Lets get hybrid! How to bring your best practices into the cloud - Jodi Boone - PSConfEU 2023

Complete title
Let 's get hybrid! Demo session on how to bring your best practices into the cloud

Summary
In today's episode titled "Let's Get Hybrid," we dive into the topic of bringing best practices into the cloud through a demo session. We are excited to have this opportunity thanks to our sponsors. My name is Jody Boone, a PM at Microsoft, and I will be your main speaker for this session. Before we get started, I share a bit about myself, including my interests in pottery, hiking, and skiing.

Moving on, we discuss the concept of auto-managed machine configuration, which allows us to configure operating system and app settings as code in a cloud-native and declarative manner. This configuration can be applied to both Windows and Linux machines running in Azure and connected through Arc-enabled servers. We highlight the importance of continuous auditing and enforcement capabilities to monitor and maintain desired configurations. Additionally, we explain the role of Arc-enabled servers, which include servers from various sources such as private data centers, AWS, GCP, etc., all connected through the AZCM agent.

Next, we explore two approaches for automated machine configuration. The first approach utilizes built-in content provided by Microsoft, focusing on server security posture. The second approach offers extensibility through PowerShell DSC. Throughout the session, we will demonstrate new resources and provide instructions for using them in multi-cloud environments.

We then highlight three ways to utilize the service: point-and-click deployment with auto-managed machine best practices, using Azure Policy to deploy data plane level policies at scale, and developing configuration as code pipelines using Azure Resource Manager integrated with CI/CD pipelines through GitHub Actions.

To set the stage, we explain that the service aims to simplify configuring settings inside machines using Azure Resource Manager. We emphasize the first-class support for both Linux and Windows machines, as well as native support for Azure Native VMs and Arc-enabled servers. Additionally, we discuss the advanced reporting capabilities and the ability to have multiple configurations for individual machines. The service also offers built-in content and custom configuration support through tooling like the PowerShell module. We mention the various management interfaces supported, including PowerShell, Azure Portal, Azure CLI, Bicep, and Terraform.

Another key aspect we focus on is the continuous monitoring provided by the service. We delve into the auditing and compliance process, mentioning the default one-hour interval for the getTestSet cycle, which can be configured according to requirements.

We then share some exciting updates since the last psconfvue conference. These include making remediation capabilities generally available, allowing users to configure and audit OS upper workload level settings. This can be done through three different methods: audit only, apply and monitor, and apply and auto-correct.

Other notable releases include expanded distro support for Linux, enhanced PowerShell integration, and built-in content for Azure policy definitions. The built-in content encompasses features like disabling local user authentication, setting secure communication protocols, and improvements to the Azure Compute Security baseline.

On the Linux side, we introduce the new module called NxTools, which provides DSC resources and built-in configurations for Linux, making it easier for the DSC community to develop on Linux. The module covers various operations such as user and group management, file system operations, package management, service management, and archive operations.

Furthermore, we discuss the tooling provided through the PowerShell module, which allows users to get started with machine configuration. This workflow involves wrapping the configuration document and required DSC resources into a package, uploading it to publicly accessible storage, generating a custom policy definition, and deploying it using AZ cm…