Kurt Shintaku's Blog

[I’ve shared this before but it’s been updated a bit and is a worthwhile companion to the “Azure Strategic Implementation Guide”]

"Azure Onboarding Guide for IT Organizations”, is a popular document for our customers in IT and is usually a good resource to review top to bottom as a starting point to understanding the considerations to adopting Azure cloud services as an organization.

It covers:

1. Moving to the cloud
2. Managing security, compliance, and data privacy
3. Azure enterprise administration
4. Integrating Azure into the corporate network
5. Extending Active Directory to Azure
6. Operating Azure IaaS Services
7. Migrating existing services to Azure
8. Offering management for cloud-based services

(When you review it, you’ll notice that it’s more tactical as opposed to the eBook I shared earlier entitled, “Azure Strategy & Implementation Guide” making it a good guide for IT pros.)

• DOWNLOAD: "Azure Onboarding Guide for IT Organizations"
  https://azure.microsoft.com/mediahandler/files/resourcefiles/d8e7430c-8f62-4bbb-9ca2-f2bc877b48bd/Azure%20Onboarding%20Guide%20for%20IT%20Organizations.pdf

Gartner Group just published a analysis report on Microsoft Teams entitled, “Why Microsoft Teams Will Soon Be Just as Common as Outlook”. 

It is only available to Gartner customers & subscribers however the table of contents alone is a fascinating overview of questions that I’m sure many people have about Teams and it’s role in enterprise collaboration.

Taken from summary:

Microsoft Teams is playing an increasingly unifying and expanding role in Office 365. This report guides technical professionals on getting the most value out of Teams, analyzes Teams’ impact on the rest of Office 365, and assesses Teams’ strengths and weaknesses.

…

Download the report here if you are a Gartner subscriber:

• Gartner: “Why Microsoft Teams Will Soon Be Just as Common as Outlook”
  https://www.gartner.com/doc/3879669/microsoft-teams-soon-just-common

Our LinkedIn subsidiary announced that military spouses will be eligible to receive LinkedIn Premium upgrades, including access to the LinkedIn Learning library. (Many assets formerly from the acqusition of Lynda.com)

Faced with frequent moves and deployments, military spouses have a unique challenge when it comes to growing their careers – in fact, they are four times more likely to be unemployed than their civilian counterparts. In order to help set them up for success, re-skilling and re-training are key as well as identifying remote and flexible work options.

To help solve this pressing challenge, LinkedIn is expanding our military and veterans program to include military spouses through a new partnership with the U.S. Department of Defense’s Spouse Education and Career Opportunities program. Beginning this July, we’ll provide one year of LinkedIn Premium to every military spouse during each of their moves to new installations to help their career transitions, and once again upon conclusion of military service.

This will include free access to our online library of more than 12,000 LinkedIn Learning courses, including our newly-launched learning path designed to help military spouses succeed in flexible, freelance, or remote work opportunities. We’ll be working to foster this community through the DoD’s growing military spouse LinkedIn group, as well as directing employers to this community as a top source of talent.

Read the entire announcement here.

• ANNOUNCEMENT: Welcoming Military Spouses to LinkedIn’s Military and Veterans Program
  https://blog.linkedin.com/2018/june/11/welcoming-military-spouses-to-linkedins-military-and-veterans-program
• ANNOUNCEMENT: DoD Partners With LinkedIn, Offers Military Spouses Free Membership
  https://www.defense.gov/News/Article/Article/1554303/dod-partners-with-linkedin-offers-military-spouses-free-membership/

For details on how to enroll, check out the Spouce Education & Career Opportunities site on Millitary OneSource at:

• SECO – LinkedIn Premium
  https://myseco.militaryonesource.mil/portal/content/view/8256

Azure compliance offerings are based on various types of assurances, including formal certifications, attestations, validations, authorizations, and assessments produced by independent third-party auditing firms, as well as contractual amendments, self-assessments, and customer guidance documents produced by Microsoft.

Each offering description in this document provides an up to date scope statement indicating which Azure customer-facing services are in scope for the assessment, as well as links to downloadable resources to assist customers with their own compliance obligations. Azure compliance offerings are grouped into four segments: globally applicable, US government, industry specific, and region/country specific.

Download the paper here.

• WHITEPAPER: Overview of Microsoft Azure Compliance offerings (.PDF, 56pgs)
  https://gallery.technet.microsoft.com/Overview-of-Azure-c1be3942

Recently, I’ve received several requests to help a customer deploy “Windows Defender for the Enterprise”, provide great management & reporting, and otherwise displace their existing solution on their desktops & servers.

Here are a few articles online that help provide background on how to use & deploy Windows Defender in the Enterprise:

• Why Windows Defender Antivirus is the most deployed in the enterprise
  https://cloudblogs.microsoft.com/microsoftsecure/2018/03/22/why-windows-defender-antivirus-is-the-most-deployed-in-the-enterprise/
• Example scenario: Using System Center Endpoint Protection to protect computers from malware in System Center Configuration Manager
  https://docs.microsoft.com/en-us/sccm/protect/deploy-use/scenarios-endpoint-protection
• Evaluate Windows Defender Antivirus protection
  https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus

Here are some presentations from Microsoft Ignite that may also help people understand Windows Defender:

• Next Generation Malware Detection with Windows Defender
  https://channel9.msdn.com/events/Ignite/2015/BRK2327
• Protect your endpoints from malware threats with Windows Defender and System Center Endpoint Protection
  https://channel9.msdn.com/events/Ignite/2016/BRK2205
• Explore Windows Defender Instant Protection
  https://channel9.msdn.com/events/Ignite/2016/THR2195R

Announcing the Azure Active Directory password protection Ask Microsoft Anything (AMA)!

An AMA is a live online event similar to a “YamJam” on Yammer or an “Ask Me Anything” on Reddit. This AMA gives you the opportunity to connect with members of the product engineering team who will be on hand to answer your questions and listen to feedback.

Join the Azure Active Directory team on the Microsoft Tech Community to discuss the public preview of Azure AD Password Protection and Smart Lockout announced here. The AMA will begin on Thursday, June 28th at 9am PT in the Azure Active Directory AMA group. 

• DATE/TIME:
  June 28th, 2018 9-10AM PT
• ADD TO CALENDAR:
  https://aka.ms/aadama/invite
• LOCATION:
  https://aka.ms/aadama

Azure Security and Compliance Blueprints are resources to assist you in building and launching cloud-powered applications that help you comply with stringent regulations and standards. Blueprints include:

• Industry-specific overview and guidance
• Customer responsibilities matrix
• Reference architectures with threat models
• Control implementation matrices
• Automation to deploy reference architectures

PCI DSS

• Azure Security and Compliance Blueprint – PCI DSS-compliant Payment Processing environments – The Payment Processing for PCI DSS-Compliant Environments provides guidance for the deployment of a PCI DSS-compliant Platform-as-a-Service (PaaS) environment suitable for handling sensitive payment card data. It showcases a common reference architecture and is designed to simplify adoption of Microsoft Azure.

HIPAA/HITRUST

• Azure Security and Compliance Blueprint – HIPAA/HITRUST Health Data and AI – The Azure Security and Compliance Blueprint – HIPAA/HITRUST Health Data and AI offers a turn-key deployment of an Azure PaaS solution to demonstrate how to securely ingest, store, analyze, and interact with health data while being able to meet industry compliance requirements. The blueprint helps accelerate cloud adoption and utilization for customers with data that is regulated.

GDPR

• Azure Security and Compliance Blueprint: Analytics for GDPR – This Azure Security and Compliance Blueprint provides guidance to deploy a data analytics architecture in Azure that assists with the requirements of the GDPR. This solution demonstrates ways in which customers can meet specific security and compliance requirements and serves as a foundation for customers to build and configure their own data analytics solutions in Azure.
• Azure Security and Compliance Blueprint: Data Warehouse for GDPR – This Azure Security and Compliance Blueprint provides guidance to deploy a data warehouse architecture in Azure that assists with the requirements of the GDPR.
• Azure Security and Compliance Blueprint – IaaS Web Application for GDPR – This Azure Security and Compliance Blueprint provides guidance to deploy an infrastructure as a service (IaaS) environment suitable for a simple Internet-facing web application. This solution demonstrates ways in which customers can meet specific security and compliance requirements of the GDPR and serves as a foundation for customers to build and configure their own IaaS web application solutions in Azure.
• Azure Security and Compliance Blueprint – PaaS Web Application for GDPR – This Azure Security and Compliance Blueprint provides guidance to deploy a platform as a service (PaaS) environment suitable for a simple Internet-facing web application. This solution demonstrates ways in which customers can meet the specific security and compliance requirements of the GDPR and serves as a foundation for customers to build and configure their own PaaS web application solutions in Azure.

UK-OFFICIAL

• Azure Security and Compliance Blueprint – UK-OFFICAL Three-Tier Web Applications Automation – This article provides guidance and automation scripts to deliver a Microsoft Azure three-tier web based architecture appropriate for handling many workloads classified as OFFICIAL in the United Kingdom.

FFIEC

• Azure Security and Compliance Blueprint – FFIEC Financial Services Regulated Workloads – This blueprint is designed to meet the requirements of stringent compliant standards set by the American Institute of Certified Public Accountants such as – SOC 1, SOC 2, the Payment Card Industry Data Security Standards council’s DSS 3.2, and FFIEC for the collection, storage, and retrieval of sensitive financial data. It demonstrates the proper handling of such data by deploying a solution that manages financial data in a secure, compliant, multi-tier environment. The solution is deployed as an end-to-end Azure-based PaaS solution.

FedRAMP

• Azure Security and Compliance Blueprint: Analytics for FedRAMP – This Azure Security and Compliance Blueprint provides guidance for how to deliver a Microsoft Azure analytics architecture that helps implement a subset of FedRAMP High controls. This solution provides guidance on the deployment and configuration of Azure resources for a common reference architecture, demonstrating ways in which customers can meet specific security and compliance requirements and serves as a foundation for customers to build and configure their own analytics solutions in Azure.
• Azure Security and Compliance Blueprint: Data Warehouse for FedRAMP Automation – This Azure Security and Compliance Blueprint provides guidance for how to deliver a Microsoft Azure data warehouse architecture that helps implement a subset of FedRAMP High controls. This solution provides guidance on the deployment and configuration of Azure resources for a common reference architecture, demonstrating ways in which customers can meet specific security and compliance requirements and serves as a foundation for customers to build and configure their own data warehouse solutions in Azure.
• Azure Security and Compliance Blueprint: IaaS Web Application for FedRAMP – This Azure Security and Compliance Blueprint Automation provides guidance for the deployment of a FedRAMP-compliant infrastructure as a service (IaaS) environment suitable for a simple Internet-facing web application.
• Azure Security and Compliance Blueprint: PaaS Web Application for FedRAMP – This Azure Security and Compliance Blueprint provides guidance for how to deliver a Microsoft Azure platform as a service (PaaS) architecture that helps implement a subset of FedRAMP High controls.

Distributed denial of service (DDoS) attacks are some of the largest availability and security concerns facing customers that are moving their applications to the cloud. A DDoS attack attempts to exhaust an application’s resources, making the application unavailable to legitimate users. DDoS attacks can be targeted at any endpoint that is publicly reachable through the internet.

Azure DDoS protection, combined with application design best practices, provide defense against DDoS attacks. Azure DDos protection provides the following service tiers:

• Basic: Automatically enabled as part of the Azure platform, at no additional charge. Always-on traffic monitoring, and real-time mitigation of common network-level attacks, provide the same defenses utilized by Microsoft’s online services. The entire scale of Azure’s global network can be used to distribute and mitigate attack traffic across regions. Protection is provided for IPv4 and IPv6 Azure public IP addresses.
• Standard: Provides additional mitigation capabilities over the Basic service tier that are tuned specifically to Azure Virtual Network resources. DDoS Protection Standard is simple to enable, and requires no application changes. Protection policies are tuned through dedicated traffic monitoring and machine learning algorithms. Policies are applied to public IP addresses associated to resources deployed in virtual networks, such as Azure Load Balancer, Azure Application Gateway, and Azure Service Fabric instances. Real-time telemetry is available through Azure Monitor views during an attack, and for history. Application layer protection can be added through the Azure Application Gateway Web Application Firewall. Protection is provided for IPv4 Azure public IP addresses.

…

Read more about Azure DDOS Protection here:

• DOCS: Azure DDoS Protection Standard overview
  https://docs.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview.

Still considering using Windows 10 Long Term Servicing Channel (LTSC) for desktop deployment? Think real hard.

The LTSC servicing option is designed for device types and scenarios where the key attribute is for features or functionality to never change.
It is a edition of Windows 10 that is specifically designed for special purpose devices such as embedded systems. To be clear, it is not designed for end user desktops. Examples of the intended target system for LTSC include systems that power manufacturing or medical equipment or embedded systems in kiosks such as ATMs or airport ticketing systems. (LTSC is also the same build as Windows IoT Enterprise, the next generation of Windows Embedded.)

The reason LTSC exists is that specialized systems—such as PCs that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. It’s more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Windows 10 Enterprise LTSC devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date.

To be clear, Long-term Servicing channel is not intended for deployment on most or all the PCs in an organization; it should be used only for special-purpose devices. As a general guideline, a PC with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it is better suited for the Semi-Annual servicing channel.

Here’s a list of considerations regarding the use of LTSC:
(Thank you to former Microsoft Southwest Windows Technology Specialist, Prasad Naik, for providing much of this background!)

1. No realization of Windows 10’s evolving value.
   Windows 10’s value in the semi-annual channel increases with every evolutionary release. Today’s 1803 release is a very different operating system from 1507 with added functionality that improves the end user experience, provides business value or mitigates risk. For example, RS3/1709 received a variety of invaluable endpoint security advancements including:
   1. Application Guard
   2. Exploit Guard
   3. Improved ransomware protection including Controlled folder access protections & Smart application whitelisting
2. Lack of support for new/old CPU architectures between releases.
   LTSC is designed specifically to the silicon available at the time of release & is architected for close alignment with that particular hardware. It will not receive new chipset support for hardware architectures (such as Intel’s Coffee Lake, Cannon Lake, and beyond) until subsequent full releases of LTSC. Users of LTSC are locked in to one non-evolving hardware standard, even as newer PC models displace an organization’s current standard. Because hardware vendors generally cease producing PCs with older architectures after a certain time, company’s may need to either warehouse/stock a certain number of your standard PCs to ensure they have them into the future, or negotiate long term purchasing agreements. Organizations using LTSC on desktops will generally also need to maintain multiple versions of LTSC for the hardware platforms they own.
3. Risk of not getting OS functional fixes for an improving experience.
   LTSC-based PCs are in some ways rolled out in “Extended support” from day 1 of deployment. While LTSC will receive security patches, it will not necessarily receive fixes associated with functionality. Features & functionality will be fixed regularly with the Semi-Annual Channel releases providing dramatically improved performance, security, stability and productivity. LTSC users will not necessarily get those fixes until the next release of LTSC.
4. Lack of common application support/compatibility such as Office 365 Pro Plus
   LTSC is not the same Windows 10 as semi-annual channel and lacks certain OS components that desktop applications, particularly legacy applications, can rely on. For example, common applications that do not work on Windows 10 LTSC include: Office 365 Pro Plus & Visual Studio
5. Loss of support for available Windows 10 security features
   The following security features do not exist on the LTSC 2016 release of Windows 10:
   1. Memory protection features
      1. Control Flow Guard (CFG) – a highly-optimized platform security feature that was created to combat memory corruption vulnerabilities
      2. Data Execution Prevention (DEP)
      3. Structured Exception Handling Overwrite Protection (SEHOP)
   2. Address Space Layout Randomization (ASLR)
   3. Hardening against recent zero-day exploits
      1. Win32k elevation of privilege
      2. Open type font elevation of privilege
      1. Windows Hello for Business on-premises
         
6. No support for Windows Analytics
   The capabilities of Windows Analytics to collect and present information to IT around Upgrade Readiness, Update Compliance, and Device Health across all enterprise PCs is not available to LTSC machines.

Gartner’s Recommendation
If you’d like to see what analysts say about the matter, here’s a research report that you can view online where Gartner discusses the impact and recommendations for use of LTSC:

• Rethink Windows 10 LTSB Deployment Based on Microsoft’s Updated Guidance
  https://www.gartner.com/doc/reprints?id=1-3V8VD56&ct=170309&st=sb

References:

• • https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview
  • https://support.microsoft.com/en-us/help/18581/lifecycle-faq-windows-products
  • https://blogs.windows.com/windowsexperience/2016/01/15/windows-10-embracing-silicon-innovation
  • https://blogs.windows.com/business/2016/08/11/updates-to-silicon-support-policy-for-windows
  • https://docs.microsoft.com/en-us/windows-hardware/design/minimum/windows-processor-requirements
  • https://docs.microsoft.com/en-us/windows/deployment/upgrade/upgrade-readiness-requirements
  • https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview#servicing-branches
  • https://www.visualstudio.com/en-us/productinfo/vs2017-system-requirements-vs
  • https://support.office.com/en-us/article/Change-management-for-Office-365-clients-9d9fc2d3-23e1-4309-8ae6-12ef5b6a8dcd?#branches
  • https://docs.microsoft.com/en-us/windows/deployment/upgrade/windows-10-upgrade-paths

Dependent upon the ISV / IHV:

• ISV – https://developer.microsoft.com/en-us/windows/ready-for-windows/get-listed
• IHV – https://support.microsoft.com/en-us/help/18581/lifecycle-faq-windows-products
• https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview#servicing-branches

On June 7 at 10:30a PT Nat Friedman did a Reddit “Ask Me Anything” (AMA) about Microsoft’s planned acquisition of GitHub, and our work with developers and open source.

Hi, I’m Nat Friedman, future CEO of GitHub (when the deal closes at the end of the year). I’m here to answer your questions about the planned acquisition, and Microsoft’s work with developers and open source. Ask me anything.

To review the archives of the AMA, visit the link below:

• INFO: Nat Friedman, future CEO of GitHub does a Reddit AMA
  https://www.reddit.com/r/AMA/comments/8pc8mf/im_nat_friedman_future_ceo_of_github_ama/