{"_id":"5a7bbbc10cbdcc005ff16ea2","project":"55d535ca988e130d000b3f5c","version":{"_id":"55d535cb988e130d000b3f5f","__v":13,"project":"55d535ca988e130d000b3f5c","hasDoc":true,"hasReference":false,"createdAt":"2015-08-20T02:04:59.052Z","releaseDate":"2015-08-20T02:04:59.052Z","categories":["55d535cc988e130d000b3f60","55d6b238d2a8eb1900109eef","55d6b4f3250d7d0d004274cd","55d7967960fc730d00fc2852","55da9804e835f20d009fc5d0","55e75b1de06f4b190080dbfd","55e75b39e06f4b190080dbfe","55e75b7ae06f4b190080dbff","564f5a4e33082f0d001bb709","570fb64aa38d470e0060cbff","586d0dd89a854123001acd65","586d0e3b9a854123001acd66","5a613b28da07540012e8ca4a"],"is_deprecated":false,"is_hidden":false,"is_beta":false,"is_stable":true,"codename":"","version_clean":"1.0.0","version":"1.0"},"category":{"_id":"55e75b7ae06f4b190080dbff","__v":10,"project":"55d535ca988e130d000b3f5c","version":"55d535cb988e130d000b3f5f","pages":["5637e17197666c0d008656a5","569591a4fcb1032d0089e037","569622eafe18811700c9c19b","5696c9588560a60d00e2c1e0","569709ca0b09a41900b2442b","5697129ac8ded91700307b77","5697190a59a6692d003fad6a","5697192969393517000c8280","569f11908f6d4b0d00f13bb2","56a0030b5b981c2b00383df0"],"sync":{"url":"","isSync":false},"reference":false,"createdAt":"2015-09-02T20:26:34.258Z","from_sync":false,"order":4,"slug":"frame-platform","title":"Frame Platform"},"user":"55d535835082980d0009c965","__v":0,"parentDoc":null,"updates":[],"next":{"pages":[],"description":""},"createdAt":"2018-02-08T02:53:53.193Z","link_external":false,"link_url":"","githubsync":"","sync_unique":"","hidden":false,"api":{"settings":"","results":{"codes":[]},"auth":"required","params":[],"url":""},"isReference":false,"order":19,"body":"You can run the resources of your Frame account on an Azure subscription that Frame owns and manages or on one that you own and manage. The benefit of using Frame's Azure subscription is that the entire service is completely turn-key and you only pay one bill to Frame. When you bring your own (BYO) Azure subscription, you pay Microsoft directly for infrastructure (your VMs, storage, networking, etc.) and you pay Frame for its platform services. \n\nYou might choose to have your Frame accounts use infrastructure provisioned under your own Azure subscription (BYO) because: \n\n* You wish to take advantage of your existing billing arrangements with Azure for convenience and/or pricing. For example, your organization may already have certain Azure consumption commitments or pre-payments -- and you can use Frame to consume those resources on your own Azure account.\n* You want to have additional administrative access to your Frame workloads for more detailed monitoring and metrics.\n* You want to configure other network integrations (VPN gateway) on your own within your Azure account.\n\nThis document shows you how to create, setup, configure, and manage a BYO Azure account that integrates with Frame. If you already have an Azure account and subscription dedicated to Frame, you can move directly to the \"Setting Subscription limits/quotas\" section of the document.\n\nSteps at a glance:\n  * [Create an Azure account: 5-10 minutes](https://docs.fra.me/v1.0/docs/byo-azure-subscription-1#create-an-azure-account)\n  * [Create an Azure subscription: 5 minutes](https://docs.fra.me/v1.0/docs/byo-azure-subscription-1#create-an-azure-subscription)\n  * [Set limits/quotas for your Azure account: optional](https://docs.fra.me/v1.0/docs/byo-azure-subscription-1#setting-subscription-limitsquotas)  \n  * [Create an Azure application registration: 5 minutes](https://docs.fra.me/v1.0/docs/byo-azure-subscription-1#create-an-azure-application-registration)\n  * [Import your BYO Azure subscription credentials into Frame: 3 minutes for self-service](https://docs.fra.me/v1.0/docs/byo-azure-subscription-1#import-your-byo-azure-account-into-frame) \n[block:api-header]\n{\n  \"title\": \"Create an Azure Account\"\n}\n[/block]\nCurrently, Frame supports all free and paid Azure account types (including Bizspark and Enterprise accounts). Microsoft uses simple wizards to walk you through the entire process when signing up for Azure services. In a browser, go to [https://azure.microsoft.com](https://azure.microsoft.com) and click the \"Start Free\" or \"Free Account\" link on that first page. This will walk you through the account creation process for a \"Free\" account which can be upgraded later. You can bypass the \"Free\" account and go straight to the \"Buy now\" option if you prefer. \n[block:callout]\n{\n  \"type\": \"info\",\n  \"title\": \"Microsoft ID Required\",\n  \"body\": \"Please note that you will need a valid Microsoft ID to create an Azure account. If you don't have one already you can create one [here](https://account.microsoft.com/account).\"\n}\n[/block]\n\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/287d3f0-Screen_Shot_2018-02-09_at_11.15.25_AM.png\",\n        \"Screen Shot 2018-02-09 at 11.15.25 AM.png\",\n        1034,\n        592,\n        \"#1e398c\"\n      ],\n      \"caption\": \"You can choose to start for free or choose \\\"Buy now\\\" to go straight to a paid account.\"\n    }\n  ]\n}\n[/block]\n\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/90306ca-4a084ac-upgrade_trial_account.png\",\n        \"4a084ac-upgrade_trial_account.png\",\n        1205,\n        356,\n        \"#3273c4\"\n      ],\n      \"caption\": \"Free Azure trial accounts can be upgraded later as well.\"\n    }\n  ]\n}\n[/block]\nOnce you've created your Azure account, or if you already have one, you'll be ready to create a Subscription. This can be done multiple ways depending on what type of console access you have. We'll describe these consoles in the next section, so if you're already familiar with your console you can skip ahead.\n[block:api-header]\n{\n  \"title\": \"Azure Web Portals\"\n}\n[/block]\nAzure offers several web portals for managing Azure accounts and subscriptions:\n\n- **Standard web portal** (https://portal.azure.com): this is the primary web portal created by Microsoft for Azure services and was developed to create a simpler management interface compared to the older \"classic\" portal which you might have used in the past. You might hear it referred to as the Azure Resource Manager (ARM) portal as well.\n- **Enterprise web portal** (https://ea.azure.com):  this portal is only available to Azure customers that have signed an Enterprise Agreement (EA) with Microsoft. This portal (also referred to as the \"EA portal\") lets you manage admin users and track billing across your enterprise. You can also create subscriptions in the Enterprise portal, but all other actions for setup will still require you to use the standard portal. \n\nIn summary, you can do everything you need to setup your Frame integration from the standard ARM portal. For more information on the ARM web portal see: \n[https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-portal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-portal) \n[block:callout]\n{\n  \"type\": \"info\",\n  \"body\": \"The [classic Azure web portal](https://account.windowsazure.com/Home/Index) may be what you have used in the past if you've had an account for some time. When you need to create a subscription, it will link you to the new ARM portal automatically (the link is called \\\"Developer Portal\\\").\",\n  \"title\": \"Classic Azure portal\"\n}\n[/block]\n\n[block:api-header]\n{\n  \"title\": \"Create an Azure Subscription\"\n}\n[/block]\nAzure resources are grouped into \"subscriptions\" - which you can view as sub-accounts within your overall Azure account. For Frame integration, you must dedicate a subscription specifically to Frame and you should not make any manual changes to it in the Azure portal beyond what is described in this article. You should also ensure that no servers, storage, or any other items already exist in the subscription for Frame. In this BYO setup, you will grant Frame full access to this subscription and everything in it - so it's important not to try to use the subscription with any other service (either before or after you have setup the Frame integration).\n[block:callout]\n{\n  \"type\": \"danger\",\n  \"title\": \"Do NOT use an existing subscription for your Frame integration\",\n  \"body\": \"You must create a new subscription that is 100% dedicated to your Frame integration. Frame's automation and orchestration requires a dedicated subscription with no other resources in it. If you do not follow this requirement Frame is not responsible for any issues which may affect other resources in your subscription not provisioned by Frame.\"\n}\n[/block]\nAgain, you can create a subscription from the ARM web portal or from your EA portal.\n\n##Using the standard Azure web portal to create a subscription\n\n1. Navigate to https://portal.azure.com\n2. Login\n3. Click (navigate) to \"More services\" at the bottom left corner of the portal\n4. Click Subscriptions\n5. At the top of the new window click on the + sign next to \"Add\"\n\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/1f745d5-Screen_Shot_2018-02-07_at_7.33.10_PM.png\",\n        \"Screen Shot 2018-02-07 at 7.33.10 PM.png\",\n        1226,\n        746,\n        \"#232323\"\n      ],\n      \"sizing\": \"full\"\n    }\n  ]\n}\n[/block]\n##Using the enterprise web portal\n\n1. Navigate to https://ea.azure.com\n2. Login\n3. Click \"Manage\"\n4. Click \"Subscriptions\"\n5. Click \"Add Subscription\"\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/41d1e2b-23255c1-create_subscription_ea.png\",\n        \"23255c1-create_subscription_ea.png\",\n        606,\n        586,\n        \"#2b2a3a\"\n      ]\n    }\n  ]\n}\n[/block]\nIn each case, you'll be taken to a wizard that walks you through the remaining steps which include phone verification, payment setup, and more.\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/edbf8bc-Screen_Shot_2018-02-07_at_7.29.05_PM.png\",\n        \"Screen Shot 2018-02-07 at 7.29.05 PM.png\",\n        1202,\n        727,\n        \"#2d70b4\"\n      ],\n      \"caption\": \"Azure subscription creation for an enterprise account\"\n    }\n  ]\n}\n[/block]\n\n[block:callout]\n{\n  \"type\": \"info\",\n  \"body\": \"Note: after you create your subscription it may take ~24 hours for it to be ready depending on your account type. For example, for enterprise accounts, an association of the subscription to your enterprise agreement may take up to a day.\",\n  \"title\": \"Creating subscriptions can take some time\"\n}\n[/block]\n\n[block:api-header]\n{\n  \"title\": \"Setting Subscription limits/quotas\"\n}\n[/block]\nIn order for the Frame platform to properly provision and manage virtual machines in your subscription, you will also need to set up appropriate limits/quotas for certain Azure services, as follows:\n\n- **Public IP addresses and network interfaces:** Increase the maximum number of Public IP addresses and network interfaces (NICs) by 220% of the expected maximum number of VMs you plan to use in your Frame account per region.  The default is 60 IPs per region. For example, if you are planning to have your Max capacity in your Frame Dashboard set to 100, you will need to increase your Public IP and NIC limit to 220. This enables the Frame platform to publish app updates from the Sandbox without issue, because the publishing process creates new instances without affecting existing user sessions (effectively consuming double the number of VMs during the publishing process). Basically, you need one public IP and one NIC for every VM that is provisioned. \n\n- **Cores:** Increase the maximum number of cores for each instance type series (N, D, F...etc) by 220% of your expected max VM settting per region (the default is 20 per series per region). For example, if you are planning to have your Max capacity in the Frame Dashboard set to 100 Pro 56GB (NV6, 6 cores) in Azure South Central, you will need to increase your N-series core limit to 1320 (100 x 6 x 2.2). \n\n- **VNets:** Frame will create one new Virtual Network (VNet) for each of the Frame accounts using your subscription. Frame Strategic tier customers have the ability to create multiple Frame sub-accounts; therefore multiple VNets will be needed at the Strategic Tier. Since the default Vnet limit per Azure Subscription is 50 per region, you may need to increase the limit of VPCs on your Azure account. \n\n- **Storage:** The default is 500TB per storage account with a max of 200 storage accounts (automatically created as needed) per subscription. This includes Azure file shares (For Frame P drive). This is typically enough for most initial use cases. Note, Azure storage limits are for combined Standard and Premium storage, today Frame only uses Standard storage.\n\nMore information on Azure service limits can be found here:\n[https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits](https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits) \n[block:callout]\n{\n  \"type\": \"info\",\n  \"title\": \"Deployment model\",\n  \"body\": \"When requesting limit/quota increases the Azure team may ask which deployment model is used. The method used is ARM (not ASM).\"\n}\n[/block]\n\n[block:api-header]\n{\n  \"title\": \"Create an Azure application registration\"\n}\n[/block]\nThis section assumes that you already have an active Azure account with a subscription dedicated to Frame. This also assumes you have set the resource limits for your subscription to levels high enough to accommodate your expected loads. To confirm your subscription, login to the Azure web portal, navigate to your subscription, and confirm that its status is \"active\": \n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/4a08aaf-fe4e0b5-byo_step_10.png\",\n        \"fe4e0b5-byo_step_10.png\",\n        2292,\n        1054,\n        \"#e6d6e4\"\n      ],\n      \"caption\": \"Managing subscriptions in the Azure web portal\"\n    }\n  ]\n}\n[/block]\nNext, you'll need to create an Azure app registration for Frame. The app registration is the mechanism by which you'll give Frame access to creating and managing virtual machines and storage resources in your Azure subscription.  Open the Azure Active Directory option and App registration section. From there, select \"New application registration\" to create a new app.\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/c7cceb3-9364ed5-byo_step_2.png\",\n        \"9364ed5-byo_step_2.png\",\n        2526,\n        1336,\n        \"#dbd0d9\"\n      ]\n    }\n  ]\n}\n[/block]\nYou'll see a panel titled \"Create.\" You'll be asked for the following app information:\n\n+ a valid Name:  you can choose any name, but we recommend you simply call it \"Frame\"\n+ select  \"Web app / API\"\n+ a valid Sign-on URL: you can use https://fra.me\n\nClick \"Create\" at the bottom of the panel.\n\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/d5b03fc-20d6ced-byo_step_3.png\",\n        \"20d6ced-byo_step_3.png\",\n        1204,\n        1424,\n        \"#222f36\"\n      ],\n      \"sizing\": \"full\"\n    }\n  ]\n}\n[/block]\nYou should see a notification that your application has been created successfully. It should now be available in your \"App registrations\" list.  \n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/040e9f5-c08d99b-byo_setp_4.png\",\n        \"c08d99b-byo_setp_4.png\",\n        2458,\n        1316,\n        \"#dac9d8\"\n      ]\n    }\n  ]\n}\n[/block]\nNext, select your new application from the list and **copy or write down the \"Application ID.\"** This \"Azure Application ID\" is one of the four values you will need for setting up your Frame integration (note that you do NOT need the \"Object ID\"):\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/689410f-a81b09c-byo_step_8.png\",\n        \"a81b09c-byo_step_8.png\",\n        1816,\n        1028,\n        \"#26282b\"\n      ]\n    }\n  ]\n}\n[/block]\nYou can copy/print the form below for tracking the values you'll need for your Frame integration.\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/bea9146-Screen_Shot_2018-02-09_at_1.08.21_PM.png\",\n        \"Screen Shot 2018-02-09 at 1.08.21 PM.png\",\n        552,\n        369,\n        \"#dbe2e2\"\n      ]\n    }\n  ]\n}\n[/block]\nNow navigate to the \"Properties\" panel, where you can set the logo of your application registration to the Frame logo icon. You can download and use this file: [Frame icon](http://fra.me/azappframelogo.png).\n\nThen change the \"Visible to users\" slider to \"No\" (this is not an application that you want your Office365 users to see). \n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/00a65f9-Screen_Shot_2018-02-09_at_2.22.34_PM.png\",\n        \"Screen Shot 2018-02-09 at 2.22.34 PM.png\",\n        1220,\n        751,\n        \"#252525\"\n      ],\n      \"sizing\": \"full\"\n    }\n  ]\n}\n[/block]\nNow go back to the Registered app page and click on \"All settings\" and navigate to the \"Keys\" section in the \"Settings\" menu.\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/96b7ed4-f484aa0-byo_step_5.png\",\n        \"f484aa0-byo_step_5.png\",\n        1870,\n        908,\n        \"#e7e8e8\"\n      ]\n    }\n  ]\n}\n[/block]\nWhen you're taken to the \"Keys\" page, enter the following:\n\n+ Enter the key Description under \"Passwords.\"  For our example, we used \"byo-tutorial-key\" - we'd suggest you use something like \"Frame-key\" \n+ Select the expiration period under \"Expires\" - we recommend using \"Never expires\" - otherwise your integration with Frame will not function after the expiration date and you would experience an outage.\n\nClick on \"Save.\" \n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/98fa395-e464b37-byo_step_6.png\",\n        \"e464b37-byo_step_6.png\",\n        1702,\n        846,\n        \"#262626\"\n      ]\n    }\n  ]\n}\n[/block]\n\n[block:callout]\n{\n  \"type\": \"danger\",\n  \"title\": \"WARNING:\",\n  \"body\": \"Please note that the app key is used by Frame to manage your BYO Azure account. If your key expires, Frame will no longer be able to manage your account for you and you will experience an outage. This is why we recommend selecting \\\"Never expires.\\\"\"\n}\n[/block]\nA notification will appear stating that your keys have been successfully updated. Your **secret** key (under \"Value\") will be displayed now and only this one time. Be sure to **copy or write the key value string down.** This is the second of the four values you will need for setting up your Frame integration. When you copy/write this down, note that it is your \"Azure Secret\" key. (If you're using the form from above, note that the \"Azure secret\" is the fourth entry.)\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/0f013ea-874e513-byo_step_7.png\",\n        \"874e513-byo_step_7.png\",\n        2186,\n        668,\n        \"#edd6d3\"\n      ]\n    }\n  ]\n}\n[/block]\n\n[block:callout]\n{\n  \"type\": \"danger\",\n  \"title\": \"IMPORTANT:\",\n  \"body\": \"Please note that the key value will only be displayed **once** after you click \\\"Save.\\\" Be sure to **copy or write this information down**, as you will not be able to obtain it again. If you lose your key for any reason, you can delete it and create a new one.\"\n}\n[/block]\nNow, go to \"Azure Active Directory\" > \"App registrations\" and click on your recently created application. \n\nFrom there, navigate back to \"Azure Active Directory\" and scroll down to open the \"Properties\" section. **Copy or write down the Directory ID** listed at the bottom of this section and mark it as the \"Directory ID\" - the third value that you'll need for your Frame integration.\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/63df19f-a7b3bc4-byo_step_9.png\",\n        \"a7b3bc4-byo_step_9.png\",\n        2546,\n        1328,\n        \"#dfd1db\"\n      ]\n    }\n  ]\n}\n[/block]\n### Adding Owner permissions \n\nThe last step consists of adding owner permissions to your new application for the subscription to be managed by Frame. \n\nOpen the \"Subscriptions\" section in the main menu. Find the subscription that you created for Frame and click on it. \n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/c0c2262-fe4e0b5-byo_step_10.png\",\n        \"fe4e0b5-byo_step_10.png\",\n        2292,\n        1054,\n        \"#e6d6e4\"\n      ]\n    }\n  ]\n}\n[/block]\n**Copy or write down the \"Subscription ID\"** as this will be the fourth value you need for your Frame integration. But you're not done yet! The next few steps are critical to complete:\n\nAfter clicking on your subscription, open \"Access control\" (IAM) and click \"Add\". A new panel will appear:\n\n+ Under the \"Role\" drop-down, select \"Owner\" (you cannot choose any other value, it must be Owner).\n+ Under \"Assign access to\", select \"Azure AD user, group, or application\"\n+ Under the \"Select\" drop-down, type the name of your new application to search for it (e.g. \"Frame\" or in the example below \"byo-tutorial-app\")\n\nSelect your app when it appears under \"Selected members\" and then click \"Save\". \n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/a336728-8f29328-byo_step_11.png\",\n        \"8f29328-byo_step_11.png\",\n        2542,\n        1424,\n        \"#dccee0\"\n      ]\n    }\n  ]\n}\n[/block]\nYour app should now be listed under the \"Access control (IAM)\" section. \n[block:callout]\n{\n  \"type\": \"warning\",\n  \"body\": \"Please make sure your app has the \\\"Owner\\\" role in the subscription. Your integration with Frame will not work otherwise.\",\n  \"title\": \"Important:\"\n}\n[/block]\n\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/d57baef-5e05976-byo_step_12.png\",\n        \"5e05976-byo_step_12.png\",\n        2542,\n        1334,\n        \"#d9c9dd\"\n      ]\n    }\n  ]\n}\n[/block]\nNow, you should have the following information written down after completing all the steps above:\n\n+ Azure Application ID\n\n+ Azure Directory ID\n\n+ Azure Subscription ID\n\n+ Azure Secret key value\n\nYou'll use these values for the Frame setup per below.\n[block:api-header]\n{\n  \"title\": \"Import your BYO Azure account into Frame\"\n}\n[/block]\nDepending on how you setup your account, you can either self-serve the input of your Azure subscription values or have Frame do so. When setting up your Frame account with the Frame Configurator, you'll select Azure as your infrastructure provider and choose \"Bring your own credentials.\"  You'll then be prompted for the four values collected above. Or you can provide the four values to your Frame support/account representative and we will setup the Frame account for you. Once you (or Frame) enters in the values, it will then take approximately two to three hours for the automated account setup process to complete. This process includes setting up storage accounts in all Azure regions supported by Frame and copying over the base Frame OS image into these regions.  \n[block:api-header]\n{\n  \"title\": \"Usage Estimates\"\n}\n[/block]\nThe total cost of your Azure service depends on your service tier with Azure and any custom pricing arrangements you may have. Full details of Azure pricing for these areas are listed in [Azure's pricing information online](https://azure.microsoft.com/en-us/pricing/). If you have an Enterprise Agreement, you can download your specific price list from the [EA Portal](https://ea.azure.com). \n\nFrame's default settings configure the following Azure instance types, which correspond to the Air and Pro system models: \n\n- D1_V2 (Air 4GB - Azure)\n- D2_V2 (Air 8GB - Azure)\n- NV6 (Pro 56GB)\n- NV24 (Pro 224GB)\n\nOther instance types are available through a custom configuration request to Frame Support. Note that when your subscription is linked to Frame, the base images for these instances are copied to each of the Azure regions supported by Frame.  \n\nStorage sizing is based on several factors specific to your apps: the base system image of the Windows OS, the size of your applications plus application data and any user data. Additional data is consumed if you are also using a utility server. \n\nThe default base system image for the Sandbox is 45 GB, but can be increased when creating an account via the Frame Configurator or via a Support request. The general formula for estimating the total amount of storage required is the Sandbox image size multiplied by the maximum number of instances multiplied by the monthly hours consumed. Total storage also includes the system image size of all Utility Servers multiplied by the number of hours consumed per month. Note that even if instances are powered off, storage is still consumed. \n\nYour networking usage on Azure also depends on your apps and the work patterns of your users. Azure networking limits and data transfer pricing are based on inbound and outbound data sent to or from Azure regions or the internet. Typical data transfer costs for Frame customers are between 1% and 2% of their overall monthly bill. For details about how your account will be charged for data transfers, please refer to Azure documentation. \n\nYour Azure expenses are separate from the cost of the Frame service for our BYO accounts. Azure bills your account according to your usage patterns on Frame, as described in [our documentation regarding capacity and scaling](doc:set-up-capacity-and-scaling).","excerpt":"Bring Your Own Azure Subscription to Frame","slug":"byo-azure-subscription-1","type":"basic","title":"BYO Azure Account"}

BYO Azure Account

Bring Your Own Azure Subscription to Frame

You can run the resources of your Frame account on an Azure subscription that Frame owns and manages or on one that you own and manage. The benefit of using Frame's Azure subscription is that the entire service is completely turn-key and you only pay one bill to Frame. When you bring your own (BYO) Azure subscription, you pay Microsoft directly for infrastructure (your VMs, storage, networking, etc.) and you pay Frame for its platform services. You might choose to have your Frame accounts use infrastructure provisioned under your own Azure subscription (BYO) because: * You wish to take advantage of your existing billing arrangements with Azure for convenience and/or pricing. For example, your organization may already have certain Azure consumption commitments or pre-payments -- and you can use Frame to consume those resources on your own Azure account. * You want to have additional administrative access to your Frame workloads for more detailed monitoring and metrics. * You want to configure other network integrations (VPN gateway) on your own within your Azure account. This document shows you how to create, setup, configure, and manage a BYO Azure account that integrates with Frame. If you already have an Azure account and subscription dedicated to Frame, you can move directly to the "Setting Subscription limits/quotas" section of the document. Steps at a glance: * [Create an Azure account: 5-10 minutes](https://docs.fra.me/v1.0/docs/byo-azure-subscription-1#create-an-azure-account) * [Create an Azure subscription: 5 minutes](https://docs.fra.me/v1.0/docs/byo-azure-subscription-1#create-an-azure-subscription) * [Set limits/quotas for your Azure account: optional](https://docs.fra.me/v1.0/docs/byo-azure-subscription-1#setting-subscription-limitsquotas) * [Create an Azure application registration: 5 minutes](https://docs.fra.me/v1.0/docs/byo-azure-subscription-1#create-an-azure-application-registration) * [Import your BYO Azure subscription credentials into Frame: 3 minutes for self-service](https://docs.fra.me/v1.0/docs/byo-azure-subscription-1#import-your-byo-azure-account-into-frame) [block:api-header] { "title": "Create an Azure Account" } [/block] Currently, Frame supports all free and paid Azure account types (including Bizspark and Enterprise accounts). Microsoft uses simple wizards to walk you through the entire process when signing up for Azure services. In a browser, go to [https://azure.microsoft.com](https://azure.microsoft.com) and click the "Start Free" or "Free Account" link on that first page. This will walk you through the account creation process for a "Free" account which can be upgraded later. You can bypass the "Free" account and go straight to the "Buy now" option if you prefer. [block:callout] { "type": "info", "title": "Microsoft ID Required", "body": "Please note that you will need a valid Microsoft ID to create an Azure account. If you don't have one already you can create one [here](https://account.microsoft.com/account)." } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/287d3f0-Screen_Shot_2018-02-09_at_11.15.25_AM.png", "Screen Shot 2018-02-09 at 11.15.25 AM.png", 1034, 592, "#1e398c" ], "caption": "You can choose to start for free or choose \"Buy now\" to go straight to a paid account." } ] } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/90306ca-4a084ac-upgrade_trial_account.png", "4a084ac-upgrade_trial_account.png", 1205, 356, "#3273c4" ], "caption": "Free Azure trial accounts can be upgraded later as well." } ] } [/block] Once you've created your Azure account, or if you already have one, you'll be ready to create a Subscription. This can be done multiple ways depending on what type of console access you have. We'll describe these consoles in the next section, so if you're already familiar with your console you can skip ahead. [block:api-header] { "title": "Azure Web Portals" } [/block] Azure offers several web portals for managing Azure accounts and subscriptions: - **Standard web portal** (https://portal.azure.com): this is the primary web portal created by Microsoft for Azure services and was developed to create a simpler management interface compared to the older "classic" portal which you might have used in the past. You might hear it referred to as the Azure Resource Manager (ARM) portal as well. - **Enterprise web portal** (https://ea.azure.com): this portal is only available to Azure customers that have signed an Enterprise Agreement (EA) with Microsoft. This portal (also referred to as the "EA portal") lets you manage admin users and track billing across your enterprise. You can also create subscriptions in the Enterprise portal, but all other actions for setup will still require you to use the standard portal. In summary, you can do everything you need to setup your Frame integration from the standard ARM portal. For more information on the ARM web portal see: [https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-portal](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-portal) [block:callout] { "type": "info", "body": "The [classic Azure web portal](https://account.windowsazure.com/Home/Index) may be what you have used in the past if you've had an account for some time. When you need to create a subscription, it will link you to the new ARM portal automatically (the link is called \"Developer Portal\").", "title": "Classic Azure portal" } [/block] [block:api-header] { "title": "Create an Azure Subscription" } [/block] Azure resources are grouped into "subscriptions" - which you can view as sub-accounts within your overall Azure account. For Frame integration, you must dedicate a subscription specifically to Frame and you should not make any manual changes to it in the Azure portal beyond what is described in this article. You should also ensure that no servers, storage, or any other items already exist in the subscription for Frame. In this BYO setup, you will grant Frame full access to this subscription and everything in it - so it's important not to try to use the subscription with any other service (either before or after you have setup the Frame integration). [block:callout] { "type": "danger", "title": "Do NOT use an existing subscription for your Frame integration", "body": "You must create a new subscription that is 100% dedicated to your Frame integration. Frame's automation and orchestration requires a dedicated subscription with no other resources in it. If you do not follow this requirement Frame is not responsible for any issues which may affect other resources in your subscription not provisioned by Frame." } [/block] Again, you can create a subscription from the ARM web portal or from your EA portal. ##Using the standard Azure web portal to create a subscription 1. Navigate to https://portal.azure.com 2. Login 3. Click (navigate) to "More services" at the bottom left corner of the portal 4. Click Subscriptions 5. At the top of the new window click on the + sign next to "Add" [block:image] { "images": [ { "image": [ "https://files.readme.io/1f745d5-Screen_Shot_2018-02-07_at_7.33.10_PM.png", "Screen Shot 2018-02-07 at 7.33.10 PM.png", 1226, 746, "#232323" ], "sizing": "full" } ] } [/block] ##Using the enterprise web portal 1. Navigate to https://ea.azure.com 2. Login 3. Click "Manage" 4. Click "Subscriptions" 5. Click "Add Subscription" [block:image] { "images": [ { "image": [ "https://files.readme.io/41d1e2b-23255c1-create_subscription_ea.png", "23255c1-create_subscription_ea.png", 606, 586, "#2b2a3a" ] } ] } [/block] In each case, you'll be taken to a wizard that walks you through the remaining steps which include phone verification, payment setup, and more. [block:image] { "images": [ { "image": [ "https://files.readme.io/edbf8bc-Screen_Shot_2018-02-07_at_7.29.05_PM.png", "Screen Shot 2018-02-07 at 7.29.05 PM.png", 1202, 727, "#2d70b4" ], "caption": "Azure subscription creation for an enterprise account" } ] } [/block] [block:callout] { "type": "info", "body": "Note: after you create your subscription it may take ~24 hours for it to be ready depending on your account type. For example, for enterprise accounts, an association of the subscription to your enterprise agreement may take up to a day.", "title": "Creating subscriptions can take some time" } [/block] [block:api-header] { "title": "Setting Subscription limits/quotas" } [/block] In order for the Frame platform to properly provision and manage virtual machines in your subscription, you will also need to set up appropriate limits/quotas for certain Azure services, as follows: - **Public IP addresses and network interfaces:** Increase the maximum number of Public IP addresses and network interfaces (NICs) by 220% of the expected maximum number of VMs you plan to use in your Frame account per region. The default is 60 IPs per region. For example, if you are planning to have your Max capacity in your Frame Dashboard set to 100, you will need to increase your Public IP and NIC limit to 220. This enables the Frame platform to publish app updates from the Sandbox without issue, because the publishing process creates new instances without affecting existing user sessions (effectively consuming double the number of VMs during the publishing process). Basically, you need one public IP and one NIC for every VM that is provisioned. - **Cores:** Increase the maximum number of cores for each instance type series (N, D, F...etc) by 220% of your expected max VM settting per region (the default is 20 per series per region). For example, if you are planning to have your Max capacity in the Frame Dashboard set to 100 Pro 56GB (NV6, 6 cores) in Azure South Central, you will need to increase your N-series core limit to 1320 (100 x 6 x 2.2). - **VNets:** Frame will create one new Virtual Network (VNet) for each of the Frame accounts using your subscription. Frame Strategic tier customers have the ability to create multiple Frame sub-accounts; therefore multiple VNets will be needed at the Strategic Tier. Since the default Vnet limit per Azure Subscription is 50 per region, you may need to increase the limit of VPCs on your Azure account. - **Storage:** The default is 500TB per storage account with a max of 200 storage accounts (automatically created as needed) per subscription. This includes Azure file shares (For Frame P drive). This is typically enough for most initial use cases. Note, Azure storage limits are for combined Standard and Premium storage, today Frame only uses Standard storage. More information on Azure service limits can be found here: [https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits](https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits) [block:callout] { "type": "info", "title": "Deployment model", "body": "When requesting limit/quota increases the Azure team may ask which deployment model is used. The method used is ARM (not ASM)." } [/block] [block:api-header] { "title": "Create an Azure application registration" } [/block] This section assumes that you already have an active Azure account with a subscription dedicated to Frame. This also assumes you have set the resource limits for your subscription to levels high enough to accommodate your expected loads. To confirm your subscription, login to the Azure web portal, navigate to your subscription, and confirm that its status is "active": [block:image] { "images": [ { "image": [ "https://files.readme.io/4a08aaf-fe4e0b5-byo_step_10.png", "fe4e0b5-byo_step_10.png", 2292, 1054, "#e6d6e4" ], "caption": "Managing subscriptions in the Azure web portal" } ] } [/block] Next, you'll need to create an Azure app registration for Frame. The app registration is the mechanism by which you'll give Frame access to creating and managing virtual machines and storage resources in your Azure subscription. Open the Azure Active Directory option and App registration section. From there, select "New application registration" to create a new app. [block:image] { "images": [ { "image": [ "https://files.readme.io/c7cceb3-9364ed5-byo_step_2.png", "9364ed5-byo_step_2.png", 2526, 1336, "#dbd0d9" ] } ] } [/block] You'll see a panel titled "Create." You'll be asked for the following app information: + a valid Name: you can choose any name, but we recommend you simply call it "Frame" + select "Web app / API" + a valid Sign-on URL: you can use https://fra.me Click "Create" at the bottom of the panel. [block:image] { "images": [ { "image": [ "https://files.readme.io/d5b03fc-20d6ced-byo_step_3.png", "20d6ced-byo_step_3.png", 1204, 1424, "#222f36" ], "sizing": "full" } ] } [/block] You should see a notification that your application has been created successfully. It should now be available in your "App registrations" list. [block:image] { "images": [ { "image": [ "https://files.readme.io/040e9f5-c08d99b-byo_setp_4.png", "c08d99b-byo_setp_4.png", 2458, 1316, "#dac9d8" ] } ] } [/block] Next, select your new application from the list and **copy or write down the "Application ID."** This "Azure Application ID" is one of the four values you will need for setting up your Frame integration (note that you do NOT need the "Object ID"): [block:image] { "images": [ { "image": [ "https://files.readme.io/689410f-a81b09c-byo_step_8.png", "a81b09c-byo_step_8.png", 1816, 1028, "#26282b" ] } ] } [/block] You can copy/print the form below for tracking the values you'll need for your Frame integration. [block:image] { "images": [ { "image": [ "https://files.readme.io/bea9146-Screen_Shot_2018-02-09_at_1.08.21_PM.png", "Screen Shot 2018-02-09 at 1.08.21 PM.png", 552, 369, "#dbe2e2" ] } ] } [/block] Now navigate to the "Properties" panel, where you can set the logo of your application registration to the Frame logo icon. You can download and use this file: [Frame icon](http://fra.me/azappframelogo.png). Then change the "Visible to users" slider to "No" (this is not an application that you want your Office365 users to see). [block:image] { "images": [ { "image": [ "https://files.readme.io/00a65f9-Screen_Shot_2018-02-09_at_2.22.34_PM.png", "Screen Shot 2018-02-09 at 2.22.34 PM.png", 1220, 751, "#252525" ], "sizing": "full" } ] } [/block] Now go back to the Registered app page and click on "All settings" and navigate to the "Keys" section in the "Settings" menu. [block:image] { "images": [ { "image": [ "https://files.readme.io/96b7ed4-f484aa0-byo_step_5.png", "f484aa0-byo_step_5.png", 1870, 908, "#e7e8e8" ] } ] } [/block] When you're taken to the "Keys" page, enter the following: + Enter the key Description under "Passwords." For our example, we used "byo-tutorial-key" - we'd suggest you use something like "Frame-key" + Select the expiration period under "Expires" - we recommend using "Never expires" - otherwise your integration with Frame will not function after the expiration date and you would experience an outage. Click on "Save." [block:image] { "images": [ { "image": [ "https://files.readme.io/98fa395-e464b37-byo_step_6.png", "e464b37-byo_step_6.png", 1702, 846, "#262626" ] } ] } [/block] [block:callout] { "type": "danger", "title": "WARNING:", "body": "Please note that the app key is used by Frame to manage your BYO Azure account. If your key expires, Frame will no longer be able to manage your account for you and you will experience an outage. This is why we recommend selecting \"Never expires.\"" } [/block] A notification will appear stating that your keys have been successfully updated. Your **secret** key (under "Value") will be displayed now and only this one time. Be sure to **copy or write the key value string down.** This is the second of the four values you will need for setting up your Frame integration. When you copy/write this down, note that it is your "Azure Secret" key. (If you're using the form from above, note that the "Azure secret" is the fourth entry.) [block:image] { "images": [ { "image": [ "https://files.readme.io/0f013ea-874e513-byo_step_7.png", "874e513-byo_step_7.png", 2186, 668, "#edd6d3" ] } ] } [/block] [block:callout] { "type": "danger", "title": "IMPORTANT:", "body": "Please note that the key value will only be displayed **once** after you click \"Save.\" Be sure to **copy or write this information down**, as you will not be able to obtain it again. If you lose your key for any reason, you can delete it and create a new one." } [/block] Now, go to "Azure Active Directory" > "App registrations" and click on your recently created application. From there, navigate back to "Azure Active Directory" and scroll down to open the "Properties" section. **Copy or write down the Directory ID** listed at the bottom of this section and mark it as the "Directory ID" - the third value that you'll need for your Frame integration. [block:image] { "images": [ { "image": [ "https://files.readme.io/63df19f-a7b3bc4-byo_step_9.png", "a7b3bc4-byo_step_9.png", 2546, 1328, "#dfd1db" ] } ] } [/block] ### Adding Owner permissions The last step consists of adding owner permissions to your new application for the subscription to be managed by Frame. Open the "Subscriptions" section in the main menu. Find the subscription that you created for Frame and click on it. [block:image] { "images": [ { "image": [ "https://files.readme.io/c0c2262-fe4e0b5-byo_step_10.png", "fe4e0b5-byo_step_10.png", 2292, 1054, "#e6d6e4" ] } ] } [/block] **Copy or write down the "Subscription ID"** as this will be the fourth value you need for your Frame integration. But you're not done yet! The next few steps are critical to complete: After clicking on your subscription, open "Access control" (IAM) and click "Add". A new panel will appear: + Under the "Role" drop-down, select "Owner" (you cannot choose any other value, it must be Owner). + Under "Assign access to", select "Azure AD user, group, or application" + Under the "Select" drop-down, type the name of your new application to search for it (e.g. "Frame" or in the example below "byo-tutorial-app") Select your app when it appears under "Selected members" and then click "Save". [block:image] { "images": [ { "image": [ "https://files.readme.io/a336728-8f29328-byo_step_11.png", "8f29328-byo_step_11.png", 2542, 1424, "#dccee0" ] } ] } [/block] Your app should now be listed under the "Access control (IAM)" section. [block:callout] { "type": "warning", "body": "Please make sure your app has the \"Owner\" role in the subscription. Your integration with Frame will not work otherwise.", "title": "Important:" } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/d57baef-5e05976-byo_step_12.png", "5e05976-byo_step_12.png", 2542, 1334, "#d9c9dd" ] } ] } [/block] Now, you should have the following information written down after completing all the steps above: + Azure Application ID + Azure Directory ID + Azure Subscription ID + Azure Secret key value You'll use these values for the Frame setup per below. [block:api-header] { "title": "Import your BYO Azure account into Frame" } [/block] Depending on how you setup your account, you can either self-serve the input of your Azure subscription values or have Frame do so. When setting up your Frame account with the Frame Configurator, you'll select Azure as your infrastructure provider and choose "Bring your own credentials." You'll then be prompted for the four values collected above. Or you can provide the four values to your Frame support/account representative and we will setup the Frame account for you. Once you (or Frame) enters in the values, it will then take approximately two to three hours for the automated account setup process to complete. This process includes setting up storage accounts in all Azure regions supported by Frame and copying over the base Frame OS image into these regions. [block:api-header] { "title": "Usage Estimates" } [/block] The total cost of your Azure service depends on your service tier with Azure and any custom pricing arrangements you may have. Full details of Azure pricing for these areas are listed in [Azure's pricing information online](https://azure.microsoft.com/en-us/pricing/). If you have an Enterprise Agreement, you can download your specific price list from the [EA Portal](https://ea.azure.com). Frame's default settings configure the following Azure instance types, which correspond to the Air and Pro system models: - D1_V2 (Air 4GB - Azure) - D2_V2 (Air 8GB - Azure) - NV6 (Pro 56GB) - NV24 (Pro 224GB) Other instance types are available through a custom configuration request to Frame Support. Note that when your subscription is linked to Frame, the base images for these instances are copied to each of the Azure regions supported by Frame. Storage sizing is based on several factors specific to your apps: the base system image of the Windows OS, the size of your applications plus application data and any user data. Additional data is consumed if you are also using a utility server. The default base system image for the Sandbox is 45 GB, but can be increased when creating an account via the Frame Configurator or via a Support request. The general formula for estimating the total amount of storage required is the Sandbox image size multiplied by the maximum number of instances multiplied by the monthly hours consumed. Total storage also includes the system image size of all Utility Servers multiplied by the number of hours consumed per month. Note that even if instances are powered off, storage is still consumed. Your networking usage on Azure also depends on your apps and the work patterns of your users. Azure networking limits and data transfer pricing are based on inbound and outbound data sent to or from Azure regions or the internet. Typical data transfer costs for Frame customers are between 1% and 2% of their overall monthly bill. For details about how your account will be charged for data transfers, please refer to Azure documentation. Your Azure expenses are separate from the cost of the Frame service for our BYO accounts. Azure bills your account according to your usage patterns on Frame, as described in [our documentation regarding capacity and scaling](doc:set-up-capacity-and-scaling).