@@ -10,8 +10,8 @@ manager: carmonm
10
10
---
11
11
# Overview of the Azure Policy service
12
12
13
- Governance validates that your organization can achieve its goals through an effective and
14
- efficient use of IT. It meets this need by creating clarity between business goals and IT projects.
13
+ Governance validates that your organization can achieve its goals through effective and efficient
14
+ use of IT. It meets this need by creating clarity between business goals and IT projects.
15
15
16
16
Does your company experience a significant number of IT issues that never seem to get resolved?
17
17
Good IT governance involves planning your initiatives and setting priorities on a strategic level
@@ -33,11 +33,12 @@ over more details on how to create and implement policies with Azure Policy.
33
33
34
34
## How is it different from RBAC?
35
35
36
- There are a few key differences between Policy and role-based access control (RBAC). RBAC focuses
37
- on user actions at different scopes. You might be added to the contributor role for a resource
38
- group, allowing you to make changes to that resource group. Policy focuses on resource properties
39
- during deployment and for already existing resources. Policy controls properties such as the types
40
- or locations of resources. Unlike RBAC, Policy is a default allow and explicit deny system.
36
+ There are a few key differences between Azure Policy and role-based access control (RBAC). RBAC
37
+ focuses on user actions at different scopes. You might be added to the contributor role for a
38
+ resource group, allowing you to make changes to that resource group. Azure Policy focuses on
39
+ resource properties during deployment and for already existing resources. Azure Policy controls
40
+ properties such as the types or locations of resources. Unlike RBAC, Azure Policy is a default allow
41
+ and explicit deny system.
41
42
42
43
### RBAC Permissions in Azure Policy
43
44
@@ -47,9 +48,9 @@ Azure Policy has several permissions, known as operations, in two Resource Provi
47
48
- [ Microsoft.PolicyInsights] ( ../../role-based-access-control/resource-provider-operations.md#microsoftpolicyinsights )
48
49
49
50
Many Built-in roles grant permission to Azure Policy resources. The ** Resource Policy Contributor
50
- (Preview)** role includes most Policy operations. ** Owner** has full rights. Both ** Contributor **
51
- and ** Reader** can use all read Policy operations, but ** Contributor** can also trigger
52
- remediation.
51
+ (Preview)** role includes most Azure Policy operations. ** Owner** has full rights. Both
52
+ ** Contributor ** and ** Reader** can use all read Azure Policy operations, but ** Contributor** can
53
+ also trigger remediation.
53
54
54
55
If none of the Built-in roles have the permissions required, create a [ custom role] ( ../../role-based-access-control/custom-roles.md ) .
55
56
@@ -93,7 +94,7 @@ networking resources. You could exclude a resource group in that subscription th
93
94
networking infrastructure. You then grant access to this networking resource group to users that
94
95
you trust with creating networking resources.
95
96
96
- In another example, you might want to assign a resource type whitelist policy at the management
97
+ In another example, you might want to assign a resource type allow list policy at the management
97
98
group level. And then assign a more permissive policy (allowing more resource types) on a child
98
99
management group or even directly on subscriptions. However, this example wouldn't work because
99
100
policy is an explicit deny system. Instead, you need to exclude the child management group or
@@ -167,7 +168,7 @@ options:
167
168
When creating value options in an initiative definition, you're unable to input a different value
168
169
during the initiative assignment because it's not part of the list.
169
170
170
- ## Maximum count of Policy objects
171
+ ## Maximum count of Azure Policy objects
171
172
172
173
[ !INCLUDE [ policy-limits] ( ../../../includes/azure-policy-limits.md )]
173
174
@@ -208,8 +209,8 @@ visit [Govern your Azure environment through Azure Policy](https://channel9.msdn
208
209
Now that you have an overview of Azure Policy and some of the key concepts, here are the suggested
209
210
next steps:
210
211
211
- - [ Assign a policy definition using the portal] ( assign-policy-portal.md )
212
- - [ Assign a policy definition using the Azure CLI] ( assign-policy-azurecli.md )
213
- - [ Assign a policy definition using PowerShell] ( assign-policy-powershell.md )
214
- - Review what a management group is with [ Organize your resources with Azure management groups] ( ..//management-groups/overview.md )
215
- - View [ Govern your Azure environment through Azure Policy] ( https://channel9.msdn.com/events/Build/2018/THR2030 ) on Channel 9
212
+ - [ Assign a policy definition using the portal] ( assign-policy-portal.md ) .
213
+ - [ Assign a policy definition using the Azure CLI] ( assign-policy-azurecli.md ) .
214
+ - [ Assign a policy definition using PowerShell] ( assign-policy-powershell.md ) .
215
+ - Review what a management group is with [ Organize your resources with Azure management groups] ( ..//management-groups/overview.md ) .
216
+ - View [ Govern your Azure environment through Azure Policy] ( https://channel9.msdn.com/events/Build/2018/THR2030 ) on Channel 9.
0 commit comments