You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/governance/policy/how-to/migrate-from-automanage-best-practices.md
+10-17Lines changed: 10 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ ms.author: mmasheke
10
10
# Overview
11
11
12
12
> [!CAUTION]
13
-
> On 30th September, 2027, the Automanage Best Practices product will be retired. Migrate to Azure Policy before that. [Migrate Now](https://ms.portal.azure.com/).
13
+
> On September 30, 2027, the Automanage Best Practices product will be retired. Migrate to Azure Policy before that date. [Migrate here](https://ms.portal.azure.com/).
14
14
15
15
Azure Policy is a more robust cloud resource governance, enforcement and compliance offering with full parity with the Automanage Best Practices service. When possible, you should plan to move your content and machines to the new service. This
16
16
article provides guidance on developing a migration strategy from Azure Automation to machine
@@ -29,19 +29,13 @@ Before you begin, it's a good idea to read the conceptual overview information a
29
29
30
30
## Understand migration
31
31
32
-
The best approach to migration is to identify how to map services in an Automanage configuration profile to respective Azure Policy content first, and then offboard your subscriptions from Automanage. This section outlines the expected steps for migration. Automanage’s capabilities involved creating a deploy-and-forget experience for Azure customers to onboard new and existing virtual machines to a recommended set of Azure
33
-
Services to ensure compliance with Azure’s best practices. This was achieved by the
34
-
creation of a configuration profile, a reusable template of management, monitoring,
35
-
security and resiliency services that customers could opt into. The profile is then assigned
36
-
to a set of VMs that will be onboarded to those services and receive reports on the state of
37
-
their machines.
32
+
The best approach to migration is to identify how to map services in an Automanage configuration profile to respective Azure Policy content first, and then offboard your subscriptions from Automanage. This section outlines the expected steps for migration. Automanage’s capabilities involved creating a deploy-and-forget experience for Azure customers to onboard new and existing virtual machines to a recommended set of Azure Services to ensure compliance with Azure’s best practices. These capabilities were achieved by the creation of a configuration profile, a reusable template of management, monitoring,
33
+
security and resiliency services that customers could opt into. The profile is then assigned to a set of VMs that are onboarded to those services and receive reports on the state of their machines.
38
34
39
35
40
-
This functionality is available in Azure policy today as an Azure
41
-
Policy Initiative with a wider variety of configurable parameters, Azure services, regional
42
-
availability, compliance states and remediation actions. Configuration Profiles are the main onboarding vehicle for Automanage customers. Just like Azure Policy Initiatives, Automanage configuration profiles are applicable to VMs at the
36
+
This functionality is available in Azure Policy as an initiative with a variety of configurable parameters, Azure services, regional availability, compliance states, and remediation actions. Configuration Profiles are the main onboarding vehicle for Automanage customers. Just like Azure Policy Initiatives, Automanage configuration profiles are applicable to VMs at the
43
37
subscription and resource group level and enables further specification of the zone of
44
-
applicability. Below is the feature parity of available Automanage services in Azure Policy:
38
+
applicability. The following Automanage feature parities are available in Azure Policy:
45
39
46
40
### Azure Monitoring Agent
47
41
@@ -87,7 +81,7 @@ malicious or unwanted software tries to install itself or run on your Azure syst
87
81
Azure Guest Agent (or the Fabric Agent) launches the Antimalware Extension, applying the
88
82
Antimalware configuration settings supplied as input. This step enables the Antimalware
89
83
service with either default or custom configuration settings.
90
-
The Azure Antimalware policies below are deployable in policy:
84
+
The following Azure Antimalware policies are deployable in Azure Policy:
91
85
92
86
- Microsoft Antimalware for Azure should be configured to automatically update
93
87
protection signatures
@@ -121,15 +115,15 @@ Collection Endpoint
121
115
- Configure Windows Machines to be associated with a Data Collection Rule or a
122
116
Data Collection Endpoint
123
117
124
-
All the above are configurable by deploying the Enable Azure Monitor for VMs with Azure
118
+
All the previous options are configurable by deploying the Enable Azure Monitor for VMs with Azure
125
119
Monitoring Agent (AMA) Policy initiative.
126
120
127
121
### Change Tracking and Inventory
128
122
129
123
Change Tracking and Inventory is a feature within Azure Automation that monitors changes
130
124
in virtual machines across Azure, on-premises, and other cloud environments. It tracks
131
125
modifications to installed software, files, registry keys, and services on both Windows and
132
-
Linux systems. By leveraging the Log Analytics agent, the Change Tracking service collects data and forwards it to
126
+
Linux systems. By using the Log Analytics agent, the Change Tracking service collects data and forwards it to
133
127
Azure Monitor Logs for analysis. Additionally, it integrates with Microsoft Defender for
134
128
Cloud File Integrity Monitoring (FIM) to enhance security and operational insights. The
135
129
following policies enable change tracking on VMs:
@@ -205,7 +199,7 @@ booting up by collecting serial log information and screenshots. Enabling Boot D
205
199
feature allows Microsoft Azure cloud platform to inspect the virtual machine operating
206
200
system (OS) for provisioning errors, helping to provide deeper information on the root
207
201
causes of the startup failures. Boot diagnostics is enabled by default when we create a VM
208
-
and is enforced by the "Boot Diagnostics should be enabled on virtual machines" policy.
202
+
and is enforced by the _Boot Diagnostics should be enabled on virtual machines_ policy.
209
203
210
204
### Windows Admin Center
211
205
@@ -218,8 +212,7 @@ the boot process. It's configurable either through an ARM template or a custom A
218
212
Azure Log Analytics is a service that monitors your cloud and on-premises resources and
219
213
applications. It allows you to collect and analyze data generated by resources in your
220
214
cloud and on-premises environments. With Azure Log Analytics, you can search, analyze,
221
-
and visualize data to identify trends, troubleshoot issues, and monitor your systems. On 31
222
-
August 2024, both Automation Update Management and the Log Analytics agent it uses
215
+
and visualize data to identify trends, troubleshoot issues, and monitor your systems. On August 31, 2024, both Automation Update Management and the Log Analytics agent it uses
223
216
will be retired. Migrate to Azure Update Manager before that. Refer to guidance on
224
217
migrating to Azure Update Manager [here][05]. We advise you to migrate [now][06] as this feature will
0 commit comments