Hello, Cloud Gurus,
and welcome back for this lesson
where we're going to take a peek into the future
and take a look at Azure Policy Guest Configuration.
Let's take a look at what we're going to cover.
First up, we'll briefly review Azure Policy
and then we'll answer the question.
What is guest configuration?
We'll take a look at the guest configuration requirements
and the guest configuration policy types.
And finally, we'll wrap up with a demo,
where we will configure Azure Policy guest configuration.
Let's dive in.
So what is Azure Policy?
Well, Azure Policy is a service
that can help your organization check and correct compliance
in your Microsoft Azure environment.
Now you might do this to meet organizational standards,
or an industry standard
that your company needs to adhere to.
In Azure Policy you declare rules,
and these rules are referred to as policies,
and then you apply those policies to your Azure resources
and you can even bundle your policies up together
into what's known as initiatives,
and apply the policy initiatives to your Azure resources.
And you can also apply these policies
to large groups of resources
by targeting things like management groups,
subscriptions, or resource groups.
But the challenge with Azure Policy and hybrid computing
is that Azure Policy is designed to work
at the Azure resource management layer.
And for Azure Arc servers, this means you can make sure
that extensions are installed
and that other things like tags are applied,
but wouldn't it be great
if you could also ensure that the operating system
and software configuration deployed to your VMs
is also compliant?
Well, good news.
That's possible too.
And let's take a look at that now.
At a high level, outside Azure
we have our on-premises servers.
They can be in other clouds, but for our purposes
we'll say that they're on-premises.
and we can also have our Azure resources like Azure VMs.
And we know that we can represent
our on-premises servers in Azure as Azure Arc servers.
And we can apply Azure Policy
to ensure our Azure resources are compliant.
For Azure Vms, this includes not only the VM,
but other associated resources
like disks and network interfaces.
Azure Policy guest configuration
allows you to extend Azure Policy
to audit operating system and software configuration
and even correct compliance issues in Azure VMs.
Azure Arc allows you to extend some of the capabilities
of Azure Policy to operating systems of servers
running in on-premises data centers,
or hosted by third party cloud providers.
Now the name guest configuration might seem a little odd.
The reason Microsoft is using that name
is because they are referring to guests
as virtual machine guests running on a hypervisor,
and these guests can be on Hyper-V, VMware, or in Azure,
or they can even be physical servers.
So I guess that does make the name a little confusing,
but when Microsoft is referring to guests,
they're referring to the operating system
and software within a virtual machine or a server.
Now let's take a look at the requirements
for guest configuration for both Azure VMs
and Azure Arc connected machines.
To use guest configuration with Azure VMs
you need to have the Guest Configuration
Virtual Machine extension deployed to your VM,
and you also need to have
a system-assigned managed identity.
Now the extension isn't required for Azure Arc-enabled
servers because it's included
in the Azure Arc connected machine agent
that is deployed when you onboard a server into Azure Arc,
but the Guest Configuration extension is required
for all your Azure virtual machines.
It's good to know that Microsoft provides
a policy initiative that can enable all of the requirements
for guest configuration on your Azure VMs automatically.
And we'll take a look at this policy initiative
in the demo later in this lesson.
Windows Server 2012 or later is required
for both Azure VMs and Azure Arc connected machines.
And you'll also need to have network connectivity
for the guest configuration servers.
Now there are 2 guest configuration policy types.
The first are built-in policies
that are created by Microsoft.
And these policies allow you to define baseline settings
for your server operating system.
And they are customizable using parameters
and provide best practice settings for your servers.
And these policies are handled automatically
by the Azure Arc connected machine agent,
or the guest configuration extension for your Azure VMs.
Now you can also create custom guest configuration policies,
and these use a new version
of the Desired State Configuration engine.
To create a custom guest configuration policy,
you need to create a custom guest configuration package,
which includes your configuration mof file.
And if you are thinking that sounds familiar, it is,
because you author DSC configuration
and generate a mof file from your declared configuration.
And then you need to test and upload your package artifact
to a storage account.
Now the artifact is just a zip file
of your custom configuration and all its dependencies.
And then you need to create a custom policy definition
and to sign it through Azure Policy.
Now creating a custom guest configuration package
is a fairly lengthy process.
So we won't take a look at it in the demo.
And instead I'll drop a link
in the resources section for this lesson,
so you can take a look.
All right, let's take a look at a demo
of assigning Azure Policy guest configuration.
In this demo, we have some Azure virtual machines
and some Azure Arc connected machines,
and they're all on the same Azure subscription.
We will prepare our Azure machines
by applying the policy
to deploy the guest configuration prerequisites.
And you'll remember that we don't need to do this
for our Azure Arc connected machines.
And then we will apply the Windows baseline
built-in policy initiative
to all the servers in our environment,
including our Azure Arc connected machines
by linking the baseline policy to our subscription.
Let's take a look at the demo.
All right, so here we are in the Azure portal.
Let's go ahead and navigate to Azure Policy
and then we'll navigate
to Policy Definitions under Authoring.
And this contains all of the policy definitions
in our environment.
And let's go ahead and search for the Azure Policy
that will install the guest configuration prerequisites
on our Azure virtual machines.
To do that we're going to change the category
to guest configuration.
So we'll go ahead and deselect all the other categories.
And then we'll search for guest configuration.
We'll go ahead and select that.
And then we'll go ahead and search
for the Deploy prerequisites
to enable guest configuration policy initiative.
I'll just drag out this first column and we can see here
we have the deploy prerequisites
to enable guest configuration policies
on virtual machines policy initiative.
So we'll go ahead and select that.
And then we'll go ahead and assign this policy.
We'll set the scope to our subscription.
Go ahead and hit Select.
We're not going to apply any exclusions
and we'll leave our policy enforced.
We'll go ahead and hit Next.
There's no parametes to apply,
so we'll go ahead and hit Next.
Now we do want to create a remediation task
that will correct any issues
on preexisting virtual machines.
So we'll go ahead and select Create Remediation Task.
We'll use a system-assigned managed identity
and I'm just going to change the region to Australia East.
And then we can go ahead and select Review and Create,
and then we can go ahead and hit Create.
Now this will just take a moment.
So I'll come back when this is done.
All right, that policy assignment is done.
Now I'm going to navigate back to Azure Policy
and we'll go ahead and search
for the Windows baseline policy initiative.
So I'll just change the search to baseline.
And then we've got this Microsoft created policy initiative.
So I'll go ahead and select that.
And this policy initiative is called
Windows machine should meet requirements
for Azure compute security baseline.
It's a decent name, but basically what it means
is that Microsoft has a set of recommended settings
for your Windows virtual machines.
And you can use this policy initiative
combined with guest configuration
to automatically set those settings
on your Azure VMs and your Azure Arc connected machines.
So let's go ahead and assign this policy initiative.
We'll set the scope to our subscription again
then we'll go ahead and hit Next.
Now by default, it doesn't show the parameters here,
because they all have assigned default values,
but I want to change one of the values.
And I also want to show the list
of parameters so that you can customize this as required.
So I'm going to go ahead and untick the check box,
to only show parameters that need input.
And then I'm going to change the include Azure Arc
connected servers to true,
because I want to include both my Azure VMs
and my Azure Arc connected servers.
And you can see here, you can go ahead
and change a number of the security settings if required.
For example, if you wanted to allow
the convenience PIN sign-in option,
or you wanted to allow guest accounts.
We don't want to change any of the default values,
so I'm just going to go ahead and select Next.
Now this policy initiative will be remediated
by the Guest Configuration extension,
or the Azure Arc connected machine agent.
So we don't need to worry about remediation,
so we can go ahead and click Review and Create,
and then we can go ahead and click Create.
And this will just take a moment to deploy,
so we'll come back when this is done.
All right, that policy initiative has been applied
and Azure Policy has already started working
in the background,
to start to bring these resources into compliance.
So let's take a look at our compliance in Azure Policy.
We'll navigate back to Azure Policy
and then we'll navigate into compliance.
And if I expand out this left column here,
we can see that we have
the default Azure security benchmark policy initiative.
And we have our 2 policy initiatives
that we've assigned,
the deploy prerequisites and the Windows security baseline.
And we can see we're already 33% compliant
with our prerequisites.
And then once our prerequisites are deployed,
it will start to bring our Windows machines
into compliance with the security baseline.
All right, that wraps up this demo.
Now let's go and take a look
at what we've covered in this lesson.
All right.
So what have we covered?
Azure Policy helps ensure compliance
by auditing and remediating compliance issues.
And policies can be bundled together into policy initiatives
and applied to your resources at scale,
by applying your policies, or your policy initiatives
to things like management groups,
resource groups, and subscriptions.
And guest configuration allows you to extend Azure Policy
to manage operating systems and software
on your virtual machines.
And Azure Arc extends that guest configuration functionality
to servers on-premises and in other clouds.
And you can also create custom guest policies
to apply settings using the latest version
of Desired State Configuration.
All right, thanks for being with me in this lesson
and I hope you found it useful
and I look forward to seeing you in the next lesson.