[{"data":1,"prerenderedAt":1010},["ShallowReactive",2],{"i-ph:list-bold":3,"i-ph:github-logo-bold":8,"i-ph:linkedin-logo-bold":10,"i-ph:rss-bold":12,"tag-azure-local":14,"i-ph:arrow-left-bold":1008},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,256,false,"\u003Cpath fill=\"currentColor\" d=\"M228 128a12 12 0 0 1-12 12H40a12 12 0 0 1 0-24h176a12 12 0 0 1 12 12M40 76h176a12 12 0 0 0 0-24H40a12 12 0 0 0 0 24m176 104H40a12 12 0 0 0 0 24h176a12 12 0 0 0 0-24\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"currentColor\" d=\"M212.62 75.17A63.7 63.7 0 0 0 206.39 26A12 12 0 0 0 196 20a63.71 63.71 0 0 0-50 24h-20a63.71 63.71 0 0 0-50-24a12 12 0 0 0-10.39 6a63.7 63.7 0 0 0-6.23 49.17A61.5 61.5 0 0 0 52 104v8a60.1 60.1 0 0 0 45.76 58.28A43.66 43.66 0 0 0 92 192v4H76a20 20 0 0 1-20-20a44.05 44.05 0 0 0-44-44a12 12 0 0 0 0 24a20 20 0 0 1 20 20a44.05 44.05 0 0 0 44 44h16v12a12 12 0 0 0 24 0v-40a20 20 0 0 1 40 0v40a12 12 0 0 0 24 0v-40a43.66 43.66 0 0 0-5.76-21.72A60.1 60.1 0 0 0 220 112v-8a61.5 61.5 0 0 0-7.38-28.83M196 112a36 36 0 0 1-36 36h-48a36 36 0 0 1-36-36v-8a37.87 37.87 0 0 1 6.13-20.12a11.65 11.65 0 0 0 1.58-11.49a39.9 39.9 0 0 1-.4-27.72a39.87 39.87 0 0 1 26.41 17.8a12 12 0 0 0 10.1 5.53h32.35a12 12 0 0 0 10.11-5.53a39.84 39.84 0 0 1 26.41-17.8a39.9 39.9 0 0 1-.4 27.72a12 12 0 0 0 1.61 11.53A37.85 37.85 0 0 1 196 104Z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"currentColor\" d=\"M216 20H40a20 20 0 0 0-20 20v176a20 20 0 0 0 20 20h176a20 20 0 0 0 20-20V40a20 20 0 0 0-20-20m-4 192H44V44h168Zm-100-36v-56a12 12 0 0 1 21.43-7.41A40 40 0 0 1 192 148v28a12 12 0 0 1-24 0v-28a16 16 0 0 0-32 0v28a12 12 0 0 1-24 0m-16-56v56a12 12 0 0 1-24 0v-56a12 12 0 0 1 24 0M68 80a16 16 0 1 1 16 16a16 16 0 0 1-16-16\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cpath fill=\"currentColor\" d=\"M109.74 146.26A75.53 75.53 0 0 1 132 200a12 12 0 0 1-24 0a52 52 0 0 0-52-52a12 12 0 0 1 0-24a75.5 75.5 0 0 1 53.74 22.26M56 76a12 12 0 0 0 0 24a100 100 0 0 1 100 100a12 12 0 0 0 24 0A124 124 0 0 0 56 76m121.62 2.38A170.85 170.85 0 0 0 56 28a12 12 0 0 0 0 24a147 147 0 0 1 104.65 43.35A147 147 0 0 1 204 200a12 12 0 0 0 24 0a170.85 170.85 0 0 0-50.38-121.62M60 180a16 16 0 1 0 16 16a16 16 0 0 0-16-16\"\u002F>",[15,561,601,798],{"_path":16,"_dir":17,"_draft":18,"_partial":6,"_locale":19,"title":20,"description":21,"date":22,"preview":19,"draft":18,"tags":23,"categories":19,"image":29,"body":30,"_type":555,"_id":556,"_source":557,"_file":558,"_stem":559,"_extension":560},"\u002Fblog\u002F2026-07-07-sovereign-cloud-azure-landing-zones-azure-local","blog","false","","Sovereign Cloud on Azure: Landing Zones and Azure Local","How Microsoft's Sovereign Landing Zone and Azure Local help European organizations meet digital sovereignty requirements while still using the Azure platform.","2026-07-07T09:00:00.000Z",[24,25,26,27,28],"azure","sovereign-cloud","landing-zones","azure-local","compliance","\u002Fimages\u002Fsovereign-cloud-header.svg",{"type":31,"children":32,"toc":546},"root",[33,41,62,96,103,115,120,128,173,178,184,196,203,208,281,286,296,301,308,333,339,350,357,369,413,418,424,429,488,493,517,522,528,533],{"type":34,"tag":35,"props":36,"children":38},"element","h1",{"id":37},"sovereign-cloud-on-azure-landing-zones-and-azure-local",[39],{"type":40,"value":20},"text",{"type":34,"tag":42,"props":43,"children":44},"p",{},[45,47,53,55,60],{"type":40,"value":46},"Almost every customer conversation I have lately opens with the same question: ",{"type":34,"tag":48,"props":49,"children":50},"em",{},[51],{"type":40,"value":52},"\"What is sovereign cloud, and do we need it?\"",{"type":40,"value":54}," Usually followed by a second one: ",{"type":34,"tag":48,"props":56,"children":57},{},[58],{"type":40,"value":59},"\"How much control do we actually have over our own data in Azure?\"",{"type":40,"value":61}," Those are fair questions. Between NIS2, DORA, the EU Data Act and the public debate about where data lives and who can access it, sovereignty has moved from a nice-to-have to a board-level topic for a lot of European organizations.",{"type":34,"tag":42,"props":63,"children":64},{},[65,67,73,75,80,82,87,89,94],{"type":40,"value":66},"The good news is that this is not a story about leaving the public cloud. It is a story about ",{"type":34,"tag":68,"props":69,"children":70},"strong",{},[71],{"type":40,"value":72},"staying in control",{"type":40,"value":74}," — of where your data lives, who can operate it, and how you can prove it. In this blog I want to zoom out from my previous posts on Infrastructure-as-Code and Terraform, and talk about the platform itself: how do you build an Azure environment that is sovereign ",{"type":34,"tag":48,"props":76,"children":77},{},[78],{"type":40,"value":79},"and",{"type":40,"value":81}," still feels like Azure? To do that, Microsoft has introduced two important building blocks: the ",{"type":34,"tag":68,"props":83,"children":84},{},[85],{"type":40,"value":86},"Sovereign Landing Zone",{"type":40,"value":88}," and ",{"type":34,"tag":68,"props":90,"children":91},{},[92],{"type":40,"value":93},"Azure Local",{"type":40,"value":95},".",{"type":34,"tag":97,"props":98,"children":100},"h3",{"id":99},"so-what-is-sovereign-cloud-really",[101],{"type":40,"value":102},"So what is \"sovereign cloud\", really?",{"type":34,"tag":42,"props":104,"children":105},{},[106,108,113],{"type":40,"value":107},"When a customer asks me what sovereign cloud means, I try to avoid the marketing definition and reduce it to one sentence: ",{"type":34,"tag":68,"props":109,"children":110},{},[111],{"type":40,"value":112},"sovereign cloud is about being able to prove, at any moment, that you are in control of your own data",{"type":40,"value":114},". That control has a technical side (where is the data, who holds the keys, who can read the logs) and a legal side (which laws apply, which support engineer can touch what).",{"type":34,"tag":42,"props":116,"children":117},{},[118],{"type":40,"value":119},"Sovereign cloud is often reduced to \"my data stays in Europe\", but in practice it is broader than that. Microsoft describes it around four pillars, and that model works well to structure the conversation:",{"type":34,"tag":42,"props":121,"children":122},{},[123],{"type":34,"tag":124,"props":125,"children":127},"img",{"alt":19,"src":126},"\u002Fimages\u002Fsovereign-cloud-pillars.svg",[],{"type":34,"tag":129,"props":130,"children":131},"ul",{},[132,143,153,163],{"type":34,"tag":133,"props":134,"children":135},"li",{},[136,141],{"type":34,"tag":68,"props":137,"children":138},{},[139],{"type":40,"value":140},"Data sovereignty",{"type":40,"value":142}," – where data is stored and processed, how it is encrypted, and who holds the keys.",{"type":34,"tag":133,"props":144,"children":145},{},[146,151],{"type":34,"tag":68,"props":147,"children":148},{},[149],{"type":40,"value":150},"Operational sovereignty",{"type":40,"value":152}," – who can operate the platform, from what location, and under which legal framework.",{"type":34,"tag":133,"props":154,"children":155},{},[156,161],{"type":34,"tag":68,"props":157,"children":158},{},[159],{"type":40,"value":160},"Software sovereignty",{"type":40,"value":162}," – can you run the same workloads somewhere else if you have to? Portability, open-source and hybrid runtimes.",{"type":34,"tag":133,"props":164,"children":165},{},[166,171],{"type":34,"tag":68,"props":167,"children":168},{},[169],{"type":40,"value":170},"Assurance and compliance",{"type":40,"value":172}," – proving all of the above against frameworks like GDPR, NIS2, DORA, ISO 27001, C5 or BIO.",{"type":34,"tag":42,"props":174,"children":175},{},[176],{"type":40,"value":177},"The point is that sovereignty is not a single Azure feature you can switch on. It is a combination of region choice, identity, key management, policy, monitoring and the way you operate the platform.",{"type":34,"tag":97,"props":179,"children":181},{"id":180},"the-sovereign-landing-zone-slz",[182],{"type":40,"value":183},"The Sovereign Landing Zone (SLZ)",{"type":34,"tag":42,"props":185,"children":186},{},[187,189,194],{"type":40,"value":188},"If you have worked with Azure Landing Zones before, the Sovereign Landing Zone will look familiar. It builds on the same ",{"type":34,"tag":68,"props":190,"children":191},{},[192],{"type":40,"value":193},"Azure Landing Zone (ALZ)",{"type":40,"value":195}," accelerator, but adds an extra management group with a sovereign policy initiative, sovereign guardrails and a set of reference landing zones.",{"type":34,"tag":42,"props":197,"children":198},{},[199],{"type":34,"tag":124,"props":200,"children":202},{"alt":19,"src":201},"\u002Fimages\u002Fsovereign-landing-zone.svg",[],{"type":34,"tag":42,"props":204,"children":205},{},[206],{"type":40,"value":207},"What you get on top of a \"regular\" landing zone:",{"type":34,"tag":129,"props":209,"children":210},{},[211,223,234,265],{"type":34,"tag":133,"props":212,"children":213},{},[214,216,221],{"type":40,"value":215},"A ",{"type":34,"tag":68,"props":217,"children":218},{},[219],{"type":40,"value":220},"Sovereign Root management group",{"type":40,"value":222}," that carries the sovereign policy initiative, so every subscription underneath inherits the same controls.",{"type":34,"tag":133,"props":224,"children":225},{},[226,227,232],{"type":40,"value":215},{"type":34,"tag":68,"props":228,"children":229},{},[230],{"type":40,"value":231},"policy baseline",{"type":40,"value":233}," that enforces things like: allowed regions, customer-managed keys, private endpoints only, no unmanaged disks, and Customer Lockbox enabled.",{"type":34,"tag":133,"props":235,"children":236},{},[237,239,244,246,251,252,257,259,263],{"type":40,"value":238},"Reference landing zones for ",{"type":34,"tag":68,"props":240,"children":241},{},[242],{"type":40,"value":243},"Corp",{"type":40,"value":245},", ",{"type":34,"tag":68,"props":247,"children":248},{},[249],{"type":40,"value":250},"Confidential",{"type":40,"value":245},{"type":34,"tag":68,"props":253,"children":254},{},[255],{"type":40,"value":256},"Online",{"type":40,"value":258}," and – this is the new one – ",{"type":34,"tag":68,"props":260,"children":261},{},[262],{"type":40,"value":93},{"type":40,"value":264}," at the edge.",{"type":34,"tag":133,"props":266,"children":267},{},[268,270,279],{"type":40,"value":269},"Bicep and Terraform templates in the ",{"type":34,"tag":271,"props":272,"children":276},"a",{"href":273,"rel":274},"https:\u002F\u002Fgithub.com\u002FAzure\u002Fsovereign-landing-zone",[275],"nofollow",[277],{"type":40,"value":278},"Azure\u002Fsovereign-landing-zone",{"type":40,"value":280}," repository, so you can deploy it as code (which fits nicely with what I wrote in my previous blog).",{"type":34,"tag":42,"props":282,"children":283},{},[284],{"type":40,"value":285},"A concrete example of a sovereign guardrail in Bicep looks like this:",{"type":34,"tag":287,"props":288,"children":290},"pre",{"code":289},"targetScope = 'managementGroup'\n\nresource allowedLocations 'Microsoft.Authorization\u002FpolicyAssignments@2022-06-01' = {\n  name: 'sovereign-allowed-locations'\n  properties: {\n    displayName: 'Sovereign - Allowed locations'\n    policyDefinitionId: '\u002Fproviders\u002FMicrosoft.Authorization\u002FpolicyDefinitions\u002Fe56962a6-4747-49cd-b67b-bf8b01975c4c'\n    parameters: {\n      listOfAllowedLocations: {\n        value: [\n          'westeurope'\n          'northeurope'\n        ]\n      }\n    }\n    enforcementMode: 'Default'\n  }\n}\n",[291],{"type":34,"tag":292,"props":293,"children":294},"code",{"__ignoreMap":19},[295],{"type":40,"value":289},{"type":34,"tag":42,"props":297,"children":298},{},[299],{"type":40,"value":300},"Nothing exotic – it is a normal policy assignment. The value of the SLZ is that dozens of these controls are already bundled, tested and mapped to compliance frameworks, so you do not have to build the wheel yourself.",{"type":34,"tag":302,"props":303,"children":305},"h4",{"id":304},"where-the-confidential-landing-zone-fits-in",[306],{"type":40,"value":307},"Where the Confidential landing zone fits in",{"type":34,"tag":42,"props":309,"children":310},{},[311,313,318,319,324,326,331],{"type":40,"value":312},"The Confidential landing zone is specifically for workloads that need extra protection while the data is being processed. It defaults to ",{"type":34,"tag":68,"props":314,"children":315},{},[316],{"type":40,"value":317},"Confidential VMs",{"type":40,"value":88},{"type":34,"tag":68,"props":320,"children":321},{},[322],{"type":40,"value":323},"Confidential AKS nodes",{"type":40,"value":325}," based on AMD SEV-SNP or Intel TDX, keys in ",{"type":34,"tag":68,"props":327,"children":328},{},[329],{"type":40,"value":330},"Key Vault Managed HSM",{"type":40,"value":332},", and remote attestation before a workload is allowed to start. This is the pattern I would use for workloads that fall under DORA or that process special categories of personal data.",{"type":34,"tag":97,"props":334,"children":336},{"id":335},"azure-local-sovereign-compute-in-your-own-datacenter",[337],{"type":40,"value":338},"Azure Local: sovereign compute in your own datacenter",{"type":34,"tag":42,"props":340,"children":341},{},[342,344,348],{"type":40,"value":343},"Even with all the sovereign controls in the cloud, there are still workloads that simply cannot leave a specific building. Think of a hospital, a factory floor, a government site, or a location with limited connectivity. This is where ",{"type":34,"tag":68,"props":345,"children":346},{},[347],{"type":40,"value":93},{"type":40,"value":349}," comes in – the product formerly known as Azure Stack HCI, rebranded and repositioned as the on-premises extension of the Azure platform.",{"type":34,"tag":42,"props":351,"children":352},{},[353],{"type":34,"tag":124,"props":354,"children":356},{"alt":19,"src":355},"\u002Fimages\u002Fazure-local-architecture.svg",[],{"type":34,"tag":42,"props":358,"children":359},{},[360,362,367],{"type":40,"value":361},"The important thing to understand is that Azure Local is ",{"type":34,"tag":68,"props":363,"children":364},{},[365],{"type":40,"value":366},"not",{"type":40,"value":368}," a separate cloud. It is a validated Hyper-V based cluster (2–16 nodes on OEM-validated hardware) that is projected into Azure through Azure Arc. That means:",{"type":34,"tag":129,"props":370,"children":371},{},[372,384,389,401],{"type":34,"tag":133,"props":373,"children":374},{},[375,377,382],{"type":40,"value":376},"The control plane is the ",{"type":34,"tag":68,"props":378,"children":379},{},[380],{"type":40,"value":381},"Azure Resource Manager",{"type":40,"value":383},". You use the same RBAC, the same Policy, the same Bicep or Terraform to deploy VMs and AKS clusters – they just land on hardware in your own datacenter.",{"type":34,"tag":133,"props":385,"children":386},{},[387],{"type":40,"value":388},"Monitoring, Defender for Cloud and Sentinel treat the workloads like any other Azure resource.",{"type":34,"tag":133,"props":390,"children":391},{},[392,394,399],{"type":40,"value":393},"The ",{"type":34,"tag":68,"props":395,"children":396},{},[397],{"type":40,"value":398},"data plane stays on-premises",{"type":40,"value":400},". VM disks, container volumes, and (as they become GA on Azure Local) services like SQL MI or Event Hubs never leave the building.",{"type":34,"tag":133,"props":402,"children":403},{},[404,406,411],{"type":40,"value":405},"You can run in ",{"type":34,"tag":68,"props":407,"children":408},{},[409],{"type":40,"value":410},"disconnected mode",{"type":40,"value":412}," for a limited time, which is useful for sites with intermittent connectivity or for scenarios where a temporary air-gap is required.",{"type":34,"tag":42,"props":414,"children":415},{},[416],{"type":40,"value":417},"If you combine this with the Sovereign Landing Zone, Azure Local becomes just another landing zone under your Sovereign Root MG. The same policy initiative applies, the same tagging model applies, and the same operational model applies – only the physical location of the compute changes.",{"type":34,"tag":97,"props":419,"children":421},{"id":420},"how-the-three-pieces-fit-together",[422],{"type":40,"value":423},"How the three pieces fit together",{"type":34,"tag":42,"props":425,"children":426},{},[427],{"type":40,"value":428},"To me, the interesting part is not any of these building blocks on their own, but the fact that they finally fit together into one consistent story:",{"type":34,"tag":129,"props":430,"children":431},{},[432,456,472],{"type":34,"tag":133,"props":433,"children":434},{},[435,440,442,447,449,454],{"type":34,"tag":68,"props":436,"children":437},{},[438],{"type":40,"value":439},"Sovereign Cloud",{"type":40,"value":441}," defines the ",{"type":34,"tag":48,"props":443,"children":444},{},[445],{"type":40,"value":446},"why",{"type":40,"value":448}," and the ",{"type":34,"tag":48,"props":450,"children":451},{},[452],{"type":40,"value":453},"controls",{"type":40,"value":455}," – regions, keys, operations, compliance.",{"type":34,"tag":133,"props":457,"children":458},{},[459,463,465,470],{"type":34,"tag":68,"props":460,"children":461},{},[462],{"type":40,"value":86},{"type":40,"value":464}," delivers the ",{"type":34,"tag":48,"props":466,"children":467},{},[468],{"type":40,"value":469},"how",{"type":40,"value":471}," on the platform side – a repeatable, policy-driven Azure foundation.",{"type":34,"tag":133,"props":473,"children":474},{},[475,479,481,486],{"type":34,"tag":68,"props":476,"children":477},{},[478],{"type":40,"value":93},{"type":40,"value":480}," extends that foundation to ",{"type":34,"tag":48,"props":482,"children":483},{},[484],{"type":40,"value":485},"where the data has to physically live",{"type":40,"value":487}," – on-premises or at the edge, without giving up the Azure operating model.",{"type":34,"tag":42,"props":489,"children":490},{},[491],{"type":40,"value":492},"For most organizations I talk to, the practical path looks something like this:",{"type":34,"tag":494,"props":495,"children":496},"ol",{},[497,502,507,512],{"type":34,"tag":133,"props":498,"children":499},{},[500],{"type":40,"value":501},"Start with a normal Azure Landing Zone in a European region.",{"type":34,"tag":133,"props":503,"children":504},{},[505],{"type":40,"value":506},"Layer the Sovereign policy initiative on top and pick your allowed regions and key strategy.",{"type":34,"tag":133,"props":508,"children":509},{},[510],{"type":40,"value":511},"Add a Confidential landing zone for the workloads that need in-use protection.",{"type":34,"tag":133,"props":513,"children":514},{},[515],{"type":40,"value":516},"Add an Azure Local landing zone for the workloads that genuinely cannot leave your datacenter.",{"type":34,"tag":42,"props":518,"children":519},{},[520],{"type":40,"value":521},"That way you are not building \"yet another private cloud\" next to Azure – you are extending the same platform, with the same code, into the places where sovereignty demands it.",{"type":34,"tag":97,"props":523,"children":525},{"id":524},"which-approach-is-best-for-you",[526],{"type":40,"value":527},"Which approach is best for you?",{"type":34,"tag":42,"props":529,"children":530},{},[531],{"type":40,"value":532},"As with the IaC languages I wrote about earlier, there is no single right answer. If your workloads can run in a European Azure region and your legal team is comfortable with the sovereign controls in the SLZ, that is by far the simplest and cheapest path. If you have workloads that must physically stay on-premises, Azure Local is a much better option than building a separate stack, because you keep the same tooling, the same skills and the same governance.",{"type":34,"tag":42,"props":534,"children":535},{},[536,538,545],{"type":40,"value":537},"In my next blog I want to go one level deeper and walk through deploying the Sovereign Landing Zone with Terraform, including the sovereign policy initiative and an Azure Local landing zone. If you want to already dive into the material, the best starting point is the official Microsoft Learn overview: ",{"type":34,"tag":271,"props":539,"children":542},{"href":540,"rel":541},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fsovereign-cloud\u002Fsovereign-landing-zone\u002Foverview",[275],[543],{"type":40,"value":544},"Sovereign landing zone on Microsoft Learn",{"type":40,"value":95},{"title":19,"searchDepth":547,"depth":547,"links":548},2,[549,551,552,553,554],{"id":99,"depth":550,"text":102},3,{"id":180,"depth":550,"text":183},{"id":335,"depth":550,"text":338},{"id":420,"depth":550,"text":423},{"id":524,"depth":550,"text":527},"markdown","content:blog:2026-07-07-sovereign-cloud-azure-landing-zones-azure-local.md","content","blog\u002F2026-07-07-sovereign-cloud-azure-landing-zones-azure-local.md","blog\u002F2026-07-07-sovereign-cloud-azure-landing-zones-azure-local","md",{"_path":562,"_dir":17,"_draft":563,"_partial":6,"_locale":19,"title":564,"description":565,"date":566,"preview":19,"draft":563,"tags":567,"categories":19,"image":570,"body":571,"_type":555,"_id":598,"_source":557,"_file":599,"_stem":600,"_extension":560},"\u002Fblog\u002F2023-03-17-terraform-explained","true","Terraform Explained","A practical introduction to Terraform: what it is, how it works and why you would use it for managing cloud infrastructure.","2023-03-17T11:13:49.196Z",[568,569],"iac","terraform","\u002Fimages\u002Fterraform.png",{"type":31,"children":572,"toc":595},[573,579,590],{"type":34,"tag":35,"props":574,"children":576},{"id":575},"terraform-explained",[577],{"type":40,"value":578},"Terraform explained",{"type":34,"tag":42,"props":580,"children":581},{},[582,584],{"type":40,"value":583},"In my last post I explained the option you have when starting withf Infrastructure-as-Code when looking at the languages you want to use.\nIn this blog I will go deeper in to the language Terrarfom. If you would like to read my previous blog, ",{"type":34,"tag":271,"props":585,"children":587},{"href":586},"2023-01-13-different-languages-iac",[588],{"type":40,"value":589},"click here",{"type":34,"tag":97,"props":591,"children":592},{"id":569},[593],{"type":40,"value":594},"Terraform",{"title":19,"searchDepth":547,"depth":547,"links":596},[597],{"id":569,"depth":550,"text":594},"content:blog:2023-03-17-Terraform-explained.md","blog\u002F2023-03-17-Terraform-explained.md","blog\u002F2023-03-17-Terraform-explained",{"_path":602,"_dir":17,"_draft":18,"_partial":6,"_locale":19,"title":603,"description":604,"date":605,"preview":19,"draft":18,"tags":606,"categories":19,"image":609,"body":610,"_type":555,"_id":795,"_source":557,"_file":796,"_stem":797,"_extension":560},"\u002Fblog\u002F2023-01-13-different-languages-iac","Different languages for infrastructure-as-code","An overview of the main languages and tools used for infrastructure-as-code: Terraform, Bicep, ARM, Pulumi and CloudFormation.","2023-01-13T11:13:49.196Z",[568,569,607,608],"bicep","arm","\u002Fimages\u002Fiac-overview.png",{"type":31,"children":611,"toc":791},[612,617,622,628,633,638,643,649,655,660,687,692,698,703,708,716,720,725,730,738,742,747,752,760,765,771,776,781,786],{"type":34,"tag":35,"props":613,"children":615},{"id":614},"different-languages-for-infrastructure-as-code",[616],{"type":40,"value":603},{"type":34,"tag":42,"props":618,"children":619},{},[620],{"type":40,"value":621},"Infrastructure-as-Code (IaC) is a concept that allows for the management of infrastructure through the use of code. This means that instead of manually configuring and setting up infrastructure using a web interface, the infrastructure is defined and provisioned using code. This allows for greater automation, consistency, and repeatability in the management of infrastructure, as well as making it easier to version control, test and rollback changes",{"type":34,"tag":97,"props":623,"children":625},{"id":624},"benefits-of-infrastructure-as-code",[626],{"type":40,"value":627},"Benefits of Infrastructure-as-code",{"type":34,"tag":42,"props":629,"children":630},{},[631],{"type":40,"value":632},"Imagine you need to deploy multiple virtual machines, three storage accounts, and a virtual network. Next, you need to configure the network links on that network and format tje diskss. \"Just one click\" in the UI turns into hours of clicking and filling out all the forms and properties.",{"type":34,"tag":42,"props":634,"children":635},{},[636],{"type":40,"value":637},"Now imagine that something went wrong towards the end and you have to start all over again. With the IaC model, you can write code to describe all infrastructure components and then leave the implementation to Terraform, Bicep, or ARM. In this case, if something goes wrong at the end, you can change a few lines of code to fix the problem and run the code again.",{"type":34,"tag":42,"props":639,"children":640},{},[641],{"type":40,"value":642},"Another benefit is the ability to use a source code versioning system such as Azure DevOps or Github to store your code. This gives you equal version control and makes it possible to easily see all changes in the infrastructure and make them available to all team members. By using versions, you automatically  have an audit log in which all changes are recorded",{"type":34,"tag":42,"props":644,"children":645},{},[646],{"type":34,"tag":124,"props":647,"children":648},{"alt":19,"src":609},[],{"type":34,"tag":97,"props":650,"children":652},{"id":651},"which-language-should-you-use",[653],{"type":40,"value":654},"Which language should you use?",{"type":34,"tag":42,"props":656,"children":657},{},[658],{"type":40,"value":659},"When you start using IaC, you still have to make a number of choices. The most important choice here is: which language will you use? In principle, you have a choice of three languages.",{"type":34,"tag":129,"props":661,"children":662},{},[663,672,680],{"type":34,"tag":133,"props":664,"children":665},{},[666],{"type":34,"tag":667,"props":668,"children":669},"span",{},[670],{"type":40,"value":671},"ARM templates (json)",{"type":34,"tag":133,"props":673,"children":674},{},[675],{"type":34,"tag":667,"props":676,"children":677},{},[678],{"type":40,"value":679},"Bicep",{"type":34,"tag":133,"props":681,"children":682},{},[683],{"type":34,"tag":667,"props":684,"children":685},{},[686],{"type":40,"value":594},{"type":34,"tag":42,"props":688,"children":689},{},[690],{"type":40,"value":691},"The three languages all use the Azure Resource Manager for the deployment. The Azure Resource Manager ensures that the code is converted to a resource that must be created. For each language I've made an example how to create a resource group within Azure, so that you can see a good difference between the different languages.",{"type":34,"tag":302,"props":693,"children":695},{"id":694},"arm-template-json",[696],{"type":40,"value":697},"ARM template (json)",{"type":34,"tag":42,"props":699,"children":700},{},[701],{"type":40,"value":702},"In the past, ARM templates were the only way to create resources in Azure based on IaC. This is also the default \"language\" that the Azure Resource Manager uses.",{"type":34,"tag":42,"props":704,"children":705},{},[706],{"type":40,"value":707},"The following code is required to create a resource group:",{"type":34,"tag":287,"props":709,"children":711},{"code":710},"{\n  \"$schema\": \"https:\u002F\u002Fschema.management.azure.com\u002Fschemas\u002F2018-05-01\u002FsubscriptionDeploymentTemplate.json#\",\n  \"contentVersion\": \"1.0.0.0\",\n  \"parameters\": {\n    \"rgName\": {\n      \"type\": \"string\"\n    },\n    \"rgLocation\": {\n      \"type\": \"string\"\n    }\n  },\n  \"variables\": {},\n  \"resources\": [\n    {\n      \"type\": \"Microsoft.Resources\u002FresourceGroups\",\n      \"apiVersion\": \"2021-04-01\",\n      \"name\": \"[parameters('rgName')]\",\n      \"location\": \"[parameters('rgLocation')]\",\n      \"properties\": {}\n    }\n  ],\n  \"outputs\": {}\n}\n",[712],{"type":34,"tag":292,"props":713,"children":714},{"__ignoreMap":19},[715],{"type":40,"value":710},{"type":34,"tag":302,"props":717,"children":718},{"id":607},[719],{"type":40,"value":679},{"type":34,"tag":42,"props":721,"children":722},{},[723],{"type":40,"value":724},"Bicep is a language developed by Microsoft as a replacement for the ARM templates. The advantage of this language is that it is more readable and you need fewer lines to achieve the same. The disadvantage of Bicep, just like ARM templates, is that it can only be used on the Azure platform.",{"type":34,"tag":42,"props":726,"children":727},{},[728],{"type":40,"value":729},"As indicated, you need less code for the same action, creating a resource group.",{"type":34,"tag":287,"props":731,"children":733},{"code":732},"targetScope = 'subscription'\n\nresource rg 'Microsoft.Resources\u002FresourceGroups@2021-01-01' = {\n  name: 'rg-contoso'\n  location: 'westeurope'\n}\n",[734],{"type":34,"tag":292,"props":735,"children":736},{"__ignoreMap":19},[737],{"type":40,"value":732},{"type":34,"tag":302,"props":739,"children":740},{"id":569},[741],{"type":40,"value":594},{"type":34,"tag":42,"props":743,"children":744},{},[745],{"type":40,"value":746},"Terraform is a language developed by the Terracorp company. This language can be used for all cloud platforms, Google, AWS and Azure. This makes it a language that is widely used by developers in the open-source community and companies with a multi-cloud environment.",{"type":34,"tag":42,"props":748,"children":749},{},[750],{"type":40,"value":751},"Like Bicep, Terraform uses the Azure Resource Manager to create the resources. Because Terraform can be used for multiple cloud environments, you must indicate that you want to use the Azure Resource Manager. To create a resource group you can use the following code:",{"type":34,"tag":287,"props":753,"children":755},{"code":754},"resource \"azurerm_resource_group\" \"example\" {\n  name     = \"rg-contoso\"\n  location = \"West Europe\"\n}\n",[756],{"type":34,"tag":292,"props":757,"children":758},{"__ignoreMap":19},[759],{"type":40,"value":754},{"type":34,"tag":42,"props":761,"children":762},{},[763],{"type":40,"value":764},"The emergence of Bicep and Terraform makes it easier to create resources in an unambiguous way. Because both languages are easy to read, you also have documentation of the environment and, in combination with Azure DevOps or Github, an audit trail for the changes.",{"type":34,"tag":302,"props":766,"children":768},{"id":767},"which-language-is-best-for-you-to-use",[769],{"type":40,"value":770},"Which language is best for you to use?",{"type":34,"tag":42,"props":772,"children":773},{},[774],{"type":40,"value":775},"There is not really one answer to this and it has a lot to do with which cloud provider you use and the composition of a team.",{"type":34,"tag":42,"props":777,"children":778},{},[779],{"type":40,"value":780},"If you only use Microsoft Azure, it's best to work with Bicep because this language has been developed for Microsoft Azure.",{"type":34,"tag":42,"props":782,"children":783},{},[784],{"type":40,"value":785},"If you use different Cloud environments within your company, for example AWS and Azure, it is advisable to use Terraform because you can then manage both environments with the same language.",{"type":34,"tag":42,"props":787,"children":788},{},[789],{"type":40,"value":790},"In my next blog I will discuss the use of Terraform in more detail.",{"title":19,"searchDepth":547,"depth":547,"links":792},[793,794],{"id":624,"depth":550,"text":627},{"id":651,"depth":550,"text":654},"content:blog:2023-01-13-different-languages-iac.md","blog\u002F2023-01-13-different-languages-iac.md","blog\u002F2023-01-13-different-languages-iac",{"_path":799,"_dir":17,"_draft":18,"_partial":6,"_locale":19,"title":800,"description":801,"date":802,"preview":19,"draft":18,"tags":803,"categories":19,"image":806,"body":807,"_type":555,"_id":1005,"_source":557,"_file":1006,"_stem":1007,"_extension":560},"\u002Fblog\u002F2023-01-07-windows-365-cloud-wat-is-het-en-wat-heb-je-ervoor-nodig","Windows 365 Cloud: Wat is het en wat heb je ervoor nodig?","Microsoft heeft kort geleden aangekondigd dat ze met een nieuwe functionaliteit komen om het hybride werken nog meer te ondersteunen.","2022-07-26T10:01:27.048Z",[804,805,24],"windows-365","intune","\u002Fimages\u002Fhead365.jpg",{"type":31,"children":808,"toc":1003},[809,813,819,824,829,835,847,852,859,864,871,877,882,889,894,900,905,911,916,991],{"type":34,"tag":42,"props":810,"children":811},{},[812],{"type":40,"value":801},{"type":34,"tag":35,"props":814,"children":816},{"id":815},"windows-365-cloud-pc",[817],{"type":40,"value":818},"Windows 365 Cloud PC",{"type":34,"tag":42,"props":820,"children":821},{},[822],{"type":40,"value":823},"Met deze techniek gaat Microsoft Desktop as a Service (DaaS) bieden. Deze cloud PC’s zullen in eerste instantie draaien op basis van Windows 10 en als later dit jaar Windows 11 beschikbaar komt zal dit ook als Cloud PC worden ondersteund.",{"type":34,"tag":42,"props":825,"children":826},{},[827],{"type":40,"value":828},"Microsoft wil met het aanbieden van deze functionaliteiten bedrijven helpen om het hybride werken beter en gemakkelijker te maken. De Cloud PC maakt gebruik van alle Cloud-technieken en kan hierdoor op goede en veilige manier worden aangeboden. Daarbij zullen er apps voor alle bekende systemen zijn om verbinding te kunnen maken met de Desktop.",{"type":34,"tag":35,"props":830,"children":832},{"id":831},"windows-365-web-portaal",[833],{"type":40,"value":834},"Windows 365 web portaal",{"type":34,"tag":42,"props":836,"children":837},{},[838,840],{"type":40,"value":839},"Voor het gebruik van de Cloud PC heeft Microsoft een nieuw portaal beschikbaar gesteld, ",{"type":34,"tag":271,"props":841,"children":844},{"href":842,"rel":843},"https:\u002F\u002Fcloudpc.microsoft.com",[275],[845],{"type":40,"value":846},"cloudpc.microsoft.com",{"type":34,"tag":42,"props":848,"children":849},{},[850],{"type":40,"value":851},"ia dit portaal kan de gebruiker gemakkelijk zijn eigen pc beheren. Hierbij kan je denken aan het herstarten of bij de juiste rechten het vergroten van de pc.",{"type":34,"tag":42,"props":853,"children":854},{},[855],{"type":34,"tag":124,"props":856,"children":858},{"alt":19,"src":857},"\u002Fimages\u002Fwindows_365_1.png",[],{"type":34,"tag":42,"props":860,"children":861},{},[862],{"type":40,"value":863},"Daarnaast biedt het portaal de mogelijkheid om verbinding te maken met de pc doormiddel van de browser of door het downloaden van de desbetreffende cliënt.",{"type":34,"tag":42,"props":865,"children":866},{},[867],{"type":34,"tag":124,"props":868,"children":870},{"alt":19,"src":869},"\u002Fimages\u002Fwindows_365_2.png",[],{"type":34,"tag":35,"props":872,"children":874},{"id":873},"beheer",[875],{"type":40,"value":876},"Beheer",{"type":34,"tag":42,"props":878,"children":879},{},[880],{"type":40,"value":881},"De Cloud PC worden beheerd en uitgerold met behulp van Microsoft Endpoint Manager. Hiermee kunnen alle policies worden toegepast zoals op ‘normale’ apparaten.",{"type":34,"tag":42,"props":883,"children":884},{},[885],{"type":34,"tag":124,"props":886,"children":888},{"alt":19,"src":887},"\u002Fimages\u002Fwindows_365_3.png",[],{"type":34,"tag":42,"props":890,"children":891},{},[892],{"type":40,"value":893},"Voor de Cloud PC zijn er verschillende type images bekend voor licht, gemiddeld en zwaar werk. Hierbij zijn standaard alle Office applicaties en Microsoft Teams geïnstalleerd. Daarnaast is het ook mogelijk om een eigen image te uploaden. De verschillende images kunnen dan aan Azure Active Directory groepen worden gekoppeld.",{"type":34,"tag":35,"props":895,"children":897},{"id":896},"prijzen",[898],{"type":40,"value":899},"Prijzen",{"type":34,"tag":42,"props":901,"children":902},{},[903],{"type":40,"value":904},"Op dit moment zijn er nog geen prijzen bekend: deze worden binnenkort bekend gemaakt. Dit zal wel een fixed price zijn op basis van de grootte van de Virtuele Machine. Deze kunnen, net zoals de huidige Microsoft 365 licenties, via het admin center aan gebruikers worden gekoppeld.",{"type":34,"tag":35,"props":906,"children":908},{"id":907},"technische-vereisten",[909],{"type":40,"value":910},"Technische vereisten",{"type":34,"tag":42,"props":912,"children":913},{},[914],{"type":40,"value":915},"Om Windows 365 Cloud PC’s te kunnen activeren moet je de volgende licenties en rechten hebben.",{"type":34,"tag":129,"props":917,"children":918},{},[919,927,935,943,951,959,967,975,983],{"type":34,"tag":133,"props":920,"children":921},{},[922],{"type":34,"tag":667,"props":923,"children":924},{},[925],{"type":40,"value":926},"Licentie voor het gebruik van de Cloud PC \u002F Windows 3651.",{"type":34,"tag":133,"props":928,"children":929},{},[930],{"type":34,"tag":667,"props":931,"children":932},{},[933],{"type":40,"value":934},"Gebruiker met Windows 10 Pro",{"type":34,"tag":133,"props":936,"children":937},{},[938],{"type":34,"tag":667,"props":939,"children":940},{},[941],{"type":40,"value":942},"Windows 10 Enterprise E3 + EMS E3",{"type":34,"tag":133,"props":944,"children":945},{},[946],{"type":34,"tag":667,"props":947,"children":948},{},[949],{"type":40,"value":950},"Microsoft 365 F3\u002FE3\u002FE5\u002FBP",{"type":34,"tag":133,"props":952,"children":953},{},[954],{"type":34,"tag":667,"props":955,"children":956},{},[957],{"type":40,"value":958},"Azure subscriptie",{"type":34,"tag":133,"props":960,"children":961},{},[962],{"type":34,"tag":667,"props":963,"children":964},{},[965],{"type":40,"value":966},"Owner rol voor het opzetten van een vNet virtual netwerk.",{"type":34,"tag":133,"props":968,"children":969},{},[970],{"type":34,"tag":667,"props":971,"children":972},{},[973],{"type":40,"value":974},"Hybrid identities in Azure AD wanneer er gebruikt wordt gemaakt van een on-premise Active Directory",{"type":34,"tag":133,"props":976,"children":977},{},[978],{"type":34,"tag":667,"props":979,"children":980},{},[981],{"type":40,"value":982},"Microsoft Intune licenties (bijvoorbeeld Microsoft 365 E3)",{"type":34,"tag":133,"props":984,"children":985},{},[986],{"type":34,"tag":667,"props":987,"children":988},{},[989],{"type":40,"value":990},"Intune Service Admin rechten voor het beheren van de Cloud PC’s",{"type":34,"tag":42,"props":992,"children":993},{},[994,996],{"type":40,"value":995},"Mocht je Windows 365 Cloud PC in actie willen zien kijk dan op: ",{"type":34,"tag":271,"props":997,"children":1000},{"href":998,"rel":999},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=V14Ia2uwrtk",[275],[1001],{"type":40,"value":1002},"Windows 365, your Cloud PC | What it is, how it works, and how to set it up – YouTube",{"title":19,"searchDepth":547,"depth":547,"links":1004},[],"content:blog:2023-01-07-windows-365-cloud-wat-is-het-en-wat-heb-je-ervoor-nodig.md","blog\u002F2023-01-07-windows-365-cloud-wat-is-het-en-wat-heb-je-ervoor-nodig.md","blog\u002F2023-01-07-windows-365-cloud-wat-is-het-en-wat-heb-je-ervoor-nodig",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":1009},"\u003Cpath fill=\"currentColor\" d=\"M228 128a12 12 0 0 1-12 12H69l51.52 51.51a12 12 0 0 1-17 17l-72-72a12 12 0 0 1 0-17l72-72a12 12 0 0 1 17 17L69 116h147a12 12 0 0 1 12 12\"\u002F>",1783416620005]