You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-machines/extensions/extensions-rmpolicy-howto-ps.md
+10-30Lines changed: 10 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,32 +8,26 @@ ms.author: gabsta
8
8
author: GabstaMSFT
9
9
ms.reviewer: erd
10
10
ms.collection: windows
11
-
ms.date: 03/20/2023
11
+
ms.date: 04/11/2023
12
12
ms.custom: devx-track-azurepowershell
13
13
14
14
---
15
15
16
16
# Use Azure Policy to restrict extensions installation on Windows VMs
17
17
18
-
If you want to prevent the use or installation of certain extensions on your Windows VMs, you can create an Azure Policy definition using PowerShell to restrict extensions for VMs within a resource group.
18
+
If you want to prevent the use or installation of certain extensions on your Windows VMs, you can create an Azure Policy definition using PowerShell to restrict extensions for VMs within a resource group.
19
19
20
20
This tutorial uses Azure PowerShell within the Cloud Shell, which is constantly updated to the latest version.
21
21
22
-
23
-
24
22
## Create a rules file
25
23
26
24
In order to restrict what extensions can be installed, you need to have a [rule](../../governance/policy/concepts/definition-structure.md#policy-rule) to provide the logic to identify the extension.
27
25
28
26
This example shows you how to deny extensions published by 'Microsoft. Compute' by creating a rules file in Azure Cloud Shell, but if you're working in PowerShell locally, you can also create a local file and replace the path ($home/clouddrive) with the path to the local file on your machine.
29
27
30
-
In a [Cloud Shell](https://shell.azure.com/powershell), type:
31
-
32
-
```azurepowershell-interactive
33
-
nano $home/clouddrive/rules.json
34
-
```
28
+
1. In a [Cloud Shell](https://shell.azure.com/powershell), create the file `$home/clouddrive/rules.json` using any text editor.
35
29
36
-
Copy and paste the following .json into the file.
30
+
2.Copy and paste the following .json contents into the file and save it:
37
31
38
32
```json
39
33
{
@@ -59,21 +53,15 @@ Copy and paste the following .json into the file.
59
53
}
60
54
```
61
55
62
-
When you're done, hit the **Ctrl + O** and then **Enter** to save the file. Hit **Ctrl + X** to close the file and exit.
63
-
64
56
## Create a parameters file
65
57
66
-
You also need a [parameters](../../governance/policy/concepts/definition-structure.md#parameters) file that creates a structure for you to use for passing in a list of the extensions to block.
58
+
You also need a [parameters](../../governance/policy/concepts/definition-structure.md#parameters) file that creates a structure for you to use for passing in a list of the extensions to block.
67
59
68
60
This example shows you how to create a parameters file for VMs in Cloud Shell, but if you're working in PowerShell locally, you can also create a local file and replace the path ($home/clouddrive) with the path to the local file on your machine.
69
61
70
-
In [Cloud Shell](https://shell.azure.com/powershell), type:
71
-
72
-
```azurepowershell-interactive
73
-
nano $home/clouddrive/parameters.json
74
-
```
62
+
1. In [Cloud Shell](https://shell.azure.com/powershell), create the file `$home/clouddrive/parameters.json` using any text editor.
75
63
76
-
Copy and paste the following .json into the file.
64
+
2.Copy and paste the following .json contents into the file and save it:
77
65
78
66
```json
79
67
{
@@ -87,16 +75,11 @@ Copy and paste the following .json into the file.
87
75
}
88
76
```
89
77
90
-
When you're done, hit the **Ctrl + O** and then **Enter** to save the file. Hit **Ctrl + X** to close the file and exit.
91
-
92
78
## Create the policy
93
79
94
80
A policy definition is an object used to store the configuration that you would like to use. The policy definition uses the rules and parameters files to define the policy. Create a policy definition using the [New-AzPolicyDefinition](/powershell/module/az.resources/new-azpolicydefinition) cmdlet.
95
81
96
-
97
-
The policy rules and parameters are the files you created and stored as .json files in your cloud shell. Replace the example `-Policy` and `-Parameter` file paths as needed.
98
-
99
-
82
+
The policy rules and parameters are the files you created and stored as .json files in your cloud shell. Replace the example `-Policy` and `-Parameter` file paths as needed.
This example assigns the policy to a resource group using [New-AzPolicyAssignment](/powershell/module/az.resources/new-azpolicyassignment). Any VM created in the **myResourceGroup** resource group won't be able to install the VM Access Agent or Custom Script extensions.
95
+
This example assigns the policy to a resource group using [New-AzPolicyAssignment](/powershell/module/az.resources/new-azpolicyassignment). Any VM created in the **myResourceGroup** resource group won't be able to install the VM Access Agent or Custom Script extensions.
116
96
117
97
Use the [Get-AzSubscription | Format-Table](/powershell/module/az.accounts/get-azsubscription) cmdlet to get your subscription ID to use in place of the one in the example.
0 commit comments