copy or download the script and run it on the intended server.

And as soon as you run the script on the desired server, it will show up in Azure Arc as Connected status.

That’s all for today guys, until the next post.

Joao Costa

Azure Authentication methods – Go Passwordless

Hey guys, in my last post I talked about recovering access/resetting password. So today I will talk about the Azure Authentication Methods which includes a feature to go passwordless.

This feature will bring you greater security, after all passwords are the biggest causes of frauds, ransomwares and hacking nowadays. It will also help reduce the number of password reset tickets and help with the process of creating new user accounts.

The idea of this post will be to explain some concepts/methods and demonstrate how to enable this feature (If you already have MFA, the process will become even easier to be adopted).

Let’s get started: Go to Azure portal go to Security > Authentication Methods

As you can see above, there are 4 different methods and here below is the explanation of each one of them.

FIDO2 Security Key: Among other words, it is based on a USB device that may or may not have Bluetooth, NFC or fingerprint recognition. The vast majority of current devices use standard authentication (WebAuthn) and Microsoft has a list of supported devices. This option will allow the user to authenticate when inserting the device plus their fingerprint or with NFC/Bluetooth approach.

Microsoft Authenticator App: Well known in the market, with this app you can approve your access through a PIN or the insertion of your fingerprint.

Text Message : This method will ask you, instead of entering your username and password, enter your phone number (which must be registered before) and then it will send you an access code.

Temporary Access Pass:
This feature will help band new employee who dont have a password or MFA that is where the new Temporary Access Pass comes in. Basically, when creating a new user’s account, the administrator will be able to provide the TAP (Temporary Access Pass) to the new user. This Temporary Access Pass is a time-limited passcode that the user can apply to register their passwordless sign-in method among the methods enabled for that organization.

That said, let’s configure the passwordless option for a specific user, the option chosen for this scenario will be Microsoft Authenticator App.

Simple, easy and intuitive, save your changes and let’s go to the tests.

Go to the Azure portal, enter your username and click next

You will receive a message as shown below.

Go to the Microsoft Authenticator App and enter the requested number.

And then confirm using your fingerprint (If it’s enabled)

There we go, we’re in passwordless:

That’s all for today guys, see you in the next post.

Joao Costa

Recovering local administrator access in Azure VMs

Hey guys!

Let’s assume that for any reason you have lost the local administrator password of a virtual machine in Azure or even don’t remember the initial user created during the deployment of your virtual machine, well, the idea of this post is to solve this your problem, which just seems silly but not unusual.

Starting with the user, in case you don’t remember, it’s a pretty simple task to find out: Go to Azure and make sure your VM is powered on, then select your VM and go to blade “Operations” and select “Run Command” and finally click on “RunPowerShellScript”. This will cause a dialog box to open and in this box you will type the following command in: “Get-LocalUser” and click “Run”.

The output should be presented as the image above, and at this point you will know which are the local users of that VM.

Ok, now that you know which user to use, just type in the password, correct? But let’s say you also don’t remember which password to use (Bad days happen to everyone lol). Well then, I will present two simple ways to reset this local user password.

The easiest and simplest option would be again with your VM selected, go to the blade “Help” and click on “Reset Password”. You will only need to enter the user you want to reset the password and your new password.

(Ps: You will need to be logged into Azure with an user who gives you this right, “RBAC” is a certification exam topic).

If all goes well, you will have the new password and use your local account without any problems.

But let’s assume that this lost password is the domain controller administrator password in Azure. In this case, you will not be able to reset this password as I just showed you above.

Therefore, we will be using the Extensions function in Azure. Through this extension we will run a script to reset the admin password.

The script is very simple and has only one line and has been uploaded to Azure previously.

The script must have the command above: net user LOCALUSER PASSWORD

After creating the script, saving as ResetPassword.ps1 and uploading it to a storage account on azure, select your VM again and in the blade Settings click on Extensions > Add > CustomScriptExtension > Next > RESETPASSWORD.PS1 > Review + Create > Create.

The Azure extension function will run the script on the VM and your password will be reset as configured in the script.

Voila! You will now be able to access your domain controller as you wish. This script can also be used to reset any account’s password.

Obviously the reset options are not limited to what I presented here in this post, especially when it comes to PowerShell commands.

That’s it for today guys, see you next time!

Joao Costa