Merge pull request #114626 from parulbansal2009/master

Updating Policies

Author: v-shmck

articles/governance/blueprints/samples/canada-federal-pbmm/control-mapping.md

@@ -1,7 +1,7 @@
 ---
 title: Canada Federal PBMM blueprint sample controls
 description: Control mapping of the Canada Federal PBMM blueprint samples. Each control is mapped to one or more Azure Policies that assist with assessment.
-ms.date: 09/04/2019
+ms.date: 05/08/2020
 ms.topic: sample
 ---
 # Control mapping of the Canada Federal PBMM blueprint sample
@@ -91,8 +91,8 @@ separation of duties.
 
 - A maximum of 3 owners should be designated for your subscription
 - There should be more than one owner assigned to your subscription
-- Audit Windows VMs in which the Administrators group contains any of the specified members
-- Audit Windows VMs in which the Administrators group does not contain all of the specified members
+- Show audit results from Windows VMs in which the Administrators group contains any of the specified members
+- Show audit results from Windows VMs in which the Administrators group does not contain all of the specified members
 - Deploy requirements to audit Windows VMs in which the Administrators group contains any of the specified members
 - Deploy requirements to audit Windows VMs in which the Administrators group does not contain all of the specified members
 
@@ -106,8 +106,8 @@ indicators can help you ensure least privilege controls are implemented.
 
 - A maximum of 3 owners should be designated for your subscription
 - There should be more than one owner assigned to your subscription
-- Audit Windows VMs in which the Administrators group contains any of the specified members
-- Audit Windows VMs in which the Administrators group does not contain all of the specified members
+- Show audit results from Windows VMs in which the Administrators group contains any of the specified members
+- Show audit results from Windows VMs in which the Administrators group does not contain all of the specified members
 - Deploy requirements to audit Windows VMs in which the Administrators group contains any of the specified members
 - Deploy requirements to audit Windows VMs in which the Administrators group does not contain all of the specified members
 
@@ -134,7 +134,7 @@ connections from accounts without passwords. Additionally, the blueprint assigns
 definition that helps you monitor unrestricted access to storage accounts. Monitoring these
 indicators can help you ensure remote access methods comply with your security policy.
 
-- \[Preview\]: Audit Linux VMs that allow remote connections from accounts without passwords
+- \[Preview\]: Show audit results from Linux VMs that allow remote connections from accounts without passwords
 - \[Preview\]: Deploy requirements to audit Linux VMs that allow remote connections from accounts without passwords
 - Audit unrestricted network access to storage accounts
 - Remote debugging should be turned off for API App
@@ -160,7 +160,7 @@ audit and event logging configurations. Monitoring these configurations can prov
 an audit system failure or misconfiguration and help you take corrective action.
 
 - Audit diagnostic setting
-- Audit SQL server level Auditing settings
+- Auditing on SQL server should be enabled
 - Advanced data security should be enabled on your managed instances
 - Advanced data security should be enabled on your SQL servers
 
@@ -191,7 +191,7 @@ and Advanced Data Security are configured on SQL servers.
 - \[Preview\]: Deploy Log Analytics Agent for Linux VMs
 - \[Preview\]: Deploy Log Analytics Agent for Windows VMs
 - Audit diagnostic setting
-- Audit SQL server level Auditing settings
+- Auditing on SQL server should be enabled
 - Advanced data security should be enabled on your managed instances
 - Advanced data security should be enabled on your SQL servers
 - Deploy Advanced Data Security on SQL servers
@@ -250,8 +250,8 @@ configuration of the password encryption type for Windows virtual machines. Moni
 indicators helps you ensure that system authenticators comply with your organization's
 identification and authentication policy.
 
-- \[Preview\]: Audit Linux VMs that do not have the passwd file permissions set to 0644
-- \[Preview\]: Audit Linux VMs that have accounts without passwords
+- \[Preview\]: Show audit results from Linux VMs that do not have the passwd file permissions set to 0644
+- \[Preview\]: Show audit results from  Linux VMs that have accounts without passwords
 - \[Preview\]: Deploy requirements to audit Linux VMs that do not have the passwd file permissions set to 0644
 - \[Preview\]: Deploy requirements to audit Linux VMs that have accounts without passwords
 
@@ -263,11 +263,11 @@ password requirements. Awareness of virtual machines in violation of the passwor
 helps you take corrective actions to ensure passwords for all virtual machine user accounts comply
 with your organization's password policy.
 
-- \[Preview\]: Audit Windows VMs that allow re-use of the previous 24 passwords
-- \[Preview\]: Audit Windows VMs that do not have a maximum password age of 70 days
-- \[Preview\]: Audit Windows VMs that do not have a minimum password age of 1 day
-- \[Preview\]: Audit Windows VMs that do not have the password complexity setting enabled
-- \[Preview\]: Audit Windows VMs that do not restrict the minimum password length to 14 characters
+- \[Preview\]: Show audit results from Windows VMs that allow re-use of the previous 24 passwords
+- \[Preview\]: Show audit results from Windows VMs that do not have a maximum password age of 70 days
+- \[Preview\]: Show audit results from Windows VMs that do not have a minimum password age of 1 day
+- \[Preview\]: Show audit results from Windows VMs that do not have the password complexity setting enabled
+- \[Preview\]: Show audit results from Windows VMs that do not restrict the minimum password length to 14 characters
 - \[Preview\]: Deploy requirements to audit Windows VMs that allow re-use of the previous 24 passwords
 - \[Preview\]: Deploy requirements to audit Windows VMs that do not have a maximum password age of 70 days
 - \[Preview\]: Deploy requirements to audit Windows VMs that do not have a minimum password age of 1 day
@@ -325,10 +325,9 @@ endpoints, applications, and storage accounts. Endpoints and applications that a
 firewall, and storage accounts with unrestricted access can allow unintended access to information
 contained within the information system.
 
-- Network Security Group Rules for Internet facing virtual machines should be hardened
+- Adaptive Network Hardening recommendations should be applied on internet facing virtual machines
 - Access through Internet facing endpoint should be restricted
 - Audit unrestricted network access to storage accounts
-- The NSGs rules for web applications on IaaS should be hardened
 
 ## SC-7 (3) Boundary Protection | Access Points
 
@@ -360,7 +359,7 @@ properly encrypted can help you meet your organization's requirements or protect
 from unauthorized disclosure and modification.
 
 - API App should only be accessible over HTTPS
-- Audit Windows web servers that are not using secure communication protocols
+- Show audit results from  Windows web servers that are not using secure communication protocols
 - Deploy requirements to audit Windows web servers that are not using secure communication protocols
 - Function App should only be accessible over HTTPS
 - Only secure connections to your Redis Cache should be enabled
@@ -465,4 +464,4 @@ Additional articles about blueprints and how to use them:
 - Understand how to use [static and dynamic parameters](../../concepts/parameters.md).
 - Learn to customize the [blueprint sequencing order](../../concepts/sequencing-order.md).
 - Find out how to make use of [blueprint resource locking](../../concepts/resource-locking.md).
-- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).
+- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).

articles/governance/blueprints/samples/canada-federal-pbmm/deploy.md

@@ -1,7 +1,7 @@
 ---
 title: Deploy Canada Federal PBMM blueprint sample
 description: Deploy steps for the Canada Federal PBMM blueprint sample including blueprint artifact parameter details.
-ms.date: 09/05/2019
+ms.date: 05/08/2020
 ms.topic: sample
 ---
 # Deploy the Canada Federal PBMM blueprint samples
@@ -149,4 +149,4 @@ Additional articles about blueprints and how to use them:
 - Understand how to use [static and dynamic parameters](../../concepts/parameters.md).
 - Learn to customize the [blueprint sequencing order](../../concepts/sequencing-order.md).
 - Find out how to make use of [blueprint resource locking](../../concepts/resource-locking.md).
-- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).
+- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).

articles/governance/blueprints/samples/canada-federal-pbmm/index.md

@@ -1,7 +1,7 @@
 ---
 title: Canada Federal PBMM blueprint sample overview
 description: Overview of the Canada Federal PBMM blueprint sample. This blueprint sample helps customers assess specific Canada Federal PBMM controls.
-ms.date: 09/04/2019
+ms.date: 05/08/2020
 ms.topic: sample
 ---
 # Overview of the Canada Federal PBMM blueprint sample
@@ -35,4 +35,4 @@ Additional articles about blueprints and how to use them:
 - Understand how to use [static and dynamic parameters](../../concepts/parameters.md).
 - Learn to customize the [blueprint sequencing order](../../concepts/sequencing-order.md).
 - Find out how to make use of [blueprint resource locking](../../concepts/resource-locking.md).
-- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).
+- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).

articles/governance/blueprints/samples/ukofficial/control-mapping.md

@@ -1,7 +1,7 @@
 ---
 title: UK OFFICIAL & UK NHS blueprint sample controls
 description: Control mapping of the UK OFFICIAL and UK NHS blueprint samples. Each control is mapped to one or more Azure Policies that assist with assessment.
-ms.date: 12/04/2019
+ms.date: 05/08/2020
 ms.topic: sample
 ---
 # Control mapping of the UK OFFICIAL and UK NHS blueprint samples
@@ -37,9 +37,6 @@ definitions that audit insecure connections to storage accounts and Redis Cache.
 - Secure transfer to storage accounts should be enabled
 - Show audit results from Windows web servers that are not using secure communication protocols
 - Deploy prerequisites to audit Windows web servers that are not using secure communication protocols
-- Latest TLS version should be used in your API App
-- Latest TLS version should be used in your Web App
-- Latest TLS version should be used in your Function App
 
 ## 2.3 Data at rest protection
 
@@ -172,8 +169,8 @@ help you take corrective actions to ensure access Azure resources is restricted
 
 - \[Preview\]: Deploy requirements to audit Linux VMs that have accounts without passwords
 - \[Preview\]: Deploy requirements to audit Linux VMs that allow remote connections from accounts without passwords
-- \[Preview\]: Audit Linux VMs that have accounts without passwords
-- \[Preview\]: Audit Linux VMs that allow remote connections from accounts without passwords
+- \[Preview\]: Show audit results from Linux VMs that have accounts without passwords
+- \[Preview\]: Show audit results from Linux VMs that allow remote connections from accounts without passwords
 - Storage accounts should be migrated to new Azure Resource Manager resources
 - Virtual machines should be migrated to new Azure Resource Manager resources
 - Audit VMs that do not use managed disks
@@ -188,12 +185,10 @@ also assigns a policy that enables adaptive application controls on virtual mach
 
 - Audit unrestricted network access to storage accounts
 - Adaptive Application Controls should be enabled on virtual machines
-- The NSGs rules for web applications on IaaS should be hardened
 - Access through Internet facing endpoint should be restricted
-- Network Security Group Rules for Internet facing virtual machines should be hardened
+- Adaptive Network Hardening recommendations should be applied on internet facing virtual machines
 - Endpoint protection solution should be installed on virtual machine scale sets
 - Just-In-Time network access control should be applied on virtual machines
-- Audit unrestricted network access to storage accounts
 - Remote debugging should be turned off for Function App
 - Remote debugging should be turned off for Web Application
 - Remote debugging should be turned off for API App
@@ -246,15 +241,15 @@ This blueprint also assigns an Azure Policy definition that audits Linux VM pass
 permissions to alert if they're set incorrectly. This design enables you to take corrective action
 to ensure authenticators aren't compromised.
 
-- \[Preview\]: Audit Linux VM /etc/passwd file permissions are set to 0644
+- \[Preview\]: Show audit results from Linux VMs that do not have the passwd file permissions set to 0644
 
 ## 13 Audit Information for Users
 
 This blueprint helps you ensure system events are logged by assigning [Azure Policy](../../../policy/overview.md)
 definitions that audit log settings on Azure resources. An assigned policy also audits if virtual
 machines aren't sending logs to a specified log analytics workspace.
 
-- Auditing should be enabled on advanced data security settings on SQL Server
+- Advanced data security should be enabled on your SQL servers
 - Audit diagnostic setting
 - \[Preview\]: Deploy Log Analytics Agent for Linux VMs
 - \[Preview\]: Deploy Log Analytics Agent for Windows VMs

articles/governance/blueprints/samples/ukofficial/deploy.md

@@ -1,7 +1,7 @@
 ---
 title: Deploy UK OFFICIAL & UK NHS blueprint samples
 description: Deploy steps for the UK OFFICIAL and UK NHS blueprint samples including blueprint artifact parameter details.
-ms.date: 06/26/2019
+ms.date: 05/08/2020
 ms.topic: sample
 ---
 # Deploy the UK OFFICIAL and UK NHS blueprint samples
@@ -136,4 +136,4 @@ Additional articles about blueprints and how to use them:
 - Understand how to use [static and dynamic parameters](../../concepts/parameters.md).
 - Learn to customize the [blueprint sequencing order](../../concepts/sequencing-order.md).
 - Find out how to make use of [blueprint resource locking](../../concepts/resource-locking.md).
-- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).
+- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).

articles/governance/blueprints/samples/ukofficial/index.md

@@ -1,7 +1,7 @@
 ---
 title: UK OFFICIAL & UK NHS blueprint sample overview
 description: Overview and architecture of the UK OFFICIAL and UK NHS blueprint samples. This blueprint sample helps customers assess specific controls.
-ms.date: 06/26/2019
+ms.date: 05/08/2020
 ms.topic: sample
 ---
 # Overview of the UK OFFICIAL and UK NHS blueprint samples
@@ -33,4 +33,4 @@ Additional articles about blueprints and how to use them:
 - Understand how to use [static and dynamic parameters](../../concepts/parameters.md).
 - Learn to customize the [blueprint sequencing order](../../concepts/sequencing-order.md).
 - Find out how to make use of [blueprint resource locking](../../concepts/resource-locking.md).
-- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).
+- Learn how to [update existing assignments](../../how-to/update-existing-assignments.md).