You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/governance/blueprints/concepts/lifecycle.md
+25-22Lines changed: 25 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Understand the lifecycle of a blueprint
3
-
description: Learn about the lifecycle that a blueprint goes through and details about each stage.
3
+
description: Learn about the lifecycle that a blueprint definition goes through and details about each stage, including updating and removing blueprint assignments.
4
4
ms.date: 07/30/2019
5
5
ms.topic: conceptual
6
6
---
@@ -32,25 +32,26 @@ A never published blueprint in **Draft** mode displays a different icon on the *
32
32
Definitions** page than ones that have been **Published**. The **Latest Version** is displayed as
33
33
**Draft** for these never published blueprints.
34
34
35
-
Create and edit a blueprint with the [Azure portal](../create-blueprint-portal.md#create-a-blueprint)
36
-
or [REST API](../create-blueprint-rest-api.md#create-a-blueprint).
35
+
Create and edit a blueprint with the
36
+
[Azure portal](../create-blueprint-portal.md#create-a-blueprint) or
## Creating and editing a new version of the blueprint
49
50
50
-
A **Published** version of a blueprint can't be altered. However, a new version of the blueprint
51
-
can be added to the existing blueprint and modified as needed. Make changes to an existing
52
-
blueprint by editing it. When the new changes are saved, the blueprint now has **Unpublished
53
-
Changes**. These changes are a new **Draft** version of the blueprint.
51
+
A **Published** version of a blueprint can't be altered. However, a new version of the blueprint can
52
+
be added to the existing blueprint and modified as needed. Make changes to an existing blueprint by
53
+
editing it. When the new changes are saved, the blueprint now has **Unpublished Changes**. These
54
+
changes are a new **Draft** version of the blueprint.
54
55
55
56
Edit a blueprint with the [Azure portal](../create-blueprint-portal.md#edit-a-blueprint).
56
57
@@ -62,7 +63,8 @@ Blueprint** button is available on the edit blueprint page. If the button isn't
62
63
blueprint has already been **Published** and has no **Unpublished Changes**.
63
64
64
65
> [!NOTE]
65
-
> A single blueprint can have multiple **Published** versions that can each be assigned to subscriptions.
66
+
> A single blueprint can have multiple **Published** versions that can each be assigned to
67
+
> subscriptions.
66
68
67
69
To publish a blueprint with **Unpublished Changes**, use the same steps for publishing a new
68
70
blueprint.
@@ -74,27 +76,28 @@ version of a blueprint can also be deleted. Deleting a version of a blueprint do
74
76
impact on other versions of that blueprint.
75
77
76
78
> [!NOTE]
77
-
> It's not possible to delete a blueprint that has active assignments. Delete the
78
-
> assignments first and then delete the version you wish to remove.
79
+
> It's not possible to delete a blueprint that has active assignments. Delete the assignments first
80
+
> and then delete the version you wish to remove.
79
81
80
82
1. Select **All services** in the left pane. Search for and select **Blueprints**.
81
83
82
-
1. Select **Blueprint definitions** from the page on the left and use the filter options to locate the blueprint you want to delete a version of. Click on it to open the edit page.
84
+
1. Select **Blueprint definitions** from the page on the left and use the filter options to locate
85
+
the blueprint you want to delete a version of. Select it to open the edit page.
83
86
84
-
1.Click the **Published versions** tab and locate the version you wish to delete.
87
+
1.Select the **Published versions** tab and locate the version you wish to delete.
85
88
86
89
1. Right-click on the version to delete and select **Delete this version**.
87
90
88
91
## Deleting the blueprint
89
92
90
93
The core blueprint can also be deleted. Deleting the core blueprint also deletes any blueprint
91
94
versions of that blueprint, including both **Draft** and **Published** blueprints. As with deleting
92
-
a version of a blueprint, deleting the core blueprint doesn't remove the existing assignments of
93
-
any of the blueprint versions.
95
+
a version of a blueprint, deleting the core blueprint doesn't remove the existing assignments of any
96
+
of the blueprint versions.
94
97
95
98
> [!NOTE]
96
-
> It's not possible to delete a blueprint that has active assignments. Delete the
97
-
> assignments first and then delete the version you wish to remove.
99
+
> It's not possible to delete a blueprint that has active assignments. Delete the assignments first
100
+
> and then delete the version you wish to remove.
98
101
99
102
Delete a blueprint with the [Azure portal](../create-blueprint-portal.md#delete-a-blueprint) or
Copy file name to clipboardExpand all lines: articles/governance/blueprints/concepts/resource-locking.md
+11-9Lines changed: 11 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,15 +1,15 @@
1
1
---
2
2
title: Understand resource locking
3
-
description: Learn about the locking options to protect resources when assigning a blueprint.
3
+
description: Learn about the locking options in Azure Blueprints to protect resources when assigning a blueprint.
4
4
ms.date: 04/24/2019
5
5
ms.topic: conceptual
6
6
---
7
7
# Understand resource locking in Azure Blueprints
8
8
9
9
The creation of consistent environments at scale is only truly valuable if there's a mechanism to
10
10
maintain that consistency. This article explains how resource locking works in Azure Blueprints. To
11
-
see an example of resource locking and application of _deny assignments_, see the[protecting new resources](../tutorials/protect-new-resources.md)
12
-
tutorial.
11
+
see an example of resource locking and application of _deny assignments_, see the
12
+
[protecting new resources](../tutorials/protect-new-resources.md)tutorial.
13
13
14
14
## Locking modes and states
15
15
@@ -55,8 +55,8 @@ is left behind and would need to be deleted through normal means.
55
55
## How blueprint locks work
56
56
57
57
An RBAC [deny assignments](../../../role-based-access-control/deny-assignments.md) deny action is
58
-
applied to artifact resources during assignment of a blueprint if the assignment selected the
59
-
**Read Only** or **Do Not Delete** option. The deny action is added by the managed identity of the
58
+
applied to artifact resources during assignment of a blueprint if the assignment selected the**Read
59
+
Only** or **Do Not Delete** option. The deny action is added by the managed identity of the
60
60
blueprint assignment and can only be removed from the artifact resources by the same managed
61
61
identity. This security measure enforces the locking mechanism and prevents removing the blueprint
62
62
lock outside Blueprints.
@@ -80,10 +80,12 @@ of each mode are as follows:
80
80
81
81
## Exclude a principal from a deny assignment
82
82
83
-
In some design or security scenarios, it may be necessary to exclude a principal from the [deny assignment](../../../role-based-access-control/deny-assignments.md)
84
-
the blueprint assignment creates. This is done in REST API by adding up to five values to the
85
-
**excludedPrincipals** array in the **locks** property when [creating the assignment](/rest/api/blueprints/assignments/createorupdate).
86
-
This is an example of a request body that includes **excludedPrincipals**:
83
+
In some design or security scenarios, it may be necessary to exclude a principal from the
84
+
[deny assignment](../../../role-based-access-control/deny-assignments.md) the blueprint assignment
85
+
creates. This is done in REST API by adding up to five values to the **excludedPrincipals** array in
86
+
the **locks** property when
87
+
[creating the assignment](/rest/api/blueprints/assignments/createorupdate). This is an example of a
88
+
request body that includes **excludedPrincipals**:
Copy file name to clipboardExpand all lines: articles/governance/blueprints/how-to/update-existing-assignments.md
+21-10Lines changed: 21 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Update an existing assignment from the portal
3
-
description: Learn about the mechanism for updating an existing assignment from the portal in Azure Blueprints.
4
-
ms.date: 10/25/2018
3
+
description: Learn about the mechanism for updating an existing blueprint assignment from the portal in Azure Blueprints.
4
+
ms.date: 11/21/2019
5
5
ms.topic: conceptual
6
6
---
7
7
# How to update an existing blueprint assignment
@@ -19,17 +19,23 @@ an existing assignment, including:
19
19
20
20
1. Select **Assigned blueprints** from the page on the left.
21
21
22
-
1. In the list of blueprints, left-click the blueprint assignment. Then click the **Update assignment** button OR right-click the blueprint assignment and select **Update assignment**.
22
+
1. In the list of blueprints, left-click the blueprint assignment. Then click the **Update
23
+
assignment** button OR right-click the blueprint assignment and select **Update assignment**.
23
24
24
25

25
26
26
-
1. The **Assign blueprint** page will load pre-filled with all values from the original assignment. You can change the **blueprint definition version**, the **Lock Assignment** state, and any of the dynamic parameters that exist on the blueprint definition. Click **Assign** when done making changes.
27
+
1. The **Assign blueprint** page will load pre-filled with all values from the original assignment.
28
+
You can change the **blueprint definition version**, the **Lock Assignment** state, and any of
29
+
the dynamic parameters that exist on the blueprint definition. Click **Assign** when done making
30
+
changes.
27
31
28
-
1. On the updated assignment details page, see the new status. In this example, we added **Locking** to the assignment.
32
+
1. On the updated assignment details page, see the new status. In this example, we added **Locking**
33
+
to the assignment.
29
34
30
35

31
36
32
-
1. Explore details about other **Assignment operations** using the drop-down. The table of **Managed resources** updates by selected assignment operation.
37
+
1. Explore details about other **Assignment operations** using the drop-down. The table of **Managed
38
+
resources** updates by selected assignment operation.
33
39
34
40

35
41
@@ -40,13 +46,18 @@ happens to already deployed resources. The requested change and the type of arti
40
46
deployed or updated determine which actions are taken.
41
47
42
48
- Role Assignments
43
-
- If the role or the role assignee (user, group, or app) changes, a new role assignment is created. Role assignments previously deployed are left in place.
49
+
- If the role or the role assignee (user, group, or app) changes, a new role assignment is
50
+
created. Role assignments previously deployed are left in place.
44
51
- Policy Assignments
45
52
- If the parameters of the policy assignment are changed, the existing assignment is updated.
46
-
- If the definition of the policy assignment is changed, a new policy assignment is created. Policy assignments previously deployed are left in place.
47
-
- If the policy assignment artifact is removed from the blueprint, deployed policy assignments are left in place.
53
+
- If the definition of the policy assignment is changed, a new policy assignment is created.
54
+
Policy assignments previously deployed are left in place.
55
+
- If the policy assignment artifact is removed from the blueprint, deployed policy assignments are
56
+
left in place.
48
57
- Azure Resource Manager templates
49
-
- The template is processed through Resource Manager as a **PUT**. As each resource type handles this action differently, review the documentation for each included resource to determine the impact of this action when run by Blueprints.
58
+
- The template is processed through Resource Manager as a **PUT**. As each resource type handles
59
+
this action differently, review the documentation for each included resource to determine the
Copy file name to clipboardExpand all lines: articles/governance/blueprints/samples/caf-foundation/index.md
+9-8Lines changed: 9 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: CAF Foundation blueprint sample - Overview
3
-
description: Overview and architecture of the CAF Foundation blueprint sample.
3
+
description: Overview and architecture of the Cloud Adoption Framework (CAF) for Azure Foundation blueprint sample.
4
4
ms.date: 08/20/2019
5
5
ms.topic: sample
6
6
---
@@ -22,26 +22,27 @@ organization to confidently get started with Azure.
22
22
This implementation incorporates several Azure services used to provide a secure, fully monitored,
23
23
enterprise-ready foundation. This environment is composed of:
24
24
25
-
- An [Azure Key Vault](../../../../key-vault/key-vault-overview.md) instance used to host secrets used
26
-
for the VMs deployed in the shared services environment
25
+
- An [Azure Key Vault](../../../../key-vault/key-vault-overview.md) instance used to host secrets
26
+
used for the VMs deployed in the shared services environment
27
27
- Deploy [Log Analytics](../../../../azure-monitor/overview.md) is deployed to ensure all actions
28
-
and services log to a central location from the moment you start your secure deployment in to[Storage Accounts](../../../../storage/common/storage-introduction.md)
29
-
for diagnostic logging
28
+
and services log to a central location from the moment you start your secure deployment in to
version) provides threat protection for your migrated workloads
32
32
- The blueprint also defines and deploys [Azure Policies](../../../policy/overview.md), for
33
33
- Tagging (CostCenter) applied to resources groups
34
34
- Append resources in resource group with the CostCenter Tag
35
35
- Allowed Azure Region for Resources and Resource Groups
36
36
- Allowed Storage Account SKUs (choose while deploying)
37
-
- Allowed Azure VM SKUs(choose while deploying)
37
+
- Allowed Azure VM SKUs(choose while deploying)
38
38
- Require Network Watch to be deployed
39
39
- Require Azure Storage Account Secure transfer Encryption
40
40
- Deny resource types (choose while deploying)
41
41
- Initiatives
42
42
- Enable Monitoring in Azure Security Center (89 Policies)
43
43
44
-
All these elements abide to the proven practices published in the [Azure Architecture Center - Reference Architectures](/azure/architecture/reference-architectures/).
44
+
All these elements abide to the proven practices published in the
45
+
[Azure Architecture Center - Reference Architectures](/azure/architecture/reference-architectures/).
45
46
46
47
> [!NOTE]
47
48
> The CAF Foundation lays out a foundational architecture for workloads.
@@ -55,7 +56,7 @@ For more information, see the
55
56
You've reviewed the overview and architecture of the CAF Foundation blueprint sample.
56
57
57
58
> [!div class="nextstepaction"]
58
-
> [CAF Foundation blueprint - Deploy steps](./deploy.md)
59
+
> [CAF Foundation blueprint - Deploy steps](./deploy.md)
59
60
60
61
Additional articles about blueprints and how to use them:
@@ -38,21 +38,23 @@ enterprise-ready governance. This environment is composed of:
38
38
and Database migration.
39
39
40
40
41
-
All these elements abide to the proven practices published in the [Azure Architecture Center - Reference Architectures](/azure/architecture/reference-architectures/).
41
+
All these elements abide to the proven practices published in the
42
+
[Azure Architecture Center - Reference Architectures](/azure/architecture/reference-architectures/).
42
43
43
44
> [!NOTE]
44
45
> The CAF Migration blueprint lays out a landing zone for your workloads. You still need to perform
45
46
> the assessment and migration of your Virtual Machines / Databases on top of this foundational
46
47
> architecture.
47
48
48
-
For more information, see the [Microsoft Cloud Adoption Framework for Azure - Migrate](/azure/architecture/cloud-adoption/migrate/).
49
+
For more information, see the
50
+
[Microsoft Cloud Adoption Framework for Azure - Migrate](/azure/architecture/cloud-adoption/migrate/).
49
51
50
52
## Next steps
51
53
52
54
You've reviewed the overview and architecture of the CAF Migrate landing zone blueprint sample.
53
55
54
56
> [!div class="nextstepaction"]
55
-
> [CAF Migration landing zone blueprint - Deploy steps](./deploy.md)
57
+
> [CAF Migration landing zone blueprint - Deploy steps](./deploy.md)
56
58
57
59
Additional articles about blueprints and how to use them:
0 commit comments