You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/governance/policy/concepts/definition-structure-basics.md
+10-16Lines changed: 10 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
-
title: Details of the policy definition structure basics
3
-
description: Describes how policy definition basics are used to establish conventions for Azure resources in your organization.
4
-
ms.date: 04/19/2024
2
+
title: Details of Azure Policy definition structure basics
3
+
description: Describes how Azure Policy definition basics are used to establish conventions for Azure resources in your organization.
4
+
ms.date: 07/10/2024
5
5
ms.topic: conceptual
6
6
---
7
7
@@ -81,11 +81,7 @@ While the `policyType` property can't be set, there are three values returned by
81
81
82
82
-`Builtin`: Microsoft provides and maintains these policy definitions.
83
83
-`Custom`: All policy definitions created by customers have this value.
84
-
-`Static`: Indicates a [Regulatory Compliance](./regulatory-compliance.md) policy definition with
85
-
Microsoft **Ownership**. The compliance results for these policy definitions are the results of
86
-
non-Microsoft audits of Microsoft infrastructure. In the Azure portal, this value is sometimes
87
-
displayed as **Microsoft managed**. For more information, see
88
-
[Shared responsibility in the cloud](../../../security/fundamentals/shared-responsibility.md).
84
+
-`Static`: Indicates a [Regulatory Compliance](./regulatory-compliance.md) policy definition with Microsoft **Ownership**. The compliance results for these policy definitions are the results of non-Microsoft audits of Microsoft infrastructure. In the Azure portal, this value is sometimes displayed as **Microsoft managed**. For more information, see [Shared responsibility in the cloud](../../../security/fundamentals/shared-responsibility.md).
89
85
90
86
## Mode
91
87
@@ -108,7 +104,7 @@ We recommend that you set `mode` to `all` in most cases. All policy definitions
108
104
109
105
The following Resource Provider modes are fully supported:
110
106
111
-
-`Microsoft.Kubernetes.Data` for managing Kubernetes clusters and components such as pods, containers, and ingresses. Supported for Azure Kubernetes Service clusters and [Azure Arc-enabled Kubernetes clusters](../../../aks/intro-kubernetes.md). Definitions using this Resource Provider mode use the effects _audit_, _deny_, and _disabled_.
107
+
-`Microsoft.Kubernetes.Data` for managing Kubernetes clusters and components such as pods, containers, and ingresses. Supported for Azure Kubernetes Service clusters and [Azure Arc-enabled Kubernetes clusters](../../../aks/what-is-aks.md). Definitions using this Resource Provider mode use the effects _audit_, _deny_, and _disabled_.
112
108
-`Microsoft.KeyVault.Data` for managing vaults and certificates in [Azure Key Vault](../../../key-vault/general/overview.md). For more information on these policy definitions, see [Integrate Azure Key Vault with Azure Policy](../../../key-vault/general/azure-policy.md).
113
109
-`Microsoft.Network.Data` for managing [Azure Virtual Network Manager](../../../virtual-network-manager/overview.md) custom membership policies using Azure Policy.
114
110
@@ -119,7 +115,7 @@ The following Resource Provider modes are currently supported as a [preview](htt
119
115
-`Microsoft.MachineLearningServices.v2.Data` for managing [Azure Machine Learning](../../../machine-learning/overview-what-is-azure-machine-learning.md) model deployments. This Resource Provider mode reports compliance for newly created and updated components. During public preview, compliance records remain for 24 hours. Model deployments that exist before these policy definitions are assigned don't report compliance.
120
116
121
117
> [!NOTE]
122
-
>Unless explicitly stated, Resource Provider modes only support built-in policy definitions, and exemptions are not supported at the component-level.
118
+
>Unless explicitly stated, Resource Provider modes only support built-in policy definitions, and exemptions are not supported at the component-level.
123
119
124
120
When Azure Policy versioning is released, the following Resource Provider modes won't support built-in versioning:
125
121
@@ -128,18 +124,16 @@ When Azure Policy versioning is released, the following Resource Provider modes
128
124
-`Microsoft.ManagedHSM.Data`
129
125
130
126
## Version (preview)
131
-
Built-in policy definitions can host multiple versions with the same `definitionID`. If no version number is specified, all experiences will show the latest version of the definition. To see a specific version of a built-in, it must be specified in API, SDK or UI. To reference a specific version of a definition within an assignment, see [definition version within assignment](../concepts/assignment-structure.md#policy-definition-id-and-version-preview)
127
+
128
+
Built-in policy definitions can host multiple versions with the same `definitionID`. If no version number is specified, all experiences will show the latest version of the definition. To see a specific version of a built-in, it must be specified in API, SDK or UI. To reference a specific version of a definition within an assignment, see [definition version within assignment](../concepts/assignment-structure.md#policy-definition-id-and-version-preview)
132
129
133
130
The Azure Policy service uses `version`, `preview`, and `deprecated` properties to convey level of change to a built-in policy definition or initiative and state. The format of `version` is: `{Major}.{Minor}.{Patch}`. Specific states, such as _deprecated_ or _preview_, are appended to the `version` property or in another property as a **boolean**.
134
131
135
132
- Major Version (example: 2.0.0): introduce breaking changes such as major rule logic changes, removing parameters, adding an enforcement effect by default.
136
133
- Minor Version (example: 2.1.0): introduce changes such as minor rule logic changes, adding new parameter allowed values, change to `roleDefinitionIds`, adding or moving definitions within an initiative.
137
134
- Patch Version (example: 2.1.4): introduce string or metadata changes and break glass security scenarios (rare).
> To learn more about what it means for a policy to be _deprecated_ or in _preview_, see [Preview and deprecated policies](https://github.com/Azure/azure-policy/blob/master/built-in-policies/README.md#preview-and-deprecated-policies).
136
+
For more information about Azure Policy versions built-ins, see [Built-in versioning](https://github.com/Azure/azure-policy/blob/master/built-in-policies/README.md). To learn more about what it means for a policy to be _deprecated_ or in _preview_, see [Preview and deprecated policies](https://github.com/Azure/azure-policy/blob/master/built-in-policies/README.md#preview-and-deprecated-policies).
143
137
144
138
## Metadata
145
139
@@ -169,7 +163,7 @@ For more information, see [Understand scope in Azure Policy](./scope.md#definiti
169
163
- For more information about policy definition structure, go to [parameters](./definition-structure-parameters.md), [policy rule](./definition-structure-policy-rule.md), and [alias](./definition-structure-alias.md).
170
164
- For initiatives, go to [initiative definition structure](./initiative-definition-structure.md).
171
165
- Review examples at [Azure Policy samples](../samples/index.md).
0 commit comments