Skip to content

Commit 1b04b4b

Browse files
authored
Merge pull request #234157 from divargas-msft/patch-6
[Doc-a-thon] Updating extensions-rmpolicy-howto-ps.md
2 parents e31b37f + 1424af6 commit 1b04b4b

File tree

1 file changed

+10
-30
lines changed

1 file changed

+10
-30
lines changed

articles/virtual-machines/extensions/extensions-rmpolicy-howto-ps.md

Lines changed: 10 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -8,32 +8,26 @@ ms.author: gabsta
88
author: GabstaMSFT
99
ms.reviewer: erd
1010
ms.collection: windows
11-
ms.date: 03/20/2023
11+
ms.date: 04/11/2023
1212
ms.custom: devx-track-azurepowershell
1313

1414
---
1515

1616
# Use Azure Policy to restrict extensions installation on Windows VMs
1717

18-
If you want to prevent the use or installation of certain extensions on your Windows VMs, you can create an Azure Policy definition using PowerShell to restrict extensions for VMs within a resource group.
18+
If you want to prevent the use or installation of certain extensions on your Windows VMs, you can create an Azure Policy definition using PowerShell to restrict extensions for VMs within a resource group.
1919

2020
This tutorial uses Azure PowerShell within the Cloud Shell, which is constantly updated to the latest version.
2121

22-
23-
2422
## Create a rules file
2523

2624
In order to restrict what extensions can be installed, you need to have a [rule](../../governance/policy/concepts/definition-structure.md#policy-rule) to provide the logic to identify the extension.
2725

2826
This example shows you how to deny extensions published by 'Microsoft. Compute' by creating a rules file in Azure Cloud Shell, but if you're working in PowerShell locally, you can also create a local file and replace the path ($home/clouddrive) with the path to the local file on your machine.
2927

30-
In a [Cloud Shell](https://shell.azure.com/powershell), type:
31-
32-
```azurepowershell-interactive
33-
nano $home/clouddrive/rules.json
34-
```
28+
1. In a [Cloud Shell](https://shell.azure.com/powershell), create the file `$home/clouddrive/rules.json` using any text editor.
3529

36-
Copy and paste the following .json into the file.
30+
2. Copy and paste the following .json contents into the file and save it:
3731

3832
```json
3933
{
@@ -59,21 +53,15 @@ Copy and paste the following .json into the file.
5953
}
6054
```
6155

62-
When you're done, hit the **Ctrl + O** and then **Enter** to save the file. Hit **Ctrl + X** to close the file and exit.
63-
6456
## Create a parameters file
6557

66-
You also need a [parameters](../../governance/policy/concepts/definition-structure.md#parameters) file that creates a structure for you to use for passing in a list of the extensions to block.
58+
You also need a [parameters](../../governance/policy/concepts/definition-structure.md#parameters) file that creates a structure for you to use for passing in a list of the extensions to block.
6759

6860
This example shows you how to create a parameters file for VMs in Cloud Shell, but if you're working in PowerShell locally, you can also create a local file and replace the path ($home/clouddrive) with the path to the local file on your machine.
6961

70-
In [Cloud Shell](https://shell.azure.com/powershell), type:
71-
72-
```azurepowershell-interactive
73-
nano $home/clouddrive/parameters.json
74-
```
62+
1. In [Cloud Shell](https://shell.azure.com/powershell), create the file `$home/clouddrive/parameters.json` using any text editor.
7563

76-
Copy and paste the following .json into the file.
64+
2. Copy and paste the following .json contents into the file and save it:
7765

7866
```json
7967
{
@@ -87,16 +75,11 @@ Copy and paste the following .json into the file.
8775
}
8876
```
8977

90-
When you're done, hit the **Ctrl + O** and then **Enter** to save the file. Hit **Ctrl + X** to close the file and exit.
91-
9278
## Create the policy
9379

9480
A policy definition is an object used to store the configuration that you would like to use. The policy definition uses the rules and parameters files to define the policy. Create a policy definition using the [New-AzPolicyDefinition](/powershell/module/az.resources/new-azpolicydefinition) cmdlet.
9581

96-
97-
The policy rules and parameters are the files you created and stored as .json files in your cloud shell. Replace the example `-Policy` and `-Parameter` file paths as needed.
98-
99-
82+
The policy rules and parameters are the files you created and stored as .json files in your cloud shell. Replace the example `-Policy` and `-Parameter` file paths as needed.
10083

10184
```azurepowershell-interactive
10285
$definition = New-AzPolicyDefinition `
@@ -107,12 +90,9 @@ $definition = New-AzPolicyDefinition `
10790
-Parameter 'C:\Users\ContainerAdministrator\clouddrive\parameters.json'
10891
```
10992

110-
111-
112-
11393
## Assign the policy
11494

115-
This example assigns the policy to a resource group using [New-AzPolicyAssignment](/powershell/module/az.resources/new-azpolicyassignment). Any VM created in the **myResourceGroup** resource group won't be able to install the VM Access Agent or Custom Script extensions.
95+
This example assigns the policy to a resource group using [New-AzPolicyAssignment](/powershell/module/az.resources/new-azpolicyassignment). Any VM created in the **myResourceGroup** resource group won't be able to install the VM Access Agent or Custom Script extensions.
11696

11797
Use the [Get-AzSubscription | Format-Table](/powershell/module/az.accounts/get-azsubscription) cmdlet to get your subscription ID to use in place of the one in the example.
11898

@@ -158,6 +138,6 @@ Remove-AzPolicyAssignment -Name not-allowed-vmextension-windows -Scope $scope
158138
```azurepowershell-interactive
159139
Remove-AzPolicyDefinition -Name not-allowed-vmextension-windows
160140
```
161-
141+
162142
## Next steps
163143
For more information, see [Azure Policy](../../governance/policy/overview.md).

0 commit comments

Comments
 (0)