Differences

This shows you the differences between two versions of the page.

--- azure:az-104_2024:azure_compute [2024/10/03 15:50] – [Availability and Scale Sets] mmuze
+++ azure:az-104_2024:azure_compute [2024/10/04 20:38] (current) – [Customer Domain] mmuze
@@ Line 19: / Line 19: @@
   * For VM ARM templates the //offer// attribute is the general server type (e.g. WindowsServer, LinuxServer) and the //SKU// attribute is the specific OS (e.g. 18.04-LTS, 2019-Datacenter).
+====== Just-In-Time (JIT) VM access ======
+  * When JIT access is enabled NSG or Azure Firewall rules are added to block inbound access for specific management ports (e.g. 3389, 22 etc).
+  * When access is needed a user makes a request to access a VM. If the request is approved, Defender for Cloud configures the NSGs and Azure Firewall to allow inbound traffic to the selected ports from the relevant IP address (or range), for the amount of time that was specified.
+<callout type="warning">
+JIT does not support VMs protected by Azure Firewalls controlled by Azure Firewall Manager. The Azure Firewall must be configured with Rules (Classic) and cannot use Firewall policies.
+</callout>
+====== Bastion ======
+  * [[https://learn.microsoft.com/en-us/azure/bastion/configuration-settings]]
+  * [[https://learn.microsoft.com/en-us/azure/bastion/configuration-settings#skus]]
+<callout type="info">
+Downgrading a SKU is not supported. To downgrade, you must delete and recreate Azure Bastion.
+</callout>
+  * In addition to having a web client interface for RDP/SSH access Bastion supports using native/local RDP/SSH clients.
+    * This requires the Standard SKU.
 ====== Availability Sets ======
   * [[https://learn.microsoft.com/en-us/azure/virtual-machines/availability-set-overview]]
@@ Line 44: / Line 59: @@
 ====== App Service ======
   * App Service <color :#fff200>plans that have no apps associated with them still incur charges</color> because they continue to reserve the configured VM instances.
+    * Consequently, you should try to minimize the number of App Service Plans that are used.
-===== Customer Domain =====
+===== Custom Domain =====
   * [[https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain]]
   * If you want to map a root domain to an App Service name you have to use an ''A'' record for app IP address, because ''CNAME'' records are not support for root/apex domain records. If you want to map a subdomain name to an App Service name you should use a ''CNAME'' record.
@@ Line 71: / Line 87: @@
 ====== Azure Kubernetes Service (AKS) ======
+<callout type="warning">
+I have discovered that the current AZ-104 exam does not include questions about AKS. But, for now, I'm leaving this info here.
+</callout>
   * Microsoft Entra authentication is provided to AKS clusters with OpenID Connect. OpenID Connect is an identity layer built on top of the OAuth 2.0 protocol.
 ===== Networking =====