You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/governance/policy/tutorials/mfaselfenforcement.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ This guide walks you through the process of applying Azure Policy assignments to
13
13
## Apply Azure Policy enforcement through Azure Portal
14
14
15
15
### 1. Sign In to Azure Portal
16
-
Navigate to the [Azure Portal](https://www.portal.azure.com)
16
+
Navigate to the [Azure portal](https://www.portal.azure.com)
17
17
18
18
### 2. Access Azure Policy Service
19
19
Select Policy under Azure services. If you don't see it, type 'Policy' in the search bar at the top and select it from the results.
@@ -78,7 +78,7 @@ You can set enforcement by updating the 'Effect' of the policy assignment.
78
78
- Click 'Add a policy effect override'
79
79
- In the drop-down menu, update the 'Override Value' to 'DenyAction' or 'Deny' (depending on the policy definition chosen at Step 4).
80
80
- For 'Selected Resources', pick a few low-risk regions that you’d like to enforce on. The policy assignment will only evaluate Azure resources in those regions.
81
-
:::image type="content" source="../media/multifactor-enforcement/image7.png" alt-text="Screenshot of Azure Policy Overrides Creation." border="false":::
81
+
:::image type="content" source="../media/multifactor-enforcement/overrides-example.png" alt-text="Screenshot of Azure Policy Overrides Creation." border="false":::
82
82
- Click 'Review + save', then 'Create'.
83
83
- Once you have confirmed no unexpected impact for this initial application, you may update the existing override to add additional regions, then monitor for any impact. Repeat this step as many times as needed to eventually add all regions.
84
84
@@ -87,7 +87,7 @@ You can set enforcement by updating the 'Effect' of the policy assignment.
87
87
## Audit Mode
88
88
Discover audit events in your activity log when this policy assignment is applied in audit mode and they attempt to create, update, or delete a resource without authenticating with MFA.
89
89
90
-
You can view activity Log events in Azure Portal and other SDKs. Here's a sample query that can be used in CLI:
90
+
You can view activity Log events in Azure portal and other supported SDKs. Here's a sample query that can be used in CLI:
@@ -102,9 +102,9 @@ The next section shows the experience from some select clients when the policy a
102
102
> [!NOTE]
103
103
> In preview timeframe, the error messages displayed to the user may differ depending on the client and command being run. This error messaging continues to improve to be consistent across clients used as this feature matures to GA availability.
104
104
### Azure Portal
105
-
When you attempt to perform a create, update, or delete operation without an MFA-authenticated token, Azure Portal may return:
105
+
When you attempt to perform a create, update, or delete operation without an MFA-authenticated token, Azure portal may return:
106
106
107
-
:::image type="content" source="../media/multifactor-enforcement/portal-enforcement-sample.png" alt-text="Screenshot of Azure Portal View When User Gets Blocked By Policy." border="false":::
107
+
:::image type="content" source="../media/multifactor-enforcement/portal-enforcement-sample.png" alt-text="Screenshot of Azure portal View When User Gets Blocked By Policy." border="false":::
108
108
109
109
### Azure CLI
110
110
When you attempt to perform a create, update, or delete operation without an MFA-authenticated token, Azure CLI may return:
@@ -117,5 +117,5 @@ When you attempt to perform a create, update, or delete operation without an MFA
117
117
:::image type="content" source="../media/multifactor-enforcement/azure-ps-policy-enforcement.png" alt-text="Screenshot of Azure PS View When User Gets Blocked By Policy." border="false":::
118
118
119
119
## Limitations in the Preview Timeframe
120
-
- In some cases, you may not be prompted to complete MFA after receiving an error. In such cases, re-authenticate with MFA before retrying the operation (for example, through Azure Portal).
120
+
- In some cases, you may not be prompted to complete MFA after receiving an error. In such cases, re-authenticate with MFA before retrying the operation (for example, through Azure portal).
121
121
- In some cases, the error message may not indicate that the operation is blocked due to the policy assignment in-place. Take note of the error message samples to familiarize your organization on what error messages they may receive.
0 commit comments