Azure configuration management: the challenges and how to do it right

Cloud based platforms like Microsoft Azure are designed to make sharing, saving, storing and collaborating possible across multiple locations. They provide flexibility and agility through an on-demand network-based model that connects users with their applications, no matter where they are in the world.

As such, many modern applications, especially those running in a cloud, are likely to have many different components, distributed in different ways and from different points. Each cloud-based application stack is a digital asset that is critical to the business.

There are multiple applications running through different geographical locations, and a single solution can have different services running on various platforms like Virtual Machines, serverless functions, App Services and more. This is where app configuration is necessary.

Managing app configuration settings across various components is difficult, and when issues arise, troubleshooting can be incredibly challenging – particularly if the lead Azure consultant is no longer actively managing the configuration or a clear framework for configuration hasn’t been established.

Microsoft configuration management can provide a centralised location to store your application configurations, in order to help tackle these issues. Furthermore, by separating configuration from code, App Configuration settings can be used to store all the settings for your application and secure their accesses in a single location, keeping application configuration settings external and accessible for those granted access.

There are many reasons why businesses put the necessary time and effort into app configuration when using Azure, utilising configuration settings to make the most of Azure services and developing progress in the vein of Azure VMs. Azure is one of the most popular cloud-based platforms available to businesses, but it can also turn costly if effective managerial steps aren’t taken. This is where cost management and configuration management become necessary.

Azure key vault is a cloud service used to securely store and access sensitive information, including API keys, passwords, certificates and cryptographic keys. Key vault services support two main types of containers: vaults and managed hardware security module pools (HSM).

On the surface, this may sound similar to Azure app configuration, but they are two separate services. However, Azure configuration management complements Azure key vault, helping to bolster the security of the secrets stored. App configuration is designed in order to be used in a distinct set of cases, helping developers to manage application settings and control which features are available at any one time. Through this, it aims to simplify a great many of the tasks involved in working with complex configuration data.

As Microsoft Azure offers hundreds of products and services, it can be a big task to keep them all configured properly in a way that best suits your organisation. Several factors can determine configuration issues, such as the popularity of the service, security exposure risk, interactions with other services and control. These kinds of results can be drawn from configuration audits. Some of the most common Azure configuration challenges and best practices, regarding leading Azure services and applications, are listed below.

– Centralising the distribution and management of hierarchical configuration data for a variety of different environments and geographies.

– Changing application configuration settings dramatically without the need to redeploy or restart an entire application, simplifying the process and cutting down adjustment periods.

– Controlling the availability of features in real time in order to meet your business’s current requirements.

Azure app configuration supports a wide range of essential services, including hierarchical namespaces, extensive queries, batch retrieval, labelling, feature management user interfaces and specialised management operations.

NSGs are arguably one of the most fundamental security resources provided by Azure, filtering network traffic to and from resources in an Azure virtual network. Most Azure services can be deployed into a virtual network service, such as Azure Functions, Azure Container Instances and Redis Cache. These security groups that are created contain the security rules that determine which inbound traffic is allowed and which is denied to and from several types of key Azure resources.

Accidental exposure must be tackled by putting the right rules in place. Change the settings on your NSGs to ensure that all default security groups block all traffic by default.

The operational risk and compliance requirements for companies using the cloud differ in several respects from those using legacy “on-premise” services. While migrating to the cloud is now considered standard practice for a host of organisations across a range of sectors and industries, it presents a raft of risks and compliance issues that many companies overlook.

However, it is crucial to understand and manage the different challenges arising from cloud service adoption – be it Azure or another platform – to avoid trouble further down the line. This is particularly true for financial institutions or those organisations working within the finance or fintech space, where compliance requirements are rigorous.

Importantly, accountability for risk does not transfer to the cloud provider as part of cloud migration and so the responsibility lies with the organisation to have a firm handle on risk from the outset.

Blob storage from Microsoft Azure allows for secure and scalable object storage for unstructured data. This means that data consistency and access flexibility are possible without having to deploy a variety of database systems. As such, blob storage is useful alongside a host of other Azure services, such as PaaS and more. It uses Azure AD roles to allow for consistent user permissions across all the relevant services.

It’s important to ensure that blob containers require authentication, which is why it is important to enable blob container private access configuration. When blob containers are set with public access, anonymous users can read blobs in a publicly accessible container without authentication. Access requirements ensure that data is only visible to those who need to see it.

Understanding Azure settings and how to configure and govern them appropriately is a distinct advantage when it comes to getting the most out of Azure virtual machines, on premises infrastructure and Azure services in general. Putting the right configurations in place can help you ensure that Microsoft Azure is working for your business in a way that suits your specific needs, reducing the risk of a data breach.

As the name suggests, AKS is designed to offer a highly secure, accessible and fully managed Kubernetes service. Through AKS, Microsoft Azure provides users with a way to deploy faster and manage containerised configured applications with greater ease and success. As well as serverless Kubernetes, Azure AKS also integrates with popular CI/CD, security and governance tools, providing one platform for your development and operations teams to help smooth out and speed up the building and deployment of your applications.

With AKS, it’s important to make sure that the right teams and users have the right access to each part of the services. In order to do this successfully, it’s vital to utilise RBAC in AKS (role-based access control). This allows you to manage who has access to which Azure resources, what they can do with those resources and what areas they have access to. These can be based on roles in Azure AD.

From a risk management perspective, this is incredibly important to any organisation deploying Azure, and so it is vital to utilise this tool effectively.

Making the most of Azure virtual machines and Azure app configuration is particularly important for financial institutions and fintech companies. Because these kinds of organisations often need to be FCA regulated, they need to be able to demonstrate the ability to recover from a ransomware attack when prompted. Helping businesses achieve cybersecurity compliance is one of the many strengths that Azure can provide for businesses, and it’s also one that is made even more robust with expert insight from Syntax.

System Garden gives any and all businesses the vital help they need to map, track and control cloud resources to achieve cost, risk and compliance goals.Without this essential framework, companies can quickly find costs spiralling out of control and governance for Azure become disjointed and disparate.

At Syntax, we help clients to effectively manage and monitor the Azure platform through a unique tool called System Garden. This utilises a “template deployment” approach to the platform, creating a framework, within which the multitude of tools and solutions offered by Azure can be handled effectively and cost, risk and compliance tracked with ease.

At Syntax we utilise System Garden specifically to tackle the challenges that many enterprises face retaining control and accountability over Azure once implemented. Importantly, the framework provided by System Garden also ensures business continuity, so even if an organisation’s Azure expert moves on to pastures new, the incoming consultant or team member can quickly understand how Azure has been implemented to date.

The dynamic nature of cloud infrastructure with regular catalogue updates, new applications and scaling means that configuration drift will inevitably occur. This can lead to cost and compliance violations.

To counteract these issues an effective infrastructure track and control framework is needed, with Azure configuration management as a core component. Digital assets can include intellectual property, customer databases and financial information, so in order to ensure that risks relating to these elements are minimised, businesses require a suitable framework to provide control over policies, processes and procedures.