[Autogenerated] So let's now turn our attention in this demo to Azure policy,
guest configuration Now we don't have the time or scope to
do a full deep dive of Azure policy.
So I would recommend you look for Azure policy in the Pluralsight library.
I myself have done quite a bit of work in as your policy the workflow with
policy is that you start over at definitions and you've got your individual
JSON policy files and you also have what are called initiatives first let
me change the definition type here,
the policy and then for category notice all of the
categories that Microsoft provides,
you can go out to the Azure policy repo it GitHub to get
all of these source files and more.
I'm going to actually de select everything and look up just guest configuration.
Alright, so here's where we can see what Microsoft is surfacing.
Some of the things that we can audit and potentially remediate.
Now notice here we have audit policies,
we have machines should have the log analytics agent installed.
Windows firewall policies, security settings,
audit machines that don't have specific PowerShell modules
installed audit Windows machines that have extra accounts
in the administrators group.
Again,
the point with guest configuration is that we're creating compliance
policies for the internal state of the machine that is the operating system
environment and we can contrast that with just Azure policy in general we
can look at something like the tags category and we've got all sorts of
require a tag and its value and hair it attack now we can actually apply
these regular Azure policies to our Azure arc enabled servers which really
is a great great thing.
So I just want to underline that we have as your policy for resource
compliance and guest configuration for operating system compliance.
Now I'm going to change the definition type two initiative and I'm going
to come back to my original filter which is guest configuration because
we're going to go ahead and apply one of these.
Now we've got three as of this recording initiatives.
An initiative is simply a container that contains one or more policy
definitions and the ideas that you can assign an initiative to
simultaneously assign those related policies instead of having to
otherwise assign the policies individually.
That's no way to work.
And so we've got this important one in the middle here deploy prerequisites to
enable guest configuration policies on virtual machines.
This is important why while this is a convenient way to ensure that your
machines are set to process guest configuration policies,
there's some prerequisites like having a system assigned managed
identity in Azure Active Directory and there's also the Windows
guest configuration extension to enable guest configuration
assignments on both Windows and Linux VMS.
And the thing with Azure policy is that there are a number of effects,
audit would be an effect that just determines compliance state and stops
there but these particular effects are much more powerful,
modify and deploy if not exists,
will actually create remediation tasks to bring the
resource into compliance you see.
So I'm going to go ahead and assign this now in the real world,
you'd normally duplicate your initiative.
You're going to copy an existing system initiative so that you
have full read write control over and I'm just going to go ahead
and assign this as is and then the scope is going to be where in
the Azure management hierarchy, this goes into effect,
I'm going to scope it beyond the subscription,
I'm going to bring it right down to my arc R G resource group so
I'm going to affect just my arc virtual machines.
You can optionally create exclusions of the scope.
If we scoped this initiative at the subscription,
the exclusions would be resource groups.
I scoped this initiative at the resource group so we can
create resource exceptions if we want to best idea to change
the name to something more meaningful,
but I'm going to let it roll right here in this demo,
I don't have any parameters in this.
So I'm going to continue.
Do you want to create remediation,
This is going to allow existing resources to process any changes that are in
the initiative and I do want that and I'm going to let Azure create a system
assigned managed identity and Azure will grant that identity the contributor
role assignment at the appropriate scope.
So that has that read, write access here.
We can see our policies and we can provide custom
noncompliance messages to let our compliance,
people are support,
people are colleagues know some justification for why whatever it is,
whether it's a deployment or an existing resource is out of compliance when
you click next and then we'll complete the assignment.
Normally takes a few minutes for that to kick in and start to process.
We can follow the compliance status of our work in a couple different spots.
We can in the Azure policy go over to compliance and we can see what's going on.
The overview pages you might have noticed before shows our compliance state.
I've got some issues going on in my environment.
As you can see back this Azure security benchmark,
I don't have many resources that are in compliance.
But what's cool about this is that you can report on the
details of the compliance state and again,
depending upon whether the policy is using modify or deploy,
if not exists, you can do a remediation task to fix those errors.
Yeah, well, this Azure security benchmark is one of the,
well,
it's actually the default initiative that comes
with Microsoft defender for cloud.
There's a lot of controls in there.
And so it makes sense that I'm not compliant for most
of these because they're again,
there's a lot of controls in there that are giving me advice on how I should configure my environment