A Guide to Azure Connection Types and Configurations

Azure offers several connection types, each with its own strengths and use cases.

Azure Service Bus is a messaging service that allows for loosely coupled, asynchronous communication between applications and services.

To establish a connection, you'll need to create a Service Bus namespace and configure the necessary settings, such as the connection string and namespace management.

You can use Azure Active Directory (AAD) to authenticate and authorize connections to Azure resources.

AAD provides a centralized identity and access management system that can be used to manage permissions and access to Azure resources.

Azure provides several authentication methods, including username/password, certificate, and OAuth.

Readers also liked: Azure Devops Use Service Connection in Powershell Task

You can connect to Azure through ExpressRoute Direct, which allows you to reach Microsoft's global network directly at global peering locations.

ExpressRoute Direct offers connectivity interfaces of either 10 Gbps or 100 Gbps, with various circuit SKU options available up to the interface data rate.

You'll typically need to order two cross connects from your rack directly to Microsoft's ExpressRoute Direct interfaces.

ExpressRoute Direct is a great option for customers who need high-speed, direct connectivity to Azure.

To establish a connection between your on-premises infrastructure and Microsoft cloud services, you'll need to create an ExpressRoute circuit, which represents a logical connection between your on-premises infrastructure and Microsoft cloud services.

An ExpressRoute circuit must be deployed with either a connectivity provider or ExpressRoute Direct, and it's essential to use an ExpressRoute circuit with any combination of ExpressRoute offerings.

To connect to virtual networks in Azure with ExpressRoute, you'll need to create a virtual network gateway, which helps to exchange IP routes between your Azure and on-premises networks and to route network traffic.

To monitor connectivity from on-premises hosts, the Azure Arc agent must be enabled on the host machines, which is supported on both Windows and Linux machines.

On a similar theme: Azure Cloud Connect

An ExpressRoute circuit is a logical connection between your on-premises infrastructure and Microsoft cloud services, deployed with either a connectivity provider or ExpressRoute Direct.

To connect to virtual networks in Azure with ExpressRoute, you'll need to create a virtual network gateway, which helps exchange IP routes between your Azure and on-premises networks and route network traffic.

You might enjoy: Connect to Azure Virtual Desktop

ExpressRoute connections don't route through the public internet, providing users with more reliability, faster speeds, consistent latency, and higher security.

To link circuits together for a private connection between your on-premises networks, you can connect multiple ExpressRoute circuits.

An ExpressRoute virtual network gateway is required to connect to virtual networks in Azure with ExpressRoute.

To monitor connectivity from Azure virtual machines, you need to install the Network Watcher Agent virtual machine extension, also known as the Network Watcher extension.

This extension is required for enabling end-to-end monitoring and accessing other advanced functionalities.

The Network Watcher extension is necessary for recognizing Azure virtual machines or virtual machine scale sets as monitoring sources.

You can find more information on how to manage the Network Watcher extension for Windows or Linux in the Azure documentation.

Broaden your view: Azure Connected Machine Agent

On-premises connectivity is a crucial aspect of network configuration, enabling you to connect your on-premises infrastructure to Microsoft cloud services.

To diagnose issues in your on-premises network, you can use the Connection monitor, which detects issues such as request timeouts, DNS resolution failures, and certificate-related issues.

You can view issues in your Azure network in the network topology, where you can see issues such as agent issues, VM state issues, and traffic blocked by local firewall issues or NSG rules.

For on-premises networks, Connection monitor detects issues such as request timed out, endpoint not resolved by DNS, and source unable to connect to destination.

To extend your on-premises networks to the Microsoft cloud over a private connection, you can use Azure ExpressRoute services, which provide more reliability, faster speeds, and higher security compared to public internet connections.

Here are some key differences in issues detected by Connection monitor for on-premises networks and Azure networks:

Remember to enable the Azure Arc agent on your on-premises host machines to monitor connectivity from on-premises hosts.

Network topology is built by merging the results of two operations, one of which is the traceroute command that gets all hops from source to destination.

You usually start by running a traceroute command, which gets the hops from source to destination. However, if the source or destination lies within Azure boundaries, you need to use an internal command that identifies a logical route based on network configuration.

A few hops in the merged result, mostly those within Azure boundaries, won't display latency values because the first operation doesn't usually identify any hops within Azure boundaries.

The internal command used is similar to the Network Watcher next hop diagnostics tool, which helps to identify the logical route within Azure boundaries.

You might enjoy: How to Connect to Azure Virtual Network

Monitoring and diagnostics are crucial components of Azure Connection. Connection monitor helps you diagnose issues in your network by detecting problems in your hybrid network and Azure.

You can view issues in the Azure network in the network topology. Connection monitor detects issues such as request timed out, endpoint not resolved by DNS, no hosts found, and source unable to connect to destination.

A different take: Azure App Insights vs Azure Monitor

For networks whose sources are on-premises VMs, Connection monitor can detect the following issues: request timed out, endpoint not resolved by DNS, no hosts found, source unable to connect to destination, and certificate-related issues.

Here are some common issues detected by Connection monitor for networks whose sources are Azure VMs:

Monitoring your network traffic is crucial for identifying potential issues and optimizing performance.

An ExpressRoute Traffic Collector is a tool that enables the sampling of network flows sent over an ExpressRoute circuit.

Network flow data can be further used for network traffic analysis and insights.

This data can help you understand where traffic is coming from, where it's going, and how it's being used, allowing you to make informed decisions about your network infrastructure.

Suggestion: Azure Data Studio Connect to Azure Sql

You can store monitoring data in the Log Analytics workspace, which is set up when you create a connection monitor. This allows you to keep your monitoring data for as long as you want.

A fresh viewpoint: Azure Data Studio vs Azure Data Explorer

Monitoring data is also available in Azure Monitor Metrics, where it's stored for 30 days by default. You can use this data to set metric-based alerts.

Metric-based alerts can be created from Connection monitor, Azure Monitor, or the Azure portal. You can set alerts based on metrics such as percentage of failed checks, round-trip time, and test results.

Connection monitor metrics include metrics like % Probes Failed, AverageRoundtripMs, ChecksFailedPercent, and RoundTripTimeMs. These metrics are generated according to monitoring frequency and have multiple dimensions like SourceName, DestinationName, and TestConfiguration.

Here are some key metrics and their descriptions:

By setting metric-based alerts, you can stay on top of any issues with your connection monitors and take action when needed.

Dashboards are a crucial tool for monitoring and diagnostics, providing a centralized view of system performance and health.

They can be customized to display specific metrics and data points, such as CPU usage, memory consumption, and error logs.

A well-designed dashboard can help identify issues before they become major problems, allowing for proactive maintenance and troubleshooting.

For example, a dashboard might display a warning when a server's CPU usage exceeds 80%, prompting the IT team to investigate and take action.

By providing real-time data and alerts, dashboards enable teams to respond quickly to issues and minimize downtime.

This can be especially useful for distributed systems, where a single dashboard can provide a unified view of multiple servers and services.

On a similar theme: Azure Problems

Network Issue Diagnosis is a crucial step in ensuring your network runs smoothly. Connection monitor helps diagnose issues in your network, including those in your hybrid network and Azure.

Issues in your hybrid network are detected by Log Analytics agents, while Azure issues are detected by the Network Watcher extension. You can view these issues in the Azure network topology.

For networks with on-premises VMs, Connection monitor can detect the following issues:

For networks with Azure VMs, Connection monitor can detect issues such as agent problems, VM state issues, and missing ARP table entries. Additionally, it can identify traffic blocked by local firewall issues or NSG rules.

For government entities and corporations that need high speeds, low latency, and high reliability, ExpressRoute and ExpressRoute Direct should be considered. These options provide access to all Azure services and are more expensive than VPN due to the private highway they access.

ExpressRoute manages data up to 10 Gbps, while ExpressRoute Direct adds a tenfold bump to 100 Gbps. High data rate users may find that ExpressRoute pays for itself with lower egress fees.

However, for hybrid applications with light traffic between on-premises hardware and the cloud, VPN Gateway is a better choice. It provides Azure's flexibility and access to all Azure services, but at the cost of slightly extended latency.

Here are some key considerations:

When choosing a connection, you'll want to consider the different types of connections available. You can create a connection monitor to monitor communication at regular intervals, informing you of changes in reachability and latency.

A connection monitor can be created in the Azure portal, ARMClient, or Azure PowerShell. You can also access Connection monitor in the Azure portal, under Network Watcher.

Worth a look: How to Connect to Aks from Azure Portal

A connection monitor includes entities such as connection monitor resources, endpoints, test configurations, and test groups. These entities can be used to create a connection monitor that suits your needs.

Here's an example of how sources and destinations are arranged in a test group:

You can add both on-premises machines and Azure VMs/scale sets as sources in a connection monitor. The endpoints can be on Azure or any other URL or IP address.

Connection monitors have the following scale limits, which you should keep in mind when creating one.

Choosing the right connection for your needs can be a daunting task, but understanding the benefits of different options can help.

One of the key benefits of using Connection Monitor is its ability to provide a cross-subscription, cross-workspace monitoring experience for Azure and Hybrid cloud environments.

With Connection Monitor, you can also enjoy high probing frequencies and visibility into network performance.

For your interest: Azure Cloud Monitoring

You can monitor both source and destination endpoints, including Azure VMs, virtual machine scale sets, and Arc enabled on-premises hosts.

Destination endpoints don't require the Network Watcher extension, making it easy to set up.

Connection Monitor also supports connectivity checks based on HTTP, TCP, and ICMP, giving you a comprehensive view of your network.

Here are some of the features that make Connection Monitor so powerful:

ExpressRoute, on the other hand, offers dedicated data that bypasses the public internet, resulting in higher bandwidth and reliability, and lower and more consistent latency.

This private connection also enhances security by keeping your data off the internet.

ExpressRoute features include Layer 3 connectivity between on-premises and Microsoft Cloud, dynamic routing between your network and Microsoft via BGP, and built-in ExpressRoute redundancy in every peering location.

You can choose from scalable data rates from 50 Mbps to 10 Gbps, making it suitable for various business needs.

ExpressRoute manages data up to 10 Gbps, while ExpressRoute Direct can handle speeds of up to 100 Gbps, making it a better option for high-speed users.

For government entities and corporations that need high speeds, low latency, and high reliability, both ExpressRoute products should be considered.

ExpressRoute and ExpressRoute Direct provide access to all Azure services and tend to be more expensive than VPN due to the private highway that you’re accessing.

Heavily regulated industries, such as banking, government, and retail, sometimes require dedicated and isolated connectivity; ExpressRoute Direct provides the necessary physical isolation.

ExpressRoute Direct can get expensive, with a 100Gbps ER Direct Port Pair costing over $50,000 per month.

Enterprise IT teams have Active/Active connectivity at scale with ExpressRoute Direct, allowing them to manage peering traffic as needed.

Connection monitor relies on lightweight executable files to run connectivity checks, supporting both Azure and on-premises environments.

The executable file you use depends on whether your VM is hosted on Azure or on-premises.

Connection monitor only supports Arc-enabled on-premises hosts as source endpoints, and Log Analytics agent is no longer supported for monitoring on-premises machines with Connection monitor.

Monitoring extensions for Azure and non-Azure endpoints are automatically enabled when you use the Azure portal to create a connection monitor.

Choosing a connection can be a daunting task, but it's essential to consider the specific needs of your application. For instance, if you have a hybrid application with light traffic between on-premises hardware and the cloud, you might want to consider VPN Gateway.

However, if you're dealing with high data transfers, VPN Gateway might not be the best choice due to its extended latency. Instead, you can explore other options that provide flexibility and access to all of Azure's services.

One of the key considerations is network connectivity. For example, if you have a multi-tier application with front-end web servers and database servers, you'll want to ensure that they can communicate effectively. Connection Monitor can help you check network connectivity between these servers.

You can also use Connection Monitor to compare latencies between different regions, such as between the East US and Central US regions. This can be particularly useful if you have offices in different locations and want to optimize your application's performance.

Here are some specific use cases for Connection Monitor:

Choosing a Connection can be a daunting task, but understanding the benefits of different options can make all the difference. Cross-subscription, cross-workspace monitoring experience is available with Connection Monitor, making it easier to manage your Azure and hybrid cloud environments.

The Connection Monitor also supports high probing frequencies and visibility into network performance, giving you a clear picture of your network's health. This is especially useful for Azure and hybrid deployments, where quick alerting is crucial.

One of the biggest benefits of ExpressRoute is its dedicated data connection, which bypasses the public internet and provides higher bandwidth and reliability. This means lower and more consistent latency, making it ideal for applications that require real-time communication.

ExpressRoute Direct takes this a step further, offering dual 100 Gbps or 10 Gbps connectivity, as well as Active/Active connectivity at scale. This makes it perfect for heavily regulated industries, such as banking and government, which require dedicated and isolated connectivity.

Readers also liked: Azure Hybrid Connection

Azure VPN Gateways are also a popular choice, offering speed of deployment, seamless accessibility from anywhere, and encrypted traffic. They're easy to set up and provide scalability and resiliency, making them a great option for enterprises.

Here are some of the key benefits of different connection options:

Workspace admins can't connect their own storage account by default, but Fabric administrators can turn on a setting to allow this. This feature is called workspace-level storage permissions.

To activate this feature, go to Admin portal > Azure connections > Connect to Azure resources > Workspace-level storage permissions, and check the Allow workspace admins to connect their own storage account checkbox.

Fabric administrators can also configure activity logging in Tenant settings > Audit and usage settings > Azure Log Analytics connections for workspace administrators.

To create an Azure Resource Manager service connection, you can use either workload identity federation or an existing service principal. If you choose workload identity federation, you'll need to have the Owner role for your Azure subscription, not be connecting to Azure Stack or Azure US Government environments, and ensure that any Marketplace extensions tasks support workload identity federation.

You can create a service connection using an existing service principal by selecting Service principal (manual) and entering the service principal ID, credential, tenant ID, and verifying the settings.

A different take: Failed to Connect to Azure Storage

To create a service principal, you need to have the Owner role for your Azure subscription. You can't use this approach if you're connecting to the Azure Stack or the Azure US Government environments.

You can create a service principal by selecting New service connection, then selecting Azure Resource Manager and Next. From there, you'll select Service principal (manual) and Next.

In the New Azure service connection dialog, select the Environment, which can be Azure Stack, and enter the environment URL if necessary. You'll also need to select the Scope Level, which can be Subscription or Management Group.

To authenticate, you'll need to enter or select the Service Principal Id, Credential, Tenant Id, and Verify the settings. You'll also need to enter the Connection Name, Description, and Security settings.

Discover more: Azure Ad Connect Move to New Server

Workspace Storage Permissions are a crucial aspect of maintaining control and security in your workspace. By default, workspace admins can't connect their own storage account.

A fresh viewpoint: How to Get Azure Blob Storage Connection String

This feature lets Fabric administrators turn on a setting that allows workspace admins to connect their own storage account. It's a simple toggle that can be accessed by navigating to the Admin portal.

To activate this feature, go to Admin portal > Azure connections > Connect to Azure resources > Workspace-level storage permissions, and check the Allow workspace admins to connect their own storage account checkbox.

Fabric administrators can find and configure activity logging in Tenant settings > Audit and usage settings > Azure Log Analytics connections for workspace administrators. For more information, see Allow workspace level logging from the admin portal.

To configure workspace-level log analytics permissions, you need to navigate to Tenant settings. This is where you'll find the Audit and usage settings, which include the Azure Log Analytics connections for workspace administrators.

Fabric administrators can configure activity logging in Tenant settings, which is a crucial step in managing workspace-level log analytics permissions.

Broaden your view: What Is an Azure Tenant

You can quickly convert an existing Azure Resource Manager service connection to use workload identity federation for authentication instead of a secret. This process is available in Azure DevOps if your service connection meets certain requirements.

To convert a service connection, go to Project settings > Service connections, select the connection you want to convert, and then select Convert. You'll see a confirmation prompt to create a new service connection, which might take a few minutes.

If you want to revert a converted service connection, you can do so within seven days. To revert, go to Pipelines > Service connections, select the service connection you want to revert, and then select Revert conversion to the original scheme. You'll see a confirmation prompt to confirm your choice.

Alternatively, you can use a script to update multiple service connections at once to use workload identity federation for authentication. This requires PowerShell 7.3 or newer and Azure CLI.

Worth a look: Azure Auth Json Website Azure Ad Authentication

If you have multiple Azure Resource Manager service connections to convert, using a script can be a convenient option. You'll need to use a PowerShell script that requires Azure DevOps organization and project parameters.

The script will then retrieve the associated service connections for your Azure DevOps project and organization. It updates these service connections via the Azure DevOps REST API to utilize workload identity federation.

You'll be prompted to confirm the update for each connection not already using it. The script requires PowerShell 7.3 or newer and Azure CLI to run.

To run the script, save it to a .ps1 file and run it using PowerShell 7. Here are the steps to follow:

This approach can save you time and effort, especially if you have a large number of service connections to convert.

You can revert a service connection that uses a secret if it was converted automatically within the last seven days. After seven days, you'll need to manually create a new secret.

To revert a service connection, go to Pipelines > Service connections in your Azure DevOps project.

Select an existing service connection to revert.

Click Revert conversion to the original scheme to initiate the reversion process.

Select Revert again to confirm your choice.

You can use a script to update multiple Azure Resource Manager service connections at once to now use workload identity federation for authentication.

The script requires two parameters: Azure DevOps organization and Azure DevOps project.

You can retrieve the associated service connections for your Azure DevOps project and organization using the script.

The script updates these service connections via the Azure DevOps REST API to utilize workload identity federation.

You're prompted to confirm the update for each connection not already using it.

The script requires PowerShell 7.3 or newer and Azure CLI to run.

Save the script to a .ps1 file and run it using PowerShell 7.

You can use this script to convert multiple service connections at once.

Additional reading: Upgrading Azure Ad Connect

Azure Direct is a game-changer for large-scale data ingestion and storage needs.

With ExpressRoute Direct, you can connect directly to the Microsoft global network at speeds of 10 Gbps and 100 Gbps.

This dedicated dual capacity is available in both 10 Gbps and 100 Gbps, making it perfect for clients that generate huge amounts of data.

ExpressRoute Direct provides physical isolation for heavily regulated industries, such as banking, government, and retail.

This physical isolation is a must-have for industries that require strict security and compliance.

The cost of ExpressRoute Direct can be steep, with a 100 Gbps ER Direct Port Pair costing over $50,000 per month.

However, for clients that need high speeds, low latency, and high reliability, ExpressRoute Direct is a worthwhile investment.

ExpressRoute Direct provides access to all Azure services, making it a great option for government entities and corporations that need high-speed connectivity.

It's worth noting that ExpressRoute Direct is more expensive than VPN, but the lower egress fees can make it pay for itself for high data rate users.

By connecting directly to the Microsoft global network, ExpressRoute Direct users can enjoy faster speeds, consistent latency, and higher security.

This is especially important for clients that need to manage massive database and storage needs, such as large retailers and government agencies.

Check this out: Azure Direct Connect

Azure Virtual WAN is a single interface that simplifies networking, security, and routing through a hub-and-spoke architecture. This means you can easily connect to cloud destinations and services.

Azure Virtual WAN offers a range of benefits, including branch connectivity, site-to-site VPN connectivity, and remote user VPN connectivity. You can also use it for private connectivity, intracloud connectivity, and VPN ExpressRoute interconnectivity.

Here are the benefits of Azure Virtual WAN in more detail:

Choosing Virtual WAN can be a great option for businesses with a global reach. It's perfect for multinational corporations with branch offices scattered across the world.

Virtual WAN can link these branch offices, making it easier to manage and connect them. This is especially useful for companies with a large number of remote locations.

Data connections can be expanded, reduced, or rerouted seamlessly through Virtual WAN. This flexibility is a big advantage for businesses that need to adapt quickly to changing circumstances.

Virtual WAN can also link IoT devices, such as point of sale devices, and virtual desktops. This allows for a more integrated and streamlined experience for users.

Overall, Virtual WAN is a powerful tool for businesses with complex connectivity needs.

Recommended read: Azure Devices

Azure Virtual WAN is a single interface that simplifies networking, security, and routing through hub-and-spoke architecture. This architecture is automated and updated behind the scenes, making it easy to manage.

Azure Virtual WAN allows you to combine ExpressRoute and VPN connectivity to access Microsoft Azure from outside. This gives you flexibility and options for connecting to cloud destinations and services.

You can use Virtual WAN's hub-and-spoke architecture to diversify ways to connect to cloud destinations and services. This is made possible by Microsoft's automation of connectivity setup and configuration.

Here are the benefits of Azure Virtual WAN:

Azure Virtual WAN provides a range of connectivity options, including branch connectivity, site-to-site VPN, and remote user VPN. These options are made possible by the automation of connectivity setup and configuration.

Here's an interesting read: Aws to Azure Connectivity

Azure VPN is a popular choice for connecting to Azure due to its speed of deployment, seamless accessibility from anywhere, and ease of use. It's also encrypted, so you can rest assured that your traffic is secure.

There are two main types of VPNs: Site to Site and Point to Site. Each has its own features, including throughput, routing, and pricing, so it's essential to choose the one that suits your needs.

One of the benefits of Azure VPN is that users can access the VPN gateway remotely with their devices, including laptops, tablets, phones, and IoT devices.

Enterprises pay for Azure VPN based on the VPN Gateway sizing and the amount of Egress Data sent. This means you only pay for what you use, which can help keep costs down.

Azure VPN has a bandwidth of up to 10 Gbps, making it suitable for most businesses. However, it's not recommended for high data transfers.

Here are some key features of Azure VPN:

Azure VPN is particularly useful for hybrid applications where the traffic between on-premises hardware and the cloud is light. It's also a good choice for small organizations, especially those prototyping and developing products.

Azure Resources are a crucial part of the Azure connection. They provide a centralized platform for managing and monitoring Azure services.

Azure offers a wide range of resources, including virtual machines, storage accounts, and databases. These resources can be easily managed and scaled as needed.

Azure Virtual Machines (VMs) are a popular resource for deploying and managing virtualized servers in the cloud. They can be customized to meet specific needs and requirements.

Storage accounts are another essential resource in Azure, providing a secure and scalable way to store and manage data. They can be used to store files, images, and other types of data.

Azure Databases, such as Azure SQL Database and Azure Cosmos DB, offer a range of database services for storing and managing structured and unstructured data.

Readers also liked: Connect to Azure Sql Database from Ssms