Skip to content

Commit 52cf750

Browse files
Albertyang0Albertyang0
committed
Policy samples 2025-06-23-2
1 parent c4d7609 commit 52cf750

File tree

80 files changed

+213
-378
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+213
-378
lines changed

‎includes/policy/reference/bycat/policies-cache.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
ms.service: azure-policy
33
ms.topic: include
4-
ms.date: 05/23/2025
4+
ms.date: 06/23/2025
55
ms.author: jasongroce
66
author: jasongroce
7-
ms.custom:
8-
- generated
9-
- build-2025
7+
ms.custom: generated
108
---
119

1210
|Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> |

‎includes/policy/reference/bycat/policies-cdn.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
ms.service: azure-policy
33
ms.topic: include
4-
ms.date: 05/23/2025
4+
ms.date: 06/23/2025
55
ms.author: jasongroce
66
author: jasongroce
7-
ms.custom:
8-
- generated
9-
- build-2025
7+
ms.custom: generated
108
---
119

1210
|Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> |

‎includes/policy/reference/bycat/policies-storage.md

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
ms.service: azure-policy
33
ms.topic: include
4-
ms.date: 05/23/2025
4+
ms.date: 06/23/2025
55
ms.author: jasongroce
66
author: jasongroce
7-
ms.custom:
8-
- generated
9-
- build-2025
7+
ms.custom: generated
108
---
119

1210
|Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> |
@@ -39,7 +37,6 @@ ms.custom:
3937
|[Configure storage accounts to disable public network access](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fa06d0189-92e8-4dba-b0c4-08d7669fce7d) |To improve the security of Storage Accounts, ensure that they aren't exposed to the public internet and can only be accessed from a private endpoint. Disable the public network access property as described in [https://aka.ms/storageaccountpublicnetworkaccess](https://aka.ms/storageaccountpublicnetworkaccess). This option disables access from any public address space outside the Azure IP range, and denies all logins that match IP or virtual network-based firewall rules. This reduces data leakage risks. |Modify, Disabled |[1.0.1](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StoragePublicNetworkAccess_Modify.json) |
4038
|[Configure your Storage account public access to be disallowed](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F13502221-8df0-4414-9937-de9c5c4e396b) |Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. To prevent data breaches caused by undesired anonymous access, Microsoft recommends preventing public access to a storage account unless your scenario requires it. |Modify, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountDisablePublicBlobAccess_Modify.json) |
4139
|[Configure your Storage account to enable blob versioning](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fc36a325b-ae04-4863-ad4f-19c6678f8e08) |You can enable Blob storage versioning to automatically maintain previous versions of an object. When blob versioning is enabled, you can access earlier versions of a blob to recover your data if it's modified or deleted. |Audit, Deny, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAccountEnableBlobVersion_Audit.json) |
42-
|[Deploy Defender for Storage (Classic) on storage accounts](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F361c2074-3595-4e5d-8cab-4f21dffc835c) |This policy enables Defender for Storage (Classic) on storage accounts. |DeployIfNotExists, Disabled |[1.0.1](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageAdvancedThreatProtection_DINE.json) |
4340
|[Geo-redundant storage should be enabled for Storage Accounts](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fbf045164-79ba-4215-8f95-f8048dc1780b) |Use geo-redundancy to create highly available applications |Audit, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/GeoRedundant_StorageAccounts_Audit.json) |
4441
|[HPC Cache accounts should use customer-managed key for encryption](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F970f84d8-71b6-4091-9979-ace7e3fb6dbb) |Manage encryption at rest of Azure HPC Cache with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. |Audit, Disabled, Deny |[2.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageCache_CMKEnabled.json) |
4542
|[Modify - Configure Azure File Sync to disable public network access](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F0e07b2e9-6cd9-4c40-9ccb-52817b95133b) |The Azure File Sync's internet-accessible public endpoint are disabled by your organizational policy. You may still access the Storage Sync Service via its private endpoint(s). |Modify, Disabled |[1.0.0](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Storage/StorageSync_IncomingTrafficPolicy_Modify.json) |

‎includes/policy/reference/bycat/policies-stream-analytics.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
ms.service: azure-policy
33
ms.topic: include
4-
ms.date: 05/23/2025
4+
ms.date: 06/23/2025
55
ms.author: jasongroce
66
author: jasongroce
7-
ms.custom:
8-
- generated
9-
- build-2025
7+
ms.custom: generated
108
---
119

1210
|Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> |

‎includes/policy/reference/bycat/policies-synapse.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
ms.service: azure-policy
33
ms.topic: include
4-
ms.date: 05/23/2025
4+
ms.date: 06/23/2025
55
ms.author: jasongroce
66
author: jasongroce
7-
ms.custom:
8-
- generated
9-
- build-2025
7+
ms.custom: generated
108
---
119

1210
|Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> |

‎includes/policy/reference/bycat/policies-tags.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
ms.service: azure-policy
33
ms.topic: include
4-
ms.date: 05/23/2025
4+
ms.date: 06/23/2025
55
ms.author: jasongroce
66
author: jasongroce
7-
ms.custom:
8-
- generated
9-
- build-2025
7+
ms.custom: generated
108
---
119

1210
|Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> |

‎includes/policy/reference/bycat/policies-trusted-launch.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
ms.service: azure-policy
33
ms.topic: include
4-
ms.date: 05/23/2025
4+
ms.date: 06/23/2025
55
ms.author: jasongroce
66
author: jasongroce
7-
ms.custom:
8-
- generated
9-
- build-2025
7+
ms.custom: generated
108
---
119

1210
|Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> |

‎includes/policy/reference/bycat/policies-virtualenclaves.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
ms.service: azure-policy
33
ms.topic: include
4-
ms.date: 05/23/2025
4+
ms.date: 06/23/2025
55
ms.author: jasongroce
66
author: jasongroce
7-
ms.custom:
8-
- generated
9-
- build-2025
7+
ms.custom: generated
108
---
119

1210
|Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> |

‎includes/policy/reference/bycat/policies-vm-image-builder.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
ms.service: azure-policy
33
ms.topic: include
4-
ms.date: 05/23/2025
4+
ms.date: 06/23/2025
55
ms.author: jasongroce
66
author: jasongroce
7-
ms.custom:
8-
- generated
9-
- build-2025
7+
ms.custom: generated
108
---
119

1210
|Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> |

‎includes/policy/reference/bycat/policies-web-pubsub.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
ms.service: azure-policy
33
ms.topic: include
4-
ms.date: 05/23/2025
4+
ms.date: 06/23/2025
55
ms.author: jasongroce
66
author: jasongroce
7-
ms.custom:
8-
- generated
9-
- build-2025
7+
ms.custom: generated
108
---
119

1210
|Name<br /><sub>(Azure portal)</sub> |Description |Effect(s) |Version<br /><sub>(GitHub)</sub> |

0 commit comments

Comments
 (0)