This article is contributed. See the original author and article here.
We continue to expand the Azure Marketplace ecosystem. For this volume, 101 new offers successfully met the onboarding criteria and went live. See details of the new offers below: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This article is contributed. See the original author and article here.
SQL Server Migration Assistant (SSMA) is a suite of 5 tools designed to automate migrations from Oracle, Access, DB2, MySQL and SAP ASE (formerly SAP Sybase ASE) to Microsoft SQL. It automates the conversion of database schemas to a Microsoft SQL Server schemas, deployment of the schemas, data migration to the target SQL Server (see below for supported versions), and validation of migrated objects.
The latest releases of SSMA for Oracle and SSMA for DB2 improve the automatic conversion by adding support for new functions and enhancing existing conversion logic. In addition, all tools use COUNT_BIG in row count queries for the target database.
Follow us on Data Exposed for dedicated episodes on SSMA new features and subscribe to YouTube Channel: aka.ms/azuresqlyt to find out more on the next features.
In addition, this release includes the following:
Source: For the list of supported sources, please review the information on the Download Center for each of the above SQL Server Migration Assistant downloads.
Target: SQL Server 2012, SQL Server 2014, SQL Server 2016, SQL Server 2017, SQL Server 2019, Azure SQL Database, an Azure SQL Database managed instance, and Azure SQL Data Warehouse (Azure Synapse Analytics)*.
*Azure SQL Data Warehouse (Azure Synapse SQL Pool) is supported as a target only when using SSMA for Oracle.
This article is contributed. See the original author and article here.
If you prefer, install the Azure CLI to run CLI reference commands.
This tutorial requires version 2.0.4 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.
subscriptionId="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
resourceGroupName="myResourceGroup"
storageAccountName="mystorageacct$RANDOM"
region="westus2"
shareName="myshare$RANDOM"
mysqlServerName="myserver$RANDOM"
mysqlAdmin="myadmin"
mysqlPassword="MyWeaKPassw0rd"
privateEndpointNameStorage="myStoragePrivateEndpoint"
privateConnectionNameStorage="myStorageConnection"
privateDNSZoneNameStorage="privatelink.file.core.windows.net"
privateDNSZoneGroupNameStorage="MyStorageZoneGroup"
privateDNSLinkNameStorage="MyStorageDNSLink"
privateEndpointNameDatabase="myDatabasePrivateEndpoint"
privateConnectionNameDatabase="myDatabaseConnection"
privateDNSZoneNameDatabase="privatelink.mysql.database.azure.com"
privateDNSLinkNameDatabase="MyDatabaseDNSLink"
privateDNSZoneGroupNameDatabase="MyDatabaseZoneGroup"
dbname="wordpressdb"
dbuser="db_user"
dbpassword="db_user-weakPassword"
ScaleSetName="myScaleSet"
VNETName="myVNET"
SubnetName="mySubnet"
BackendSubnetName="myBackendSubnet"
AppGWPublicIPAddressName="myAppGWPublicIP"
AppGatewayName="myAppGateway"
az group create --name $resourceGroupName --location $region
az network vnet create
--resource-group $resourceGroupName
--location $region
--name $VNETName
--address-prefixes 10.0.0.0/16
--subnet-name $SubnetName
--subnet-prefixes 10.0.0.0/24
Please note that the subnet created here will be the dedicated subnet to Application Gateway
az network vnet subnet create
--name $BackendSubnetName
--resource-group $resourceGroupName
--vnet-name $VNETName
--address-prefix 10.0.2.0/24
az network public-ip create
--resource-group $resourceGroupName
--name $AppGWPublicIPAddressName
--allocation-method Static
--sku Standard
--zone 1 2 3
Is required to disable network policies for private endpoints
az network vnet subnet update
--name $BackendSubnetName
--resource-group $resourceGroupName
--vnet-name $VNETName
--disable-private-endpoint-network-policies true
az network application-gateway create
--name $AppGatewayName
--location $region
--resource-group $resourceGroupName
--vnet-name $VNETName
--subnet $SubnetName
--capacity 3
--sku Standard_v2
--http-settings-cookie-based-affinity Enabled
--frontend-port 80
--http-settings-port 80
--http-settings-protocol Http
--public-ip-address $AppGWPublicIPAddressName
--zones 1 2 3
az storage account create
--resource-group $resourceGroupName
--name $storageAccountName
--kind FileStorage
--sku Premium_ZRS
az storage share-rm create
--resource-group $resourceGroupName
--storage-account $storageAccountName
--name $shareName
--enabled-protocol NFS
--root-squash NoRootSquash
--quota 1024
idstorage=$(az storage account list
--resource-group $resourceGroupName
--query '[].[id]'
--output tsv)
az network private-endpoint create
--name $privateEndpointNameStorage
--resource-group $resourceGroupName
--vnet-name $VNETName
--subnet $BackendSubnetName
--private-connection-resource-id $idstorage
--connection-name $privateConnectionNameStorage
--group-id file
az network private-dns zone create
--resource-group $resourceGroupName
--name $privateDNSZoneNameStorage
az network private-dns link vnet create
--resource-group $resourceGroupName
--zone-name $privateDNSZoneNameStorage
--name $privateDNSLinkNameStorage
--virtual-network $VNETName
--registration-enabled false
az network private-endpoint dns-zone-group create
--resource-group $resourceGroupName
--endpoint-name $privateEndpointNameStorage
--name $privateDNSZoneGroupNameStorage
--private-dns-zone $privateDNSZoneNameStorage
--zone-name storage
The secure transfer setting isn’t supported on NFS protocol, so it’s required to disable it:
az storage account update -g $resourceGroupName -n $storageAccountName --https-only false
As NFS is a preview feature at this time, you need register your subscription to be able to use.
az feature register
--name AllowNfsFileShares
--namespace Microsoft.Storage
--subscription $subscriptionId
az provider register
--namespace Microsoft.Storage
az mysql server create --resource-group $resourceGroupName --name $mysqlServerName --location $region --admin-user $mysqlAdmin --admin-password $mysqlPassword --sku-name GP_Gen5_2 --ssl-enforcement Disabled
idmysql=$(az mysql server list
--resource-group $resourceGroupName
--query '[].[id]'
--output tsv)
az network private-endpoint create
--name $privateEndpointNameDatabase
--resource-group $resourceGroupName
--vnet-name $VNETName
--subnet $BackendSubnetName
--private-connection-resource-id $idmysql
--group-id mysqlServer
--connection-name $privateConnectionNameDatabase
az network private-dns zone create --resource-group $resourceGroupName
--name $privateDNSZoneNameDatabase
az network private-dns link vnet create --resource-group $resourceGroupName
--zone-name $privateDNSZoneNameDatabase
--name $privateDNSLinkNameDatabase
--virtual-network $VNETName
--registration-enabled false
az network private-endpoint dns-zone-group create
--resource-group $resourceGroupName
--endpoint-name $privateEndpointNameDatabase
--name $privateDNSZoneGroupNameDatabase
--private-dns-zone $privateDNSZoneNameDatabase
--zone-name mysql
This will allow connect on Azure Database from AZ CLI to create the database
az mysql server firewall-rule create --resource-group $resourceGroupName --server $mysqlServerName --name "AllowAll" --start-ip-address 0.0.0.0 --end-ip-address 0.0.0.0
mysql -h $mysqlServerName.mysql.database.azure.com -u$mysqlAdmin@$mysqlServerName -p$mysqlPassword<<EOFMYSQL
CREATE DATABASE wordpressdb;
CREATE USER 'db_user'@'%' IDENTIFIED BY 'db_user-weakPassword';
GRANT ALL PRIVILEGES ON wordpressdb . * TO 'db_user'@'%';
FLUSH PRIVILEGES;
EOFMYSQL
As the access from VMs to the database will use the private endpoint connection, we don’t need it anymore. Was required just to be able to connet to MySQL from AZ CLI and create the WordPress database.
az mysql server firewall-rule delete --name AllowAll --resource-group $resourceGroupName --server-name $mysqlServerName -y
At this step the cloud-init will be generated to create the configuration inside the VMs and install required packages.
cat <<EOF > cloud-init.txt
#cloud-config
package_upgrade: true
packages:
- nginx
- php-curl
- php-gd
- php-intl
- php-mbstring
- php-soap
- php-xml
- php-xmlrpc
- php-zip
- php-fpm
- php-mysql
- nfs-common
write_files:
- path: /tmp/wp-config.php
content: |
<?php
define('DB_NAME', '$dbname');
define('DB_USER', '$dbuser');
define('DB_PASSWORD', '$dbpassword');
define('DB_HOST', '$mysqlServerName.mysql.database.azure.com');
$table_prefix = 'wp_';
if ( ! defined( 'ABSPATH' ) ) {
define( 'ABSPATH', __DIR__ . '/' );
}
require_once ABSPATH . 'wp-settings.php';
?>
- path: /tmp/wordpress.conf
content: |
server {
listen 80;
server_name _;
root /data/nfs/wordpress;
index index.html index.htm index.php;
location / {
try_files $uri $uri/ /index.php$is_args$args;
}
location ~ .php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
}
location = /favicon.ico { log_not_found off; access_log off; }
location = /robots.txt { log_not_found off; access_log off; allow all; }
location ~* .(css|gif|ico|jpeg|jpg|js|png)$ {
expires max;
log_not_found off;
}
location ~ /.ht {
deny all;
}
}
runcmd:
- mkdir -p /data/nfs/wordpress
- mount -t nfs $storageAccountName.file.core.windows.net:/$storageAccountName/$shareName /data/nfs -o vers=4,minorversion=1,sec=sys
- wget http://wordpress.org/latest.tar.gz -P /data/nfs/wordpress
- tar xzvf /data/nfs/wordpress/latest.tar.gz -C /data/nfs/wordpress --strip-components=1
- cp /tmp/wp-config.php /data/nfs/wordpress/wp-config.php
- cp /tmp/wordpress.conf /etc/nginx/conf.d/wordpress.conf
- chown -R www-data:www-data /data/nfs/wordpress
- rm /etc/nginx/sites-enabled/default
- rm /etc/nginx/sites-available/default
- systemctl restart nginx
EOF
az vmss create
--name $ScaleSetName
--resource-group $resourceGroupName
--image UbuntuLTS
--admin-username azureuser
--generate-ssh-keys
--instance-count 3
--vnet-name $VNETName
--subnet $BackendSubnetName
--vm-sku Standard_DS2_v2
--upgrade-policy-mode Automatic
--app-gateway $AppGatewayName
--custom-data cloud-init.txt
--backend-pool-name appGatewayBackendPool
--zones 1 2 3
az network public-ip show
--resource-group $resourceGroupName
--name $AppGWPublicIPAddressName
--query [ipAddress]
--output tsv
Please note the complete setup of the VMs configuration can take up to 5 minutes. So if you try access and got the “Welcome to nginx!” message, it means that the setup wasn’t finished yet. So take another cup of coffee before try access again =D
In your web browser, navigate to the Application Gateway Public IP and complete the WordPress installation through the web interface:
http://application_gateway_public_ip
Select the language you would like to use:
Next, you will come to the main setup page.
Select a name for your WordPress site and choose a username. It is recommended to choose something unique and avoid common usernames like “admin” for security purposes. A strong password is generated automatically. Save this password or select an alternative strong password.
Enter your email address and select whether you want to discourage search engines from indexing your site:
When you click ahead, you will be taken to a page that prompts you to log in:
Once you log in, you will be taken to the WordPress administration dashboard:
When you created a Virtual Machine Scale, three VM instances were deployed by the parameter –instance-count 3. To increase or decrease the number of VM instances in your existing scale set, you can manually change the capacity. The scale set creates or removes the required number of VM instances then will distribute the traffic.
To manually increase or decrease the number of VM instances in the scale set, use az vmss scale. The following example sets the number of VM instances in your scale set to 5:
az vmss scale --name myScaleSet --new-capacity 5 --resource-group $resourceGroupName
az monitor autoscale create
--resource-group $resourceGroupName
--resource $ScaleSetName
--resource-type Microsoft.Compute/virtualMachineScaleSets
--name autoscale
--min-count 3
--max-count 10
--count 3
az monitor autoscale rule create
--resource-group $resourceGroupName
--autoscale-name autoscale
--condition "Percentage CPU > 70 avg 5m"
--scale out 3
az monitor autoscale rule create
--resource-group $resourceGroupName
--autoscale-name autoscale
--condition "Percentage CPU < 30 avg 5m"
--scale in 1
This article is contributed. See the original author and article here.
Howdy folks,
I’m excited to share the latest Active Azure Directory provisioning capabilities to help you with your user lifecycle and directory management needs.
Azure AD now supports provisioning into on-premises applications, and we have a preview that we’re excited for you to deploy and share your feedback.
You must have an Azure AD Premium P1 or P2 tenant and an on-premises application that uses SQL as a data store or supports SCIM. You can request an invitation to the preview here. We plan to remove the invitation requirement in the coming months and add support for provisioning users into LDAP directories (excluding AD DS).
For those customers who have previously deployed Microsoft Identity Manager (MIM), you can reuse your existing connectors and configuration without needing a full MIM deployment. And for those customers building new applications, you can use our SCIM reference code to stand up a SCIM endpoint and easily provision users into your application, whether it’s on-premises or in the cloud.
Azure AD service now supports more than 200 provisioning connectors! Checkout the growing list of applications here. Don’t see an app you’re looking for? Request your application vendors to support the SCIM standard and onboard to the Azure AD application gallery. We’ll work with the ISV to quickly onboard.
To help more admins connect third party apps to Azure AD, we’ve launched a new app integration wizard in the Microsoft 365 admin center. The app integration wizard makes it easier to connect apps in our app gallery to Azure AD by taking admins through a guided configuration experience in setting up single sign-on. Once applications have been setup for single sign-on, admins can then automate user provisioning using the hundreds of pre-built provisioning connectors.
Monitor and troubleshoot your provisioning deployment with the provisioning logs using the UI, API, or by exporting the data as a CSV. You can also build custom dashboards, alerts, and queries on the data using our Azure Monitor integration.
Azure AD’s provisioning service allows you to transform data prior to exporting it into a target system. In order to make it easier to build and test the expressions used to transform data, we’ve built an expression builder that is now available in public preview. Learn more about it here, or visit our tips for general guidance on writing expressions.
The latest version of Azure AD Connect sync has added the following capabilities:
With agent version # 1.1.359, Azure AD Connect cloud sync admins can now use GMSA cmdlets to set and reset their gMSA permission at a granular level. In addition, the limit of syncing members using group scope filtering has increased to 50,000 members. For more details on agent updates, including bug fixes, check out the version history.
As always, we’d love to hear your feedback or suggestions in the comments or on Twitter (@AzureAD).
Best regards,
Alex Simons (@Alex_A_Simons)
Corporate VP of Program Management
Microsoft Identity Division
Learn more about Microsoft identity:
This article is contributed. See the original author and article here.
By Lothar Zeitler – Senior Program Manager | Microsoft Endpoint Manager – Intune
Mobile devices have become powerful enough to support various computationally intensive tasks. To help manage more complex projects, Samsung offers Samsung DeX, which creates a desktop experience for mobile users. With Samsung DeX, you can use mobile apps in desktop mode and work from your phone or tablet in a PC-like user interface. Samsung DeX is available on premium models. For more information and a list of supported devices, go to Samsung DeX (link to Samsung.com).
The Samsung DeX platform is an extension of Android Nougat‘s multi-window mode, which means that you can use almost any Android application in desktop mode on a supported device. However, to optimize desktop/DeX performance, developers might need to customize their application (see Optimizing your app on the Samsung website). Note that both application and device policies implemented with Microsoft Endpoint Manager will continue to work with DeX without modification.
To use Samsung DeX, you simply connect a USB–C to HDMI cable to an external monitor. The DeX interface then appears on the screen via the video stream. You can also connect a mouse and keyboard to the mobile device via Bluetooth. Samsung DeX is also available as desktop (host) application for Windows and macOS, which allows you to work simultaneously between your mobile device and your computer.
IT administrators who manage mobile devices with Microsoft Intune can also use the service to manage Samsung DeX configurations. In this article, we will explain how to set up and configure DeX for managed Samsung devices in Intune.
First, you will need to create an enrollment profile and set up a device group for Samsung devices that are corporate-owned with a work profile. For detailed instructions, see Set up Intune enrollment of Android Enterprise Corporate-Owned devices with a Work Profile.
An example enrollment profile for “Corporate-owned devices with a work profile” looks like this:
Example enrollment profile for “Corporate-owned devices with a work profile”.
Next, we create a new device group to add all Samsung models with the same enrollment profile dynamically. We will use this dynamic group to assign policies, apps, and configurations, including the DeX configuration, to each new device that belongs to that group. We used the same enrollment profile name “Samsung COPE Test for DeX OEMConfig” for our device group. When you create this new group, make sure to select “Dynamic Device” in the Membership type field.
Example dynamic device group for DeX devices.
As a membership criterion for the group, we use the name of the enrollment profile. We define the rule criteria under Dynamic device members > Add a dynamic query. Under Property, we select enrollmentProfileName then under Operator, select Equals, and under Value, we enter the profile name “Samsung COPE Test for DeX OEMConfig.“
Example dynamic device query for the “Samsung COPE Test for DeX OEMConfig” profile.
Now, all devices that are enrolled with this profile in Intune automatically become members of our group.
OEMConfig is an Android standard that we use to add, create, and customize OEM-specific settings, including DeX settings, for Android Enterprise devices. OEMConfig configuration settings are delivered to a device via an OEMConfig app. This section explains how to add an OEMConfig app and then create an OEMConfig profile.
Samsung offers the Knox Service Plugin (KSP) to help IT admins create and push app configurations to managed devices. To apply an OEMConfig configuration to a Samsung device, the KSP app must be installed first. The KSP app is available in Google Play and can be automatically deployed to devices using Intune.
In the Microsoft Endpoint Manager admin center, add the KSP app via the Managed Google Play Store. For detailed instructions, see Add and assign Managed Google Play apps to Android Enterprise devices.
Adding the “Knox Service Plugin” via the Managed Google Play Store.
Once the KSP app is visible in the apps list in Intune, you can assign it to the device group. Navigate to Apps > Knox Service Plug–In > Properties > Assignments (select Edit).
Adding a new app assignment for the Knox Service Plugin app.
On the Edit application page under the Required option, we add the same device group we created earlier: “Samsung COPE Test for DeX OEMConfig.“ This will enforce a mandatory install of the app on any device in the group. For detailed instructions, see Assign apps to groups with Microsoft Intune.
After a device is enrolled using the QR code and the applicable profile, the KSP app is automatically installed. Once installed, the OEMConfig policy will be assigned to the device.
We typically use OEMConfig to configure settings that aren’t built into Intune, and the available settings depend on what the original equipment manufacturer (OEM) includes in their OEMConfig app. For detailed information on OEMConfig policies, see Use and manage Android Enterprise devices with OEMConfig in Microsoft Intune.
First, we need to create an Android Enterprise configuration profile with the type OEMConfig.
Creating a new Android Enterprise OEMConfig configuration policy.
We continue to use the same name as the enrollment profile for the OEMConfig profile: “Samsung COPE Test for DeX OEMConfig,” and then select the Knox Service Plugin as the OEMConfig app, which means it is the designated app to deploy the OEMConfig profile to devices.
Assigning the Known Service Plugin to the newly created OEMConfig profile.
On the Configuration settings page, we search for DeX settings (select the Locate search link). This will show us all available DeX settings that we might want to configure later. You can configure additional settings in the profile, beyond the DeX configuration. There are different parameters and options for each item in the profile configuration settings.
Clicking on the “Locate” search link to show all available DeX settings.
In our example scenario, we want to use the DeX for Windows application to display the DeX interface on the PC when connecting the device, and we also want to use the PC keyboard and mouse. With this setup, a user can easily copy data between a PC and DeX device. You can allow or block the direction of data flow, i.e., PC → DeX or DeX → PC, can under Configure file transfer settings, as shown below.
Example of all available DeX customization options with the “Configure file transfer settings” highlighted.
As a next step, we want to configure the connection settings and use a custom background picture.
We will now create an OEMConfig policy called “Samsung COPE Test for DeX OEMConfig.“ First, we define a profile name, “DeX Config.“ For our example, we will also add a Knox license key for the E-FOTA service.
Creating a new OEMConfig policy named “Samsung COPE Test for DeX OEMConfig”.
The DeX customization profile (Premium) item takes us to the list of configuration options for DeX. First, we set the Auto-start DeX on HDMI connection to True, which will configure DeX to start automatically when an HDMI connection is established. We also set the Enable Mouse Cursor Flow option to True, which will enable mouse movements between the connected screen and the DeX device.
Configured settings under the “DeX customization profile (Premium)” setting.
Next, we will set a custom wallpaper image that will show when a device is in DeX mode. Under the Set DeX Wallpaper, we select a Web URL for the Wallpaper Image, enter the image’s URL, and then choose when to display the wallpaper should be changed (option: Which Wallpaper to setup? All, On lock screen, On system or Not configured).
Configuring a custom wallpaper image that will show when a device is in DeX mode.
Note: To edit previous KSP configuration settings, select the ellipses next to an item (…).
To edit previous KSP configuration settings, select the “ellipses” button next to an item.
Once the DeX configuration is complete, we select Next twice. Then, under Add Groups, select the group “Samsung COPE Test for DeX OEMConfig” that we previously created.
Assigning a group under a new OEMConfig profile.
On the summary page, review the settings and select Create to create the profile.
Summary page of a new OEMConfig profile.
The configuration is now ready to use. When you connect a DeX device, a connection dialog appears.
Connection dialog example when connecting a new DeX device to your device.
Select Start Now to establish a connection to the external device or screen and start the DeX interface.
Wallpaper configuration example from a recently connected DeX device that received the configured OEMConfig.
Note: The wallpaper configuration in the OEMConfig, like other settings too, is dynamic. When you change the image source in the settings, the wallpaper will change.
Note: If you want to use the DeX host application, you must first install the software on the PC. When a DeX device connects to the PC, the DeX icon will appear in the tray.
Example of the DeX icon in the Windows system tray when a DeX device connects to the PC.
When using OEMConfig and DeX, there are a few considerations and practices to keep in mind.
OEMConfig is a functionality that is available as part of Android Enterprise. Almost all OEMs provide an app to support device–specific configurations. However, the set of options varies from OEM to OEM.
Samsung has an optional OEMConfig setting for debug mode. In debug mode, the KSP app remains visible and active on the device to facilitate troubleshooting.
| KSP Debug Mode | KSP Configuration | KSP Profile |
 Screenshot of the Knox Service Plugin in Debug Mode on a DeX device. |  Screenshot of the Knox Service Plugin and configurations applied on a DeX device. |  Screenshot of the Knox Service Plugin and configured settings on a DeX device. |
OEMConfig error messages are displayed in the Microsoft Endpoint Manager admin center. Select Devices > All devices, choose the device from the list, and then go to App Configuration.
Screenshot of the “App configuration” blade in the Microsoft Endpoint Manager admin center.
Note: The error messages in the admin center are identical to the messages created by the KSP app. You can find a list of error messages in the Samsung Knox documentation.
You can apply some DeX policies to all users on the device, regardless of work profile and personal settings. You’ll find these settings under the Know Service Plugin settings, as shown below.
Screenshot of an sample OEMConfig and highlighted example of the “Device-wide policies” that can be targeted to DeX devices.
Expand this section to find the device-wide DeX policies.
Screenshot of an sample OEMConfig and an expanded “DeX policy” section to find device-wide policies.
Now that you have a better understanding of how to manage Samsung DeX devices in Microsoft Intune, you can help your company take advantage of this technology. If you have any questions, reply to this post or reach out to @IntuneSuppTeam on Twitter.
Recent Comments