You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: "Quickstart: New policy assignment with portal"
3
-
description: In this quickstart, you use Azure portal to create an Azure Policy assignment to identify non-compliant resources.
4
-
ms.date: 08/17/2021
2
+
title: "Quickstart: Create policy assignment using Azure portal"
3
+
description: In this quickstart, you create an Azure Policy assignment to identify non-compliant resources using Azure portal.
4
+
ms.date: 02/29/2024
5
5
ms.topic: quickstart
6
6
---
7
-
# Quickstart: Create a policy assignment to identify non-compliant resources
8
7
9
-
The first step in understanding compliance in Azure is to identify the status of your resources.
10
-
This quickstart steps you through the process of creating a policy assignment to identify virtual
11
-
machines that aren't using managed disks.
8
+
# Quickstart: Create a policy assignment to identify non-compliant resources using Azure portal
12
9
13
-
At the end of this process, you'll successfully identify virtual machines that aren't using managed
14
-
disks. They're _non-compliant_ with the policy assignment.
10
+
The first step in understanding compliance in Azure is to identify the status of your resources. In this quickstart, you create a policy assignment to identify non-compliant resources using Azure portal. The policy is assigned to a resource group and audits virtual machines that don't use managed disks. After you create the policy assignment, you identify non-compliant virtual machines.
15
11
16
12
## Prerequisites
17
13
18
-
If you don't have an Azure subscription, create a [free](https://azure.microsoft.com/free/) account
19
-
before you begin.
14
+
-If you don't have an Azure account, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
15
+
- A resource group with at least one virtual machine that doesn't use managed disks.
20
16
21
17
## Create a policy assignment
22
18
23
-
In this quickstart, you create a policy assignment and assign the _Audit VMs that do not use managed
24
-
disks_ policy definition.
19
+
In this quickstart, you create a policy assignment with a built-in policy definition, [Audit VMs that do not use managed disks](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Compute/VMRequireManagedDisk_Audit.json).
25
20
26
-
1.Launch the Azure Policy service in the Azure portal by selecting **All services**, then searching
27
-
for and selecting **Policy**.
21
+
1.Sign in to the [Azure portal](https://portal.azure.com).
22
+
1. Search for _policy_and select it from the list.
28
23
29
-
:::image type="content" source="./media/assign-policy-portal/search-policy.png" alt-text="Screenshot of searching for Policy in All Services." border="false":::
24
+
:::image type="content" source="./media/assign-policy-portal/search-policy.png" alt-text="Screenshot of the Azure portal to search for policy.":::
30
25
31
-
1. Select **Assignments** on the left side of the Azure Policy page. An assignment is a policy that
32
-
has been assigned to take place within a specific scope.
26
+
1. Select **Assignments** on the **Policy** pane.
33
27
34
-
:::image type="content" source="./media/assign-policy-portal/select-assignments.png" alt-text="Screenshot of selecting the Assignments page from Policy Overview page." border="false":::
28
+
:::image type="content" source="./media/assign-policy-portal/select-assignments.png" alt-text="Screenshot of the Assignments pane that highlights the option to Assign policy.":::
35
29
36
-
1. Select **Assign Policy** from the top of the **Policy - Assignments**page.
30
+
1. Select **Assign Policy** from the **Policy Assignments**pane.
37
31
38
-
:::image type="content" source="./media/assign-policy-portal/select-assign-policy.png" alt-text="Screenshot of selecting 'Assign policy' from Assignments page." border="false":::
32
+
1. On the **Assign Policy** pane **Basics** tab configure the following options:
39
33
40
-
1. On the **Assign Policy** page, set the **Scope** by selecting the ellipsis and then selecting
41
-
either a management group or subscription. Optionally, select a resource group. A scope
42
-
determines what resources or grouping of resources the policy assignment gets enforced on. Then
43
-
use the **Select** button at the bottom of the **Scope** page.
34
+
| Field | Action |
35
+
| ---- | ---- |
36
+
|**Scope**| Use the ellipsis (`...`) and then select a subscription and a resource group. Then choose **Select** to apply the scope. |
37
+
|**Exclusions**| Optional and isn't used in this example. |
38
+
|**Policy definition**| Select the ellipsis to open the list of available definitions. |
39
+
|**Available Definitions**| Search the policy definitions list for _Audit VMs that do not use managed disks_ definition, select the policy, and select **Add**. |
40
+
|**Assignment name**| By default uses the name of the selected policy. You can change it but for this example, use the default name. |
41
+
|**Description**| Optional to provide details about this policy assignment. |
42
+
|**Policy enforcement**| Defaults to _Enabled_. For more information, go to [enforcement mode](./concepts/assignment-structure.md#enforcement-mode). |
43
+
|**Assigned by**| Defaults to who is signed in to Azure. This field is optional and custom values can be entered. |
44
44
45
-
This example uses the **Contoso** subscription. Your subscription will differ.
45
+
:::image type="content" source="./media/assign-policy-portal/select-available-definition.png" alt-text="Screenshot of filtering the available definitions.":::
46
46
47
-
1. Resources can be excluded based on the **Scope**. **Exclusions** start at one level lower than
48
-
the level of the **Scope**. **Exclusions** are optional, so leave it blank for now.
47
+
1. Select **Next** to view each tab for **Advanced**, **Parameters**, and **Remediation**. No changes are needed for this example.
49
48
50
-
1. Select the **Policy definition** ellipsis to open the list of available definitions. Azure Policy
51
-
comes with built-in policy definitions you can use. Many are available, such as:
49
+
| Tab name | Options |
50
+
| ---- | ---- |
51
+
|**Advanced**| Includes options for [resource selectors](./concepts/assignment-structure.md#resource-selectors-preview) and [overrides](./concepts/assignment-structure.md#overrides-preview). |
52
+
|**Parameters**| If the policy definition you selected on the **Basics** tab included parameters, they're configured on **Parameters** tab. This example doesn't use parameters. |
53
+
|**Remediation**| You can create a managed identity. For this example, **Create a Managed Identity** is unchecked. <br><br> This box _must_ be checked when a policy or initiative includes a policy with either the [deployIfNotExists](./concepts/effects.md#deployifnotexists) or [modify](./concepts/effects.md#modify) effect. For more information, go to [managed identities](../../active-directory/managed-identities-azure-resources/overview.md) and [how remediation access control works](./how-to/remediate-resources.md#how-remediation-access-control-works). |
52
54
53
-
- Enforce tag and its value
54
-
- Apply tag and its value
55
-
- Inherit a tag from the resource group if missing
55
+
1. Select **Next** and on the **Non-compliance messages** tab create a **Non-compliance message** like _Virtual machines should use managed disks_.
56
56
57
-
For a partial list of available built-in policies, see [Azure Policy samples](./samples/index.md).
57
+
This custom message is displayed when a resource is denied or for non-compliant resources during regular evaluation.
58
58
59
-
1. Search through the policy definitions list to find the _Audit VMs that do not use managed disks_
60
-
definition. Select that policy and then use the **Select** button.
59
+
1. Select **Next** and on the **Review + create** tab, review the policy assignment details.
61
60
62
-
:::image type="content" source="./media/assign-policy-portal/select-available-definition.png" alt-text="Screenshot of filtering the available definitions." border="false":::
63
-
64
-
1. The **Assignment name** is automatically populated with the policy name you selected, but you can
65
-
change it. For this example, leave _Audit VMs that do not use managed disks_. You can also add an
66
-
optional **Description**. The description provides details about this policy assignment.
67
-
**Assigned by** will automatically fill based on who is logged in. This field is optional, so
68
-
custom values can be entered.
69
-
70
-
1. Leave policy enforcement _Enabled_. For more information, see
1. Select **Next** at the bottom of the page or the **Parameters** tab at the top of the page to
74
-
move to the next segment of the assignment wizard.
75
-
76
-
1. If the policy definition selected on the **Basics** tab included parameters, they are configured
77
-
on this tab. Since the _Audit VMs that do not use managed disks_ has no parameters, select
78
-
**Next** at the bottom of the page or the **Remediation** tab at the top of the page to move to
79
-
the next segment of the assignment wizard.
80
-
81
-
1. Leave **Create a Managed Identity** unchecked. This box _must_ be checked when the policy or
82
-
initiative includes a policy with either the
83
-
[deployIfNotExists](./concepts/effects.md#deployifnotexists) or
84
-
[modify](./concepts/effects.md#modify) effect. As the policy used for this quickstart doesn't,
85
-
leave it blank. For more information, see
86
-
[managed identities](../../active-directory/managed-identities-azure-resources/overview.md) and
87
-
[how remediation access control works](./how-to/remediate-resources.md#how-remediation-access-control-works).
88
-
89
-
1. Select **Next** at the bottom of the page or the **Non-compliance messages** tab at the top of
90
-
the page to move to the next segment of the assignment wizard.
91
-
92
-
1. Set the **Non-compliance message** to _Virtual machines should use a managed disk_. This custom
93
-
message is displayed when a resource is denied or for non-compliant resources during regular
94
-
evaluation.
95
-
96
-
1. Select **Next** at the bottom of the page or the **Review + Create** tab at the top of the page
97
-
to move to the next segment of the assignment wizard.
98
-
99
-
1. Review the selected options, then select **Create** at the bottom of the page.
100
-
101
-
You're now ready to identify non-compliant resources to understand the compliance state of your
102
-
environment.
61
+
1. Select **Create** to create the policy assignment.
103
62
104
63
## Identify non-compliant resources
105
64
106
-
Select **Compliance** in the left side of the page. Then locate the _Audit VMs that do not use
107
-
managed disks_ policy assignment you created.
65
+
On the **Policy** pane, select **Compliance** and locate the _Audit VMs that do not use managed disks_ policy assignment. The compliance state for a new policy assignment takes a few minutes to become active and provide results about the policy's state.
108
66
109
-
:::image type="content" source="./media/assign-policy-portal/policy-compliance.png" alt-text="Screenshot of compliance details on the Policy Compliance page." border="false":::
67
+
:::image type="content" source="./media/assign-policy-portal/policy-compliance.png" alt-text="Screenshot of the Policy Compliance that highlights the example's non-compliant policy assignment." lightbox="./media/assign-policy-portal/policy-compliance.png":::
110
68
111
-
If there are any existing resources that aren't compliant with this new assignment, they appear
112
-
under **Non-compliant resources**.
69
+
The policy assignment shows resources that aren't compliant with a **Compliance state** of **Non-compliant**. To get more details, select the policy assignment name to view the **Resource Compliance**.
113
70
114
-
When a condition is evaluated against your existing resources and found true, then those resources
115
-
are marked as non-compliant with the policy. The following table shows how different policy effects
116
-
work with the condition evaluation for the resulting compliance state. Although you don't see the
117
-
evaluation logic in the Azure portal, the compliance state results are shown. The compliance state
118
-
result is either compliant or non-compliant.
71
+
When a condition is evaluated against your existing resources and found true, then those resources are marked as non-compliant with the policy. The following table shows how different policy effects work with the condition evaluation for the resulting compliance state. Although you don't see the evaluation logic in the Azure portal, the compliance state results are shown. The compliance state result is either compliant or non-compliant.
119
72
120
73
| Resource State | Effect | Policy Evaluation | Compliance State |
121
74
| --- | --- | --- | --- |
@@ -124,31 +77,25 @@ result is either compliant or non-compliant.
> The DeployIfNotExist and AuditIfNotExist effects require the IF statement to be TRUE and the
129
-
> existence condition to be FALSE to be non-compliant. When TRUE, the IF condition triggers
130
-
> evaluation of the existence condition for the related resources.
80
+
The `DeployIfNotExist` and `AuditIfNotExist` effects require the `IF` statement to be `TRUE` and the existence condition to be `FALSE` to be non-compliant. When `TRUE`, the `IF` condition triggers evaluation of the existence condition for the related resources.
131
81
132
82
## Clean up resources
133
83
134
-
To remove the assignment created, follow these steps:
84
+
You can delete a policy assignment from **Compliance** or from **Assignments**.
85
+
86
+
To remove the policy assignment created in this article, follow these steps:
135
87
136
-
1. Select **Compliance** (or **Assignments**) in the left side of the Azure Policy page and locate
137
-
the _Audit VMs that do not use managed disks_ policy assignment you created.
88
+
1. On the **Policy** pane, select **Compliance** and locate the _Audit VMs that do not use managed disks_ policy assignment.
138
89
139
-
1. Right-click the _Audit VMs that do not use managed disks_ policy assignment and select **Delete
140
-
assignment**.
90
+
1. Select the policy assignment's ellipsis and select **Delete assignment**.
141
91
142
-
:::image type="content" source="./media/assign-policy-portal/delete-assignment.png" alt-text="Screenshot of using the context menu to delete an assignment from the Compliance page." border="false":::
92
+
:::image type="content" source="./media/assign-policy-portal/delete-assignment.png" alt-text="Screenshot of the Compliance pane that highlights the menu to delete a policy assignment." lightbox="./media/assign-policy-portal/delete-assignment.png":::
143
93
144
94
## Next steps
145
95
146
-
In this quickstart, you assigned a policy definition to a scope and evaluated its compliance report.
147
-
The policy definition validates that all the resources in the scope are compliant and identifies
148
-
which ones aren't.
96
+
In this quickstart, you assigned a policy definition to identify non-compliant resources in your Azure environment.
149
97
150
-
To learn more about assigning policies to validate that new resources are compliant, continue to the
151
-
tutorial for:
98
+
To learn more about how to assign policies that validate if new resources are compliant, continue to the tutorial.
152
99
153
100
> [!div class="nextstepaction"]
154
-
> [Creating and managing policies](./tutorials/create-and-manage.md)
101
+
> [Tutorial: Create and manage policies to enforce compliance](./tutorials/create-and-manage.md)
0 commit comments