1. Secure and deploy your mobile apps in Microsoft Azure
Microsoft Ignite 2016
8/6/2018 8:15 PM
BRK2251
Secure and deploy your mobile apps in Microsoft Azure
Adrian Hall
Sr. Program Manager, Azure Mobile
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. What we are covering: An IT Pro View
A Quick Level Set: Azure App Service
Creating an Azure App Service with ARM
Linking SCCS to an Azure App Service
Using Slots to Control Deployment
Mobile Authentication with Azure AD
Bring your burning deployment questions!

3. Who am I? Adrian Hall | @FizzyInTheHall Passionate About…
8/6/2018
Who am I?
Adrian Hall
Sr. Program Manager, Azure Mobile
Blog
Passionate About…
Mobile & Web Dev
Cycling & Skiing
My Cats
App Service Blog:
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. Level Set: What are Mobile Apps?

5. Infrastructure Services
Platform Services
Infrastructure Services
Compute
Storage
Datacenter Infrastructure (32 Regions, 24 Online)
Application Platform
Web
Apps
Mobile
API
Notification
Hubs
Hybrid
Cloud
Backup
StorSimple
Azure Site
Recovery
Import/Export
Networking
Data
SQL
Database
DocumentDB
Redis
Cache
Azure
Search
Tables
SQL Data
Warehouse
Azure AD
Health Monitoring
Virtual Network
Express
Route
Blob
Files
Disks
Virtual Machines
AD Privileged
Identity
Management
Traffic Manager
App
Gateway
Operational
Analytics
Compute Services
Services
Batch
RemoteApp
Service
Fabric
Developer Services
Visual Studio
Application
Insights
VS Team Services
Containers
DNS
VPN Gateway
Load Balancer
Domain Services
Analytics & IoT
HDInsight
Machine
Learning
Stream Analytics
Factory
Event
Data Lake
Analytics Service
IoT Hub
Catalog
Security & Management
Azure Active
Directory
Multi-Factor
Authentication
Automation
Portal
Key Vault
Store/
Marketplace
VM Image Gallery
& VM Depot
B2C
Scheduler
Xamarin
HockeyApp
Power BI
Embedded
SQL Server
Stretch Database
Engagement
Functions
Intelligence
Cognitive Services
Bot Framework
Cortana
Security Center
Container
Queues VM
Scale Sets
Data Lake Store
Dev/Test Lab
Integration
BizTalk
Service Bus
Logic
Media & CDN
Content Delivery
Network
Media Services
Media Analytics

6. Azure App Service: Mobile Apps
Push Notifications
Data connections
User Authentication
Facebook
Twitter
Microsoft
Google
Azure Active Directory
Data Sync
Backend code
SQL
Tables
Mobile SDKs
Windows
iOS
Android
HTML 5/JS
REST API
Xamarin
Apache Cordova
Offline sync
Windows
iOS OSX
Android
Chrome
Kindle
In-App

7. Creating a Mobile App Backend
Demo Time!

8. This is great, but…. Seriously, I have to use a web site for this???
I like repeatability!
I like command line!
I like configuration as code!

9. Repeatable Deployments
Use Azure Resource Manager
Method 1: Visual Studio + Azure SDK
Visual Studio 2013 or Visual Studio 2015, Azure SDK 2.9 or later
File > New Project… - “Azure Resource Group” project template
Typically, start with the Web App + SQL Azure one
Method 2: Quickstart
Any old text editor – pick a quickstart as a starting point
Quickstarts in GitHub:

10. An ARM Template Anatomy{
"$schema": "
"contentVersion": " ",
"parameters": { ... },
"variables": { ... },
"resources": [... ], }

11. ARM Template: Parameters
“appName”: {
“type”: “string”,
“metadata”: {
“description”: “The name of the mobile app” } }, …

12. ARM Template: Hosting Plan Parameter
“hostingPlanSettings”: {
“type”: “object”,
“defaultValue”: {
“tier”: “Standard”,
“skuName”: “S1”,
“capacity”: “0” },
“metadata”: {
“description”: “The App Service Plan settings” }

13. ARM Template: Variables
"hostingPlanName": "[concat(parameters('appName'), '-plan')]",
"databaseServerName": "[concat(parameters('appName'), '-sql')]",
"databaseName": "[concat(variables('databaseServerName'), '-db')]",
"notificationHubNamespace": "[concat(parameters('appName'), '-namespace')]",
"notificationHubName": "[concat(parameters('appName'), '-hub')]" },

14. ARM Template: Resources{
"type": "Microsoft.Web/serverfarms",
"apiVersion": " ",
"name": "[variables('hostingPlanName')]",
"location": "[resourceGroup().location]",
"sku": {
"name": "[parameters('hostingPlanSettings').skuName]",
"tier": "[parameters('hostingPlanSettings').tier]",
"capacity": "[parameters('hostingPlanSettings').capacity]" },
"properties": {
"numberOfWorkers": 1 }

15. ARM Template: Parameters File{
"$schema": "
"contentVersion": " ",
"parameters": {
"appName": {
"value": "examplemobileapp" },
"sqlServerAdminLogin": {
"value": "NewAdmin"
"sqlServerAdminPassword": {
"value": "GEN-PASSWORD" }

16. Deploy an Azure Resource Manager Template
Visual Studio
Project > Deploy > New Deployment
PowerShell
Install Azure Powershell
Run the “Deploy-AzureResourceGroup.ps1”
Mac or Linux? Azure CLI (Node based)
npm install azure-cli
Run azure group create

17. Three Ways of Deploying a Mobile App
Demo Time!

18. Deploy an ARM Template with Command Line
Powershell
Login-AzureRmAccount
…\Scripts\Deploy-AzureResourceGroup.ps1
Azure CLI
azure login
azure config mode arm
azure group create –n “Name” –l “Region” –f “template.json” –e “params.json”

19. Continuous Deployments
My Developers tell me when to deploy.
I am not responsible for testing.
I need to protect the backend service
SOLUTION:
Link your SCC to your Azure Resources

20. Linking Azure App Service to VSTS or GitHub
Create your mobile site as normal
Use Continuous Deployment
Link your site to an SCC repository
When the repository changes, the site is updated
Use Site Deployment Scripts
If you need to compile your site or do extra things during deployment
Automatically run during deployment

21. Best Practices in Branching
Multiple Branches
“master” – the working branch
“staging” – the internal test branch
“azure” – the thing deployed to azure
Feature branches for WIP
Merge from master to staging
Test your app locally / do unit tests / etc.
Merge from staging to azure
azure branch gets automatically deployed to Azure

22. Linking to GitHub
Demo Time!

23. Continuous Deployments: Slots
Linking SCC to a Production Site is a bad idea.
Slots protect the Production Site
They also help with downtime by “warming” the site before deployment
Link SCC to a Staging Slot instead
In fact, create 3 slots so you have a “last known good” deployment

24. Slot Swapping
Demo Time!

25. Best Practices in Slot Swapping
Production
Staging
Last Known Good
SCC Link

26. Best Practices in Slot Swapping
New Production
Old Production
Last Known Good
SCC Link

27. Best Practices in Slot Swapping
New Production
New
Staging
Old Production
SCC Link

28. Securing your App with AAD

29. Azure Active Directory Apps
For Web Apps – one app registration is required
Use the Easy Registration process within Azure App Service
For Mobile Apps – two app registrations are required
Register the backend just like any other Azure App Service
Add a Mobile Client via the portal
Ensure your developers are following best practices
Use Client Flow with ADAL Library
Use a Secure Token Store
Handle Refresh Tokens

30. Securing App Service with Azure AD

31. Best Practices Wrap Up

32. Wrap Up of Best Practices
Create a deployment ARM template and check it in
Use Continuous Deployment via SCC
Use a deployment script for automation
Use slots to protect your production site
2 AAD apps: Backend and Mobile Apps
Demand developers secure their code properly

33. Additional Resources 30 days of Azure Mobile
The Azure Mobile Book (in progress)
Azure Resource Manager for App Service
Azure Deployment Guide

34. Free IT Pro resources To advance your career in cloud technology
Microsoft Ignite 2016
8/6/2018 8:15 PM
Free IT Pro resources To advance your career in cloud technology
Plan your career path
Microsoft IT Pro Career Center
Cloud role mapping
Expert advice on skills needed
Self-paced curriculum by cloud role
$300 Azure credits and extended trials
Pluralsight 3 month subscription (10 courses)
Phone support incident
Weekly short videos and insights from Microsoft’s leaders and engineers
Connect with community of peers and Microsoft experts
Get started with Azure
Microsoft IT Pro Cloud Essentials
Demos and how-to videos
Microsoft Mechanics
Connect with peers and experts
Microsoft Tech Community
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

35. Please evaluate this session
8/6/2018 8:15 PM
Please evaluate this session
Your feedback is important to us!
From your PC or Tablet visit MyIgnite at
From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

36. 8/6/2018 8:15 PM
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.