Skip to content

Commit 4c430b6

Browse files
authored
Merge pull request #110345 from DCtheGeek/dmc-policy-ghpr51361
Addressing branding issues pointed out in #51361
2 parents 85d8a2d + 32ab4ea commit 4c430b6

12 files changed

+52
-50
lines changed

articles/governance/blueprints/concepts/deployment-stages.md

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -11,24 +11,24 @@ deploy the resources defined in the blueprint. This article provides details abo
1111
involves.
1212

1313
Blueprint deployment is triggered by assigning a blueprint to a subscription or [updating an
14-
existing assignment](../how-to/update-existing-assignments.md). During the deployment, Blueprints
15-
takes the following high-level steps:
14+
existing assignment](../how-to/update-existing-assignments.md). During the deployment, Azure
15+
Blueprints takes the following high-level steps:
1616

1717
> [!div class="checklist"]
18-
> - Blueprints granted owner rights
18+
> - Azure Blueprints granted owner rights
1919
> - The blueprint assignment object is created
20-
> - Optional - Blueprints creates **system-assigned** managed identity
20+
> - Optional - Azure Blueprints creates **system-assigned** managed identity
2121
> - The managed identity deploys blueprint artifacts
22-
> - Blueprint service and **system-assigned** managed identity rights are revoked
22+
> - Azure Blueprints service and **system-assigned** managed identity rights are revoked
2323
24-
## Blueprints granted owner rights
24+
## Azure Blueprints granted owner rights
2525

2626
The Azure Blueprints service principal is granted owner rights to the assigned subscription or
2727
subscriptions when a [system-assigned managed
2828
identity](../../../active-directory/managed-identities-azure-resources/overview.md) managed identity
29-
is used. The granted role allows Blueprints to create, and later revoke, the **system-assigned**
30-
managed identity. If using a **user-assigned** managed identity, the Azure Blueprints service
31-
principal doesn't get and doesn't need owner rights on the subscription.
29+
is used. The granted role allows Azure Blueprints to create, and later revoke, the
30+
**system-assigned** managed identity. If using a **user-assigned** managed identity, the Azure
31+
Blueprints service principal doesn't get and doesn't need owner rights on the subscription.
3232

3333
The rights are granted automatically if the assignment is done through the portal. However, if the
3434
assignment is done through the REST API, granting the rights needs to be done with a separate API
@@ -43,7 +43,7 @@ principal. Then, grant the Azure Blueprints the _Owner_ role through the
4343
[REST API](../../../role-based-access-control/role-assignments-rest.md), or a
4444
[Resource Manager template](../../../role-based-access-control/role-assignments-template.md).
4545

46-
The Blueprints service doesn't directly deploy the resources.
46+
The Azure Blueprints service doesn't directly deploy the resources.
4747

4848
## The blueprint assignment object is created
4949

@@ -61,14 +61,14 @@ before the blueprint assignment is created. Both the
6161
built-in roles have the necessary `blueprintAssignment/write` permission to create an assignment
6262
that uses a **user-assigned** managed identity.
6363

64-
## Optional - Blueprints creates system-assigned managed identity
64+
## Optional - Azure Blueprints creates system-assigned managed identity
6565

6666
When [system-assigned managed
6767
identity](../../../active-directory/managed-identities-azure-resources/overview.md) is selected
68-
during assignment, Blueprints creates the identity and grants the managed identity the
68+
during assignment, Azure Blueprints creates the identity and grants the managed identity the
6969
[owner](../../../role-based-access-control/built-in-roles.md#owner) role. If an
70-
[existing assignment is upgraded](../how-to/update-existing-assignments.md), Blueprints uses the
71-
previously created managed identity.
70+
[existing assignment is upgraded](../how-to/update-existing-assignments.md), Azure Blueprints uses
71+
the previously created managed identity.
7272

7373
The managed identity related to the blueprint assignment is used to deploy or redeploy the resources
7474
defined in the blueprint. This design avoids assignments inadvertently interfering with each other.
@@ -82,15 +82,16 @@ blueprint in the defined [sequencing order](./sequencing-order.md). The order ca
8282
ensure artifacts dependent on other artifacts are deployed in the correct order.
8383

8484
An access failure by a deployment is often the result of the level of access granted to the managed
85-
identity. The Blueprints service manages the security lifecycle of the **system-assigned** managed
86-
identity. However, the user is responsible for managing the rights and lifecycle of a
85+
identity. The Azure Blueprints service manages the security lifecycle of the **system-assigned**
86+
managed identity. However, the user is responsible for managing the rights and lifecycle of a
8787
**user-assigned** managed identity.
8888

8989
## Blueprint service and system-assigned managed identity rights are revoked
9090

91-
Once the deployments are completed, Blueprints revokes the rights of the **system-assigned** managed
92-
identity from the subscription. Then, the Blueprints service revokes its rights from the
93-
subscription. Rights removal prevents Blueprints from becoming a permanent owner on a subscription.
91+
Once the deployments are completed, Azure Blueprints revokes the rights of the **system-assigned**
92+
managed identity from the subscription. Then, the Azure Blueprints service revokes its rights from
93+
the subscription. Rights removal prevents Azure Blueprints from becoming a permanent owner on a
94+
subscription.
9495

9596
## Next steps
9697

articles/governance/blueprints/concepts/lifecycle.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.topic: conceptual
77
# Understand the lifecycle of an Azure Blueprint
88

99
Like many resources within Azure, a blueprint in Azure Blueprints has a typical and natural
10-
lifecycle. They're created, deployed, and finally deleted when no longer needed or relevant.
10+
lifecycle. They're created, deployed, and finally deleted when no longer needed or relevant. Azure
1111
Blueprints supports standard lifecycle operations. It then builds upon them to provide additional
1212
levels of status that support common continuous integration and continuous deployment pipelines for
1313
organizations that manage their Infrastructure as Code – a key element in DevOps.

articles/governance/blueprints/concepts/parameters.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ resource group. Resources inside that resource group would become duplicated and
2424
> related artifacts in that resource group. This could cause a conflict as two resources with the
2525
> same name and resource type cannot exist within a subscription.
2626
27-
The solution to this problem is parameters. Blueprints allows you to define the value for each
27+
The solution to this problem is parameters. Azure Blueprints allows you to define the value for each
2828
property of the artifact during assignment to a subscription. The parameter makes it possible to
2929
reuse a blueprint that creates a resource group and other resources within a single subscription
3030
without having conflict.

articles/governance/blueprints/concepts/resource-locking.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,15 @@ see an example of resource locking and application of _deny assignments_, see th
2121
Locking Mode applies to the blueprint assignment and it has three options: **Don't Lock**, **Read
2222
Only**, or **Do Not Delete**. The locking mode is configured during artifact deployment during a
2323
blueprint assignment. A different locking mode can be set by updating the blueprint assignment.
24-
Locking modes, however, can't be changed outside of Blueprints.
24+
Locking modes, however, can't be changed outside of Azure Blueprints.
2525

2626
Resources created by artifacts in a blueprint assignment have four states: **Not Locked**, **Read
2727
Only**, **Cannot Edit / Delete**, or **Cannot Delete**. Each artifact type can be in the **Not
2828
Locked** state. The following table can be used to determine the state of a resource:
2929

3030
|Mode|Artifact Resource Type|State|Description|
3131
|-|-|-|-|
32-
|Don't Lock|*|Not Locked|Resources aren't protected by Blueprints. This state is also used for resources added to a **Read Only** or **Do Not Delete** resource group artifact from outside a blueprint assignment.|
32+
|Don't Lock|*|Not Locked|Resources aren't protected by Azure Blueprints. This state is also used for resources added to a **Read Only** or **Do Not Delete** resource group artifact from outside a blueprint assignment.|
3333
|Read Only|Resource group|Cannot Edit / Delete|The resource group is read only and tags on the resource group can't be modified. **Not Locked** resources can be added, moved, changed, or deleted from this resource group.|
3434
|Read Only|Non-resource group|Read Only|The resource can't be altered in any way -- no changes and it can't be deleted.|
3535
|Do Not Delete|*|Cannot Delete|The resources can be altered, but can't be deleted. **Not Locked** resources can be added, moved, changed, or deleted from this resource group.|
@@ -38,7 +38,7 @@ Locked** state. The following table can be used to determine the state of a reso
3838

3939
It's typically possible for someone with appropriate [role-based access
4040
control](../../../role-based-access-control/overview.md) (RBAC) on the subscription, such as the
41-
'Owner' role, to be allowed to alter or delete any resource. This access isn't the case when
41+
'Owner' role, to be allowed to alter or delete any resource. This access isn't the case when Azure
4242
Blueprints applies locking as part of a deployed assignment. If the assignment was set with the
4343
**Read Only** or **Do Not Delete** option, not even the subscription owner can perform the blocked
4444
action on the protected resource.
@@ -116,8 +116,8 @@ ways to do so.
116116
- Updating the blueprint assignment to a locking mode of **Don't Lock**
117117
- Delete the blueprint assignment
118118

119-
When the assignment is removed, the locks created by Blueprints are removed. However, the resource
120-
is left behind and would need to be deleted through normal means.
119+
When the assignment is removed, the locks created by Azure Blueprints are removed. However, the
120+
resource is left behind and would need to be deleted through normal means.
121121

122122
## How blueprint locks work
123123

@@ -126,7 +126,7 @@ applied to artifact resources during assignment of a blueprint if the assignment
126126
Only** or **Do Not Delete** option. The deny action is added by the managed identity of the
127127
blueprint assignment and can only be removed from the artifact resources by the same managed
128128
identity. This security measure enforces the locking mechanism and prevents removing the blueprint
129-
lock outside Blueprints.
129+
lock outside Azure Blueprints.
130130

131131
![Blueprint deny assignment on resource group](../media/resource-locking/blueprint-deny-assignment.png)
132132

articles/governance/blueprints/concepts/sequencing-order.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,8 @@ created within that resource group:
4242

4343
When composing large blueprint definitions, it may be necessary for resources to be created in a
4444
specific order. The most common use pattern of this scenario is when a blueprint definition includes
45-
several Azure Resource Manager templates. Blueprints handles this pattern by allowing the sequencing
46-
order to be defined.
45+
several Azure Resource Manager templates. Azure Blueprints handles this pattern by allowing the
46+
sequencing order to be defined.
4747

4848
The ordering is accomplished by defining a `dependsOn` property in the JSON. The blueprint
4949
definition, for resource groups, and artifact objects support this property. `dependsOn` is a string

articles/governance/blueprints/create-blueprint-powershell.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -425,8 +425,8 @@ lock, and blueprint parameters, use the matching PowerShell parameters on the
425425
assigning the blueprint has permissions to.
426426

427427
> [!IMPORTANT]
428-
> Blueprints doesn't manage the user-assigned managed identity. Users are responsible for assigning
429-
> sufficient roles and permissions or the blueprint assignment will fail.
428+
> Azure Blueprints doesn't manage the user-assigned managed identity. Users are responsible for
429+
> assigning sufficient roles and permissions or the blueprint assignment will fail.
430430

431431
## Clean up resources
432432

articles/governance/blueprints/create-blueprint-rest-api.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ uses these concepts to provide directions for working with Azure Blueprints and
2828
knowledge of them. Tools such as [ARMClient](https://github.com/projectkudu/ARMClient) and others
2929
may handle authorization automatically and are recommended for beginners.
3030

31-
For the Blueprints specs, see [Azure Blueprints REST API](/rest/api/blueprints/).
31+
For the Azure Blueprints specs, see [Azure Blueprints REST API](/rest/api/blueprints/).
3232

3333
### REST API and PowerShell
3434

@@ -470,7 +470,7 @@ values:
470470
assigning the blueprint has permissions to.
471471
472472
> [!IMPORTANT]
473-
> Blueprints doesn't manage the user-assigned managed identity. Users are responsible for
473+
> Azure Blueprints doesn't manage the user-assigned managed identity. Users are responsible for
474474
> assigning sufficient roles and permissions or the blueprint assignment will fail.
475475
476476
## Clean up resources

articles/governance/blueprints/how-to/import-export-ps.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ ms.topic: how-to
77
# Import and export blueprint definitions with PowerShell
88

99
Azure Blueprints can be fully managed through Azure portal. As organizations advance in their use of
10-
Blueprints, they should start thinking of blueprint definitions as managed code. This concept is
11-
often referred to as Infrastructure as Code (IaC). Treating your blueprint definitions as code
10+
Azure Blueprints, they should start thinking of blueprint definitions as managed code. This concept
11+
is often referred to as Infrastructure as Code (IaC). Treating your blueprint definitions as code
1212
offers additional advantages beyond what Azure portal offers. These benefits include:
1313

1414
- Sharing blueprint definitions

articles/governance/blueprints/how-to/manage-assignments-ps.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,12 @@ The Azure Blueprints module requires the following software:
2525

2626
### Install the module
2727

28-
The Blueprints module for PowerShell is **Az.Blueprint**.
28+
The Azure Blueprints module for PowerShell is **Az.Blueprint**.
2929

3030
1. From an **administrative** PowerShell prompt, run the following command:
3131

3232
```azurepowershell-interactive
33-
# Install the Blueprints module from PowerShell Gallery
33+
# Install the Azure Blueprints module from PowerShell Gallery
3434
Install-Module -Name Az.Blueprint
3535
```
3636

articles/governance/blueprints/overview.md

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ other artifacts such as:
2424
The Azure Blueprints service is backed by the globally distributed [Azure Cosmos DB](../../cosmos-db/introduction.md).
2525
Blueprint objects are replicated to multiple Azure regions. This replication provides low latency,
2626
high availability, and consistent access to your blueprint objects, regardless of which region
27-
Blueprints deploys your resources to.
27+
Azure Blueprints deploys your resources to.
2828

2929
## How it's different from Resource Manager templates
3030

@@ -34,20 +34,21 @@ is a package to bring each of these _artifact_ types together and allow you to c
3434
that package -- including through a CI/CD pipeline. Ultimately, each is assigned to a subscription
3535
in a single operation that can be audited and tracked.
3636

37-
Nearly everything that you want to include for deployment in Blueprints can be accomplished with a
38-
Resource Manager template. However, a Resource Manager template is a document that doesn't exist
39-
natively in Azure – each is stored either locally or in source control. The template gets used for
40-
deployments of one or more Azure resources, but once those resources deploy there's no active
37+
Nearly everything that you want to include for deployment in Azure Blueprints can be accomplished
38+
with a Resource Manager template. However, a Resource Manager template is a document that doesn't
39+
exist natively in Azure – each is stored either locally or in source control. The template gets used
40+
for deployments of one or more Azure resources, but once those resources deploy there's no active
4141
connection or relationship to the template.
4242

43-
With Blueprints, the relationship between the blueprint definition (what _should be_ deployed) and
44-
the blueprint assignment (what _was_ deployed) is preserved. This connection supports improved
45-
tracking and auditing of deployments. Blueprints can also upgrade several subscriptions at once that
46-
are governed by the same blueprint.
43+
With Azure Blueprints, the relationship between the blueprint definition (what _should be_ deployed)
44+
and the blueprint assignment (what _was_ deployed) is preserved. This connection supports improved
45+
tracking and auditing of deployments. Azure Blueprints can also upgrade several subscriptions at
46+
once that are governed by the same blueprint.
4747

4848
There's no need to choose between a Resource Manager template and a blueprint. Each blueprint can
4949
consist of zero or more Resource Manager template _artifacts_. This support means that previous
50-
efforts to develop and maintain a library of Resource Manager templates are reusable in Blueprints.
50+
efforts to develop and maintain a library of Resource Manager templates are reusable in Azure
51+
Blueprints.
5152

5253
## How it's different from Azure Policy
5354

@@ -68,7 +69,7 @@ support using parameters with policies and initiatives.
6869

6970
## Blueprint definition
7071

71-
A blueprint is made up of _artifacts_. Blueprints currently support the following resources
72+
A blueprint is made up of _artifacts_. Azure Blueprints currently supports the following resources
7273
as artifacts:
7374

7475
|Resource | Hierarchy options| Description |

0 commit comments

Comments
 (0)