From 70d7dd1547f77ca8d892d1acd686b672d4ad864f Mon Sep 17 00:00:00 2001 From: Fernando Antivero Date: Wed, 13 May 2026 13:31:00 -0300 Subject: [PATCH 1/3] update VM SKU and OS to modern Gen2 configuration - Replace Standard_A4_v2 (Gen1-only) with Standard_D2s_v3 (Gen2-capable) - VMSS (web tier): 2025-datacenter-core-smalldisk-g2 (Server Core for IIS) - Mock on-prem VM: 2025-datacenter-smalldisk-g2 (full desktop for Bastion RDP) - Smaller disk, faster boot, reduced attack surface on web tier Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../nestedtemplates/azure-network-azuredeploy.bicep | 4 ++-- .../nestedtemplates/azure-network-azuredeploy.json | 4 ++-- .../nestedtemplates/mock-onprem-azuredeploy.bicep | 9 ++------- .../nestedtemplates/mock-onprem-azuredeploy.json | 4 ++-- 4 files changed, 8 insertions(+), 13 deletions(-) diff --git a/solutions/secure-hybrid-network/nestedtemplates/azure-network-azuredeploy.bicep b/solutions/secure-hybrid-network/nestedtemplates/azure-network-azuredeploy.bicep index 27e2448f..105b84c1 100644 --- a/solutions/secure-hybrid-network/nestedtemplates/azure-network-azuredeploy.bicep +++ b/solutions/secure-hybrid-network/nestedtemplates/azure-network-azuredeploy.bicep @@ -5,7 +5,7 @@ param adminPassword string @description('The count of Windows virtual machines to create.') param webServerInstanceCount int = 2 -param vmSize string = 'Standard_A4_v2' +param vmSize string = 'Standard_D2s_v3' param configureSitetosite bool = true param hubNetwork object = { name: 'vnet-hub' @@ -55,7 +55,7 @@ param location string = resourceGroup().location var logAnalyticsWorkspaceName = 'la-${uniqueString(subscription().subscriptionId, resourceGroup().id)}' var vmssName = 'vmss-web-server' -var windowsOSVersion = '2016-Datacenter' +var windowsOSVersion = '2025-datacenter-core-smalldisk-g2' resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2025-02-01' = { name: logAnalyticsWorkspaceName diff --git a/solutions/secure-hybrid-network/nestedtemplates/azure-network-azuredeploy.json b/solutions/secure-hybrid-network/nestedtemplates/azure-network-azuredeploy.json index 8cb3aed7..691bcc8c 100644 --- a/solutions/secure-hybrid-network/nestedtemplates/azure-network-azuredeploy.json +++ b/solutions/secure-hybrid-network/nestedtemplates/azure-network-azuredeploy.json @@ -18,7 +18,7 @@ }, "vmSize": { "type": "string", - "defaultValue": "Standard_A4_v2" + "defaultValue": "Standard_D2s_v3" }, "configureSitetosite": { "type": "bool", @@ -101,7 +101,7 @@ "vmssName": "vmss-web-server", "peering-name-hub-to-spoke": "hub-to-spoke", "peering-name-spoke-to-hub": "spoke-to-hub", - "windowsOSVersion": "2022-datacenter-g2" + "windowsOSVersion": "2025-datacenter-core-smalldisk-g2" }, "resources": [ { diff --git a/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.bicep b/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.bicep index 4c74e592..b33b3280 100644 --- a/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.bicep +++ b/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.bicep @@ -21,13 +21,13 @@ param bastionHost object = { publicIPAddressName: 'pip-bastion' nsgName: 'nsg-hub-bastion' } -param vmSize string = 'Standard_A4_v2' +param vmSize string = 'Standard_D2s_v3' param configureSitetosite bool = true param location string = resourceGroup().location var nicNameWindowsName = 'nic-windows' var vmNameWindowsName = 'vm-windows' -var windowsOSVersion = '2016-Datacenter' +var windowsOSVersion = '2025-datacenter-smalldisk-g2' resource mocOnpremNetworkResource 'Microsoft.Network/virtualNetworks@2024-05-01' = { name: mocOnpremNetwork.name @@ -283,11 +283,6 @@ resource windowsVM 'Microsoft.Compute/virtualMachines@2024-11-01' = { adminPassword: adminPassword windowsConfiguration: { enableAutomaticUpdates: true - patchSettings: { - //Machines should be configured to periodically check for missing system updates - assessmentMode: 'AutomaticByPlatform' - patchMode: 'AutomaticByPlatform' - } } } storageProfile: { diff --git a/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.json b/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.json index 8adc0187..cb872616 100644 --- a/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.json +++ b/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.json @@ -38,7 +38,7 @@ }, "vmSize": { "type": "string", - "defaultValue": "Standard_DS1_v2" + "defaultValue": "Standard_D2s_v3" }, "configureSitetosite": { "type": "bool", @@ -51,7 +51,7 @@ "variables": { "nicNameWindows": "nic-windows", "vmNameWindows": "vm-windows", - "windowsOSVersion": "2016-Datacenter" + "windowsOSVersion": "2025-datacenter-smalldisk-g2" }, "resources": [ { From a4d19e22161f1c2cdb20643b09dc5768c715c109 Mon Sep 17 00:00:00 2001 From: Fernando Antivero Date: Thu, 28 May 2026 14:50:32 -0300 Subject: [PATCH 2/3] Address PR Feedback: update vmSize default in README Update parameter tables to reflect new Standard_D2s_v3 default. Co-authored-by: GitHub Copilot (Claude Opus 4.6) --- solutions/secure-hybrid-network/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/solutions/secure-hybrid-network/README.md b/solutions/secure-hybrid-network/README.md index 38f5e7e0..58dc0ce6 100644 --- a/solutions/secure-hybrid-network/README.md +++ b/solutions/secure-hybrid-network/README.md @@ -69,7 +69,7 @@ az deployment group create -n firewallDnat -g rg-site-to-site-azure-network-east |---|---|---|--| | adminUserName | string | The admin user name for the virtual machines. | azureadmin | | adminPassword | securestring | The admin password for the virtual machines. | null | -| vmSize | string | Size of the load-balanced virtual machines. | Standard_A4_v2 | +| vmSize | string | Size of the load-balanced virtual machines. | Standard_D2s_v3 | | configureSitetosite | bool | Condition for configuring a site-to-site VPN connection. | true | | hubNetwork | object | Object representing the configuration of the hub network. | name, addressPrefix | | spokeNetwork | object | Object representing the configuration of the spoke network. | name, addressPrefix, subnetName, subnetPrefix, subnetNsgName | @@ -101,7 +101,7 @@ az deployment group create -n firewallDnat -g rg-site-to-site-azure-network-east | mocOnpremNetwork | object | Object representing the configuration of the mock on-prem network. | name, addressPrefix, mgmt, subnetPrefix | | mocOnpremGateway | object | Object representing the configuration of the VPN gateway. | name, subnetName, subnetPrefix, publicIPAddressName | | bastionHost | object | Object representing the configuration of the Bastion host. | name, subnetName, subnetPrefix, publicIPAddressName, nsgName | -| vmSize | string | Size of the virtual machine. | Standard_A4_v2 | +| vmSize | string | Size of the virtual machine. | Standard_D2s_v3 | | configureSitetosite | bool | Condition for configuring a site-to-site VPN connection. | true | | location | string | Location to be used for all resources. | rg location | From 82d0fb1ee8c65bee512e49f6afc0bdd66a9bc653 Mon Sep 17 00:00:00 2001 From: Fernando Antivero Date: Thu, 28 May 2026 14:50:44 -0300 Subject: [PATCH 3/3] Address PR Feedback: retain patchSettings on mock-onprem VM Keep AutomaticByPlatform patch assessment and mode settings on the mock on-premises VM for production-like configuration. Co-authored-by: GitHub Copilot (Claude Opus 4.6) --- .../nestedtemplates/mock-onprem-azuredeploy.bicep | 4 ++++ .../nestedtemplates/mock-onprem-azuredeploy.json | 9 ++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.bicep b/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.bicep index b33b3280..7c8dbfc2 100644 --- a/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.bicep +++ b/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.bicep @@ -283,6 +283,10 @@ resource windowsVM 'Microsoft.Compute/virtualMachines@2024-11-01' = { adminPassword: adminPassword windowsConfiguration: { enableAutomaticUpdates: true + patchSettings: { + assessmentMode: 'AutomaticByPlatform' + patchMode: 'AutomaticByPlatform' + } } } storageProfile: { diff --git a/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.json b/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.json index cb872616..7041b124 100644 --- a/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.json +++ b/solutions/secure-hybrid-network/nestedtemplates/mock-onprem-azuredeploy.json @@ -327,7 +327,14 @@ "osProfile": { "computerName": "[variables('vmNameWindows')]", "adminUsername": "[parameters('adminUsername')]", - "adminPassword": "[parameters('adminPassword')]" + "adminPassword": "[parameters('adminPassword')]", + "windowsConfiguration": { + "enableAutomaticUpdates": true, + "patchSettings": { + "assessmentMode": "AutomaticByPlatform", + "patchMode": "AutomaticByPlatform" + } + } }, "storageProfile": { "imageReference": {