legi, intellexi

Read about System managed Identity (SMI): https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-arm https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-sql https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad Using SMI with App service to access Azure SQL databases https://azure.microsoft.com/en-us/blog/securing-azure-sql-databases-with-managed-identities-just-got-easier/ <# VM access configuration: 1. Azure Resources - NOT required if only accessing SQL DBs and not Azure resources Navigate to the tab for Resource Groups.     Select the specific Resource Group you created for your Windows VM.     Go to Access control (IAM) in the left panel.  ...

To log into your Azure SQL Database with a Security principal do the following: Create an Azure AD security group Add this AAD group as Azure Administrator to your Azure SQL server  Obtain Access Token Connect to Azure SQL Server with the access token for step #3 use this function # # Based on # https://blogs.technet.microsoft.com/stefan_stranger/2018/06/06/connect-to-azure-sql-database-by-obtaining-a-token-from-azure-active-directory-aad/ # Function Get-AADToken { [CmdletBinding()] [OutputType([string])] PARAM ( [String]$TenantID, [string]$ServicePrincipalId, [securestring]$ServicePrincipalPwd ) Try { # Set Resource URI to Azure Database $resourceAppIdURI = 'https://database.windows.net/' # Set Authority to Azure AD Tenant $authority = 'https://login.windows.net/' + $TenantId $ClientCred = [Microsoft.IdentityModel.Clients.ActiveDirectory.ClientCredential]::new($ServicePrincipalId, $ServicePrincipalPwd) $authContext = [Microsoft.IdentityModel.Clients.Act...

-- Execute in Master and User DB SELECT DISTINCT  @@SERVERNAME ServerName , db_name() DbName , principal_id , pr.name , pr.type_desc , pr.authentication_type_desc , pe.state_desc , pe.[permission_name] FROM sys.database_principals AS pr JOIN sys.database_permissions AS pe ON pe.grantee_principal_id = pr.principal_id;

select @@SERVERNAME ServerName , db_name() DbName , DATABASEPROPERTYEX(DB_NAME(),'Edition') Edition , DATABASEPROPERTYEX(DB_NAME(),'MaxSizeInBytes') MaxSizeInBytes , DATABASEPROPERTYEX(DB_NAME(),'Updateability') Updateability , DATABASEPROPERTYEX(DB_NAME(),'ServiceObjective') ServiceObjective , A1.Name , A1.create_date , A1.modify_date , A2.audit_action_name from sys.database_audit_specifications a1 JOIN sys.database_audit_specification_details A2 on A1.database_specification_id = a2.database_specification_id

To enable Azure SQL Server audit: - in Azure Portal Enable Audit for the SQL Server (and select the destination, e.g. Storage Account) - Start the shell from within the Portal - run this command (replace the names in yellow with your names): Set-AzureRmSqlServerAuditing -State Enabled -ResourceGroupName " rg-bdocloudops " -ServerName " bdocloudops " -AuditActionGroup APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, USER_CHANGE_PASSWORD_GROUP, DATABASE_OPERATION_GROUP Check if the last group (DATABASE_OPERATION_GROUP) causes too many events and ...

These database operations Create database Copy database. Database Copy creates a record in this view on both the source and target servers. Alter database Change the performance level of a service tier Change the service tier of a database, such as changing from Basic to Standard. Setting up a Geo-Replication relationship Terminating a Geo-Replication relationship Restore database Delete database can be monitored using the  sys.dm_operation_status in the master database

Here is the link Here is the text Create a NAT virtual network switch New-VMSwitch -Name "InternalNATSwitch" -SwitchType Internal View the properties of the switch and note the ifIndex for the new adapter. Get-NetAdapter Create an IP address for the NAT Gateway. New-NetIPAddress -IPAddress 192.168.0.1 -PrefixLength 24 -InterfaceIndex 13 where  InterfaceIndex -  ifIndex  is the interface index of the virtual switch created in the previous step Create the NAT network New-NetNat -Name "InternalNat" -InternalIPInterfaceAddressPrefix 192.168.0.0/24 Create the guest virtual machine Configure the virtual machine to use the new Internal network you created.  Configure DHCP to dynamically assign an IP address to the guest virtual machine Install DCHP Server on the Azure VM Configure a new DHCP scope Define an IP Range for your DCHP Server (for example, 192.168.0.100 to 192.168.0.200) Click  Next ...