Azure Managed Disks - Simply Explained

Beschrijving

Welcome to another episode of Knowledge Nuggets with Mirko Peters. In this episode, we're exploring Azure Managed Disks, the storage technology that powers every Azure Virtual Machine. While many people simply attach a disk to a VM and move on, choosing the wrong managed disk can lead to unnecessary costs, poor performance, or both. You'll learn what Azure Managed Disks actually are, how they simplify storage management compared to the old unmanaged disk model, the five available disk types, redundancy options, encryption, snapshots, backups, and practical tips for selecting the right disk for every workload. WHAT ARE AZURE MANAGED DISKS? Azure Managed Disks are fully managed block storage volumes that Azure automatically provisions, maintains, replicates, and monitors for your virtual machines. Before managed disks were introduced, administrators had to manually create storage accounts, manage page blobs, monitor storage limits, and carefully distribute disks across multiple storage accounts to avoid performance bottlenecks. Managed Disks eliminate all of this complexity. You simply choose the disk size and performance tier while Azure handles storage accounts, replication, availability, durability, and scaling behind the scenes. By abstracting the storage infrastructure, Azure allows administrators to focus on applications instead of storage management while improving reliability, scalability, and operational simplicity. Managed Disks also automatically distribute storage across storage scale units, reducing the impact of hardware failures and increasing overall VM availability. UNDERSTANDING THE FIVE MANAGED DISK TYPES Azure offers five managed disk options designed for different performance and pricing requirements. Ultra Disk delivers Azure's highest storage performance with extremely low latency, configurable IOPS, and throughput for mission-critical workloads like SAP HANA, enterprise databases, and high-performance analytics. Premium SSD v2 provides enterprise-level performance while allowing storage capacity, IOPS, and throughput to be configured independently. This flexibility makes it one of the most cost-efficient options for modern production environments. Premium SSD remains a popular choice for predictable production workloads where performance scales with disk size. It delivers reliable low latency for business-critical applications and virtual desktops. Standard SSD balances affordability with SSD performance, making it ideal for development, testing, web servers, and moderate production workloads. Standard HDD offers the lowest storage cost and is best suited for backup data, archives, logs, and workloads where storage capacity matters more than speed. HOW DISK PERFORMANCE WORKS Azure Managed Disks are measured using three important performance characteristics. IOPS (Input/Output Operations Per Second) measures how many read and write operations a disk can perform every second and is particularly important for databases and transactional applications. Throughput measures how much data can be transferred every second, making it critical for file transfers, analytics, and media workloads. Latency measures how quickly data begins transferring after a request. Lower latency results in faster application response times and better user experiences. Premium SSD v2 and Ultra Disk allow administrators to configure IOPS and throughput independently from storage capacity, giving far greater flexibility than traditional disk sizing models. However, it's equally important to remember that Virtual Machines themselves also have storage performance limits, so disk performance should always be matched with the VM's capabilities. REDUNDANCY, SECURITY, AND DISK TYPES Azure protects managed disks using multiple redundancy models. Locally Redundant Storage (LRS) maintains three synchronized copies of your data inside a single datacenter, providing exceptional durability against hardware failures. Zone-Redundant Storage (ZRS) extends protection across multiple availability zones within the same Azure region, ensuring workloads remain available even if an entire datacenter experiences an outage. Within every virtual machine, Azure supports three different disk roles. The Operating System Disk contains Windows or Linux and is required for the VM to boot. Data Disks provide persistent storage for applications, databases, and business data, with multiple disks supported depending on VM size. The Temporary Disk offers extremely fast local storage but should never be used for important information because all data is lost whenever the VM is redeployed or moved to another host. Azure also supports Ephemeral OS Disks, enabling extremely fast VM deployments for stateless workloads such as Kubernetes clusters and virtual machine scale sets. ENCRYPTION, SNAPSHOTS, AND BACKUPS Security is built directly into Azure Managed Disks. All managed disks are automatically encrypted at rest using platform-managed encryption keys. Organizations requiring greater control can implement customer-managed keys through Azure Key Vault, while Encryption at Host provides an additional security layer protecting temporary disks and cached data. Snapshots create point-in-time copies of managed disks and are perfect for software updates, testing, and quick rollback scenarios. Azure Backup builds on snapshots by automating backup schedules, retention policies, Recovery Services Vault integration, and long-term disaster recovery. Together, these capabilities allow organizations to recover quickly from failures while meeting security, compliance, and business continuity requirements. COST OPTIMIZATION BEST PRACTICES One of the most common mistakes in Azure is paying for oversized managed disks. Azure charges based on the provisioned disk size, not the amount of storage actually used. Choosing appropriately sized disks, deleting unattached disks, selecting the correct redundancy option, and using Premium SSD v2 instead of Ultra Disk whenever possible can significantly reduce monthly cloud costs. Standard HDD remains an excellent option for backups and archive workloads, while monitoring Azure Cost Management helps identify unused storage resources and optimization opportunities before costs increase unnecessarily. KEY TAKEAWAYS Azure Managed Disks simplify storage management by removing the complexity of storage accounts while delivering enterprise-grade availability, security, and scalability. Understanding the differences between Ultra Disk, Premium SSD v2, Premium SSD, Standard SSD, and Standard HDD allows you to optimize both application performance and infrastructure costs. Selecting the right disk type, redundancy model, backup strategy, and encryption options ensures your Azure Virtual Machines remain secure, resilient, and cost-efficient as your cloud environment continues to grow. Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support [https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Agent-to-Agent (A2A) Communication - Simply Explained

Welcome to another episode of Knowledge Nuggets with Mirko Peters. In this episode, we're exploring Agent-to-Agent (A2A) Communication, the open protocol that allows AI agents to discover one another, delegate work, and collaborate as intelligent teams. Today's AI agents are often highly specialized but isolated. One agent may excel at booking flights, another at checking weather, and another at managing IT tickets—but without a common communication standard, connecting them quickly becomes a maintenance nightmare. A2A solves this problem by providing a standardized way for AI agents to communicate regardless of which vendor or platform they were built on. THE PROBLEM WITH ISOLATED AI AGENTS Most AI agents today operate independently. As organizations build more specialized AI solutions, every new capability often requires custom integrations between agents. A travel assistant may need to communicate with weather, hotel, calendar, and airline services. Without a standard communication protocol, developers must create individual integrations between every pair of agents. Over time these point-to-point integrations become difficult to maintain, expensive to scale, and highly fragile. Every new agent increases complexity, creating what many developers describe as "integration spaghetti." A2A addresses this challenge by introducing a common communication protocol that allows independent AI agents to cooperate without requiring custom bridges between every service. WHAT IS AGENT-TO-AGENT (A2A)? Agent-to-Agent (A2A) is an open communication protocol that enables AI agents to exchange requests, delegate tasks, and return results. A useful analogy is HTTP for websites. Just as web browsers and servers communicate using HTTP, AI agents can communicate using A2A regardless of which platform they run on. The protocol is supported by major technology companies including Microsoft, Google, Cisco, Salesforce, SAP, and others through the Linux Foundation, making it an industry standard rather than a proprietary technology. A2A is built on familiar web technologies including HTTP and JSON-RPC, allowing developers to adopt it using existing networking and API knowledge. A2A VS MCP A2A is frequently compared with the Model Context Protocol (MCP), but the two solve different problems. MCP connects AI agents to tools, APIs, databases, and external systems. A2A connects AI agents directly to other AI agents. Rather than competing technologies, they complement one another. An AI agent may use MCP to retrieve information from a CRM system and then use A2A to delegate another portion of the overall task to a specialist AI agent. This creates both vertical integration with business systems and horizontal collaboration between intelligent agents. AGENT CARDS Every A2A-compatible agent publishes an Agent Card. Think of it as a machine-readable business card or résumé describing what an agent can do. The Agent Card contains information such as: * Agent name * Description * Skills * Endpoint URL * Authentication requirements * Supported input formats * Supported output formats Agent Cards are published using a standard location (/.well-known/agent-card.json), allowing orchestrators to automatically discover specialist agents and understand their capabilities without manual configuration. This decentralized approach removes the need for a central registry while making it easy to introduce new agents into an existing ecosystem. HOW A2A COMMUNICATION WORKS Communication between agents takes place using standard HTTP requests carrying JSON-RPC messages. A2A supports three communication models depending on the workload. Instant responses are used for quick synchronous requests such as retrieving today's weather. Streaming responses allow agents to continuously report progress during longer-running operations using Server-Sent Events. Asynchronous tasks support workflows that may take minutes, hours, or even days. Each request receives a task identifier that allows progress tracking while the work continues in the background. Every interaction is represented as a task containing messages, structured content, attachments, or references to external files. Authentication relies on familiar technologies such as OAuth, bearer tokens, or API keys, making integration straightforward for enterprise environments. THE ORCHESTRATOR-SPECIALIST PATTERN Most production multi-agent systems follow the Orchestrator-Specialist architecture. The orchestrator receives the user's request, understands the overall objective, and decides which specialist agents should perform each part of the work. Specialist agents focus on a single business capability such as: * Flight booking * Hotel reservations * Weather forecasting * Ticket resolution * HR onboarding * Financial processing The orchestrator never performs the specialist work itself. Instead, it delegates tasks, waits for responses, and combines the individual results into a single answer for the user. Microsoft Copilot Studio uses this architecture natively, allowing a primary Copilot to coordinate child agents and connected agents through A2A. REAL-WORLD USE CASES A2A enables AI systems to collaborate across many business scenarios. A travel planning assistant can delegate weather forecasts, flight searches, and hotel recommendations to independent specialist agents before combining the responses into a complete itinerary. IT support workflows can automatically distribute work between diagnosis agents, remediation agents, and ticket management agents. Employee onboarding can coordinate IT provisioning, HR processes, facilities management, and security access across multiple days using asynchronous task tracking. Organizations are already adopting this model. Microsoft highlights customers using Copilot Studio and Dynamics 365 where orchestrated agents automate complex planning activities that previously required significant manual effort, reducing repetitive work while improving operational efficiency. MICROSOFT'S A2A ECOSYSTEM Microsoft has fully embraced A2A across its AI platform. Copilot Studio supports connected A2A agents, allowing developers to integrate agents hosted on Microsoft Azure, Google Cloud, AWS, or other A2A-compatible platforms. Adding a connected agent is straightforward. Developers provide the agent endpoint, Copilot Studio retrieves the Agent Card, understands the agent's capabilities, and automatically creates the necessary integration. Azure AI Foundry Agent Service also exposes A2A endpoints, enabling frameworks such as Semantic Kernel, LangChain, and AutoGen to interact with Azure-hosted agents. This open architecture allows organizations to build multi-agent ecosystems without being locked into a single cloud provider or AI framework. BENEFITS AND BEST PRACTICES The greatest strength of A2A is modularity. Organizations can introduce new specialist agents without redesigning existing workflows. Agents become reusable building blocks that can be replaced, upgraded, or expanded independently. When designing multi-agent systems, it is important to: * Keep specialist domains clearly separated * Avoid overlapping responsibilities * Let orchestrators coordinate rather than execute work * Minimize unnecessary delegation layers to reduce latency Following these principles creates scalable, maintainable AI architectures capable of growing alongside business requirements. Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support [https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Gisteren18 min

Microsoft Entra External ID - Simply Explained

Welcome to another episode of Knowledge Nuggets with Mirko Peters. In this episode, we're exploring Microsoft Entra External ID, Microsoft's modern Customer Identity and Access Management (CIAM) platform and the successor to Azure AD B2C. Whether you're building a customer portal, partner application, SaaS platform, or mobile app, every external user needs a secure and seamless way to sign up, sign in, and access your services. Microsoft Entra External ID provides exactly that while keeping customer identities separate from employee accounts and supporting modern authentication standards, social logins, and enterprise-grade security. WHY EXTERNAL ID EXISTS Managing customer identities has always been challenging. Organizations once built their own authentication systems, storing usernames and passwords, implementing password reset functionality, multi-factor authentication, and account management themselves. As applications grew, maintaining these systems became increasingly complex. Azure AD B2C helped solve many of these problems but introduced new challenges of its own. Administrators often struggled with complex XML-based custom policies, difficult troubleshooting, and a separate management experience from Microsoft Entra ID. Microsoft Entra External ID replaces Azure AD B2C with a more unified and simplified platform that removes much of this complexity while introducing a modern developer experience and improved administration. WHAT IS MICROSOFT ENTRA EXTERNAL ID? Microsoft Entra External ID is Microsoft's cloud identity platform for external users. Unlike Microsoft Entra ID, which manages employee identities inside an organization, External ID is designed specifically for customers, partners, guests, suppliers, contractors, and external applications. It provides the complete identity lifecycle, including: * User registration * Secure sign-in * Password reset * Profile management * Multi-factor authentication * Token issuance * Social identity providers The platform supports modern authentication standards including OAuth 2.0, OpenID Connect, and SAML, allowing developers to integrate almost any modern web, mobile, or enterprise application. THE THREE PRIMARY USE CASES Microsoft Entra External ID supports three major identity scenarios. Customer Identity (CIAM) The most common scenario is customer authentication for public-facing applications. Organizations can build branded sign-up and sign-in experiences while allowing customers to authenticate using providers such as Google, Facebook, or Apple. External ID issues secure tokens that applications use to identify authenticated users. This is the direct replacement for Azure AD B2C. Business-to-Business Collaboration (B2B) Organizations frequently need to give partners, suppliers, consultants, or vendors access to internal applications. External ID manages guest invitations, onboarding, account redemption, and access policies while keeping external collaboration under centralized identity management. Machine-to-Machine Authentication Applications often need to communicate securely without human interaction. External ID supports OAuth 2.0 client credentials, enabling APIs and backend services to authenticate securely when communicating with payment systems, microservices, analytics platforms, or other enterprise APIs. This scenario requires the Machine-to-Machine Premium capability. WORKFORCE TENANT VS EXTERNAL TENANT One of the most important architectural decisions is determining where external identities should be stored. A Workforce Tenant stores guest users alongside employee identities. This works well for B2B collaboration where only a limited number of external users require access to internal resources such as SharePoint, Teams, or Microsoft 365 applications. An External Tenant creates a completely separate identity directory dedicated to customer accounts. Using an External Tenant offers several advantages: * Complete separation of customer and employee identities * Independent branding and user experience * Reduced security risk * Better compliance boundaries * Native authentication APIs for mobile applications * Monthly Active User (MAU) licensing model For customer-facing applications with thousands or millions of users, Microsoft recommends using an External Tenant rather than storing customers inside the workforce directory. SECURITY FEATURES Microsoft Entra External ID inherits many of the enterprise security capabilities available throughout the Microsoft Entra platform. Organizations can enable: * Multi-factor authentication * Email or SMS one-time passcodes * Conditional Access policies * Risk-based authentication * Step-up authentication * Authentication contexts Step-up authentication is particularly useful because applications can require additional verification only when users attempt sensitive operations such as viewing invoices, downloading confidential documents, or modifying payment information. This creates a balance between user convenience and strong security without forcing MFA during every sign-in. BRANDING AND USER EXPERIENCE External ID allows organizations to customize their customer authentication experience. Administrators can configure: * Company logos * Brand colors * Background images * Headers and footers * Privacy and legal links * Custom CSS styling For mobile applications, the Native Authentication API provides an even smoother experience by allowing developers to build fully integrated login screens without browser redirects. Current limitations include tenant-wide branding rather than per-application branding, limited customization of built-in error messages, and some user profile management capabilities that still require custom development. MIGRATING FROM AZURE AD B2C Microsoft has announced Microsoft Entra External ID as the future of customer identity. Azure AD B2C remains supported until at least 2030, but new identity innovations—including passkeys, native authentication improvements, and fraud protection—are being developed exclusively for External ID. Migration strategies depend on tenant size. Smaller environments can perform a standard migration by creating a new External ID tenant, migrating users, and moving applications. Large organizations can use High Scale Compatibility (HSC) mode, allowing Azure AD B2C and External ID to operate together during a phased migration. One significant change is that Azure AD B2C's XML-based custom policies are not directly transferable. Organizations instead rebuild advanced authentication scenarios using User Flows and Custom Authentication Extensions. DEVELOPER EXPERIENCE Microsoft significantly improved the developer experience compared to Azure AD B2C. Developers can use: * Visual Studio Code integration * Microsoft Graph API automation * PowerShell scripting * REST APIs * Custom Authentication Extensions * Azure Functions Authentication events can trigger custom backend logic for validating attributes, enriching tokens with custom claims, integrating external systems, or customizing verification workflows. This modern extension model replaces the complex XML configuration previously required in Azure AD B2C, making advanced authentication much easier to maintain and automate. Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support [https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support?utm_source=rss&utm_medium=rss&utm_campaign=rss].

Gisteren14 min

Azure Managed Disks - Simply Explained

Beschrijving

Reacties

Probeer 14 dagen gratis

Alle afleveringen