Skip to content

Commit be1a89d

Browse files
ttorblettorble
authored
Merge pull request #217654 from ntrogh/als-policy
[Azure Lab Services] Updated Azure policy content
2 parents d767612 + 831ad57 commit be1a89d

File tree

3 files changed

+87
-37
lines changed

3 files changed

+87
-37
lines changed

‎articles/lab-services/TOC.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -307,8 +307,9 @@
307307
href: /powershell/module/az.labservices/
308308
- name: Azure CLI
309309
href: https://github.com/Azure/azure-cli-extensions/tree/main/src/hack
310-
- name: Built-in policies
311-
href: ../governance/policy/samples/built-in-policies.md#lab-services
310+
- name: Azure Policy built-ins
311+
displayName: samples, policies, definitions
312+
href: ./policy-reference.md
312313
- name: Microsoft Azure SDK for Python
313314
href: https://pypi.org/project/azure-mgmt-labservices/
314315
- name: Resources

‎articles/lab-services/azure-polices-for-lab-services.md

Lines changed: 55 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,76 +1,96 @@
11
---
22
title: Azure Policies for Lab Services
3-
description: This article describes the policies available for Azure Lab Services.
3+
description: Learn how to use Azure Policy to use built-in policies for Azure Lab Services to make sure your labs are compliant with your requirements.
44
ms.topic: conceptual
55
ms.author: rosemalcolm
66
author: RoseHJM
7-
ms.date: 08/15/2022
7+
ms.date: 11/08/2022
88
---
99

10-
# What’s new with Azure Policy for Lab Services?
10+
# Use policies to audit and manage Azure Lab Services
1111

12-
Azure Policy helps you manage and prevent IT issues by applying policy definitions that enforce rules and effects for your resource. Azure Lab Services has added four built-in Azure policies. This article summarizes the new policies available in the August 2022 Update for Azure Lab Services.
12+
When teams create and run labs on Azure Lab Services, they may face varying requirements to the configuration of resources. Administrators may look for options to control cost, provide customization through templates, or restrict user permissions.
1313

14-
1. Lab Services should enable all options for auto shutdown
15-
1. Lab Services should not allow template virtual machines for labs
16-
1. Lab Services should require non-admin user for labs
17-
1. Lab Services should restrict allowed virtual machine SKU sizes
14+
As a platform administrator, you can use policies to lay out guardrails for teams to manage their own resources. [Azure Policy](../governance/policy/index.yml) helps audit and govern resource state. In this article, you learn about available auditing controls and governance practices for Azure Lab Services.
1815

19-
For a full list of built-in policies, including policies for Lab Services, see [Azure Policy built-in policy definitions](../governance/policy/samples/built-in-policies.md#lab-services).
16+
[!INCLUDE [lab plans only note](./includes/lab-services-new-update-focused-article.md)]
2017

18+
## Policies for Azure Lab Services
2119

20+
[Azure Policy](../governance/policy/index.yml) is a governance tool that allows you to ensure that Azure resources are compliant with your policies.
2221

23-
[!INCLUDE [lab plans only note](./includes/lab-services-new-update-focused-article.md)]
22+
Azure Lab Services provides a set of policies that you can use for common scenarios with Azure Lab Services. You can assign these policy definitions to your existing subscription or use them as the basis to create your own custom definitions.
23+
24+
Policies can be set at different scopes, such as at the subscription or resource group level. For more information, see the [Azure Policy documentation](../governance/policy/overview.md).
25+
26+
For a full list of built-in policies, including policies for Lab Services, see Azure Policy built-in policy definitions.
2427

25-
## Lab Services should enable all options for auto shutdown
28+
### Lab Services should enable all options for auto shutdown
2629

27-
This policy enforces that all [shutdown options](how-to-configure-auto-shutdown-lab-plans.md) are enabled while creating the lab. During policy assignment, lab administrators can choose the following effects.
30+
This policy enforces that all [shutdown options](how-to-configure-auto-shutdown-lab-plans.md) are enabled while creating the lab.
31+
32+
During policy assignment, lab administrators can choose the following effects:
2833

2934
|**Effect**|**Behavior**|
30-
|-----|-----|
31-
|**Audit**|Labs will show on the [compliance dashboard](../governance/policy/assign-policy-portal.md#identify-non-compliant-resources) as non-compliant when all shutdown options are not enabled for a lab. |
32-
|**Deny**|Lab creation will fail if all shutdown options are not enabled. |
35+
|----------|------------|
36+
|**Audit** | Labs will show on the [compliance dashboard](../governance/policy/assign-policy-portal.md#identify-non-compliant-resources) as non-compliant when all shutdown options aren't enabled for a lab. |
37+
|**Deny** | Lab creation will fail if all shutdown options aren't enabled. |
38+
39+
### Lab Services should not allow template virtual machines for labs
3340

34-
## Lab Services should not allow template virtual machines for labs
41+
You can use this policy to restrict [customization of lab templates](tutorial-setup-lab.md). When you create a new lab, you can choose to *Create a template virtual machine* or *Use virtual machine image without customization*. If this policy is enabled, only *Use virtual machine image without customization* is allowed.
3542

36-
This policy can be used to restrict [customization of lab templates](tutorial-setup-lab.md). When you create a new lab, you can select to *Create a template virtual machine* or *Use virtual machine image without customization*. If this policy is enabled, only *Use virtual machine image without customization* is allowed. During policy assignment, lab administrators can choose the following effects.
43+
During policy assignment, lab administrators can choose the following effects:
3744

3845
|**Effect**|**Behavior**|
39-
|-----|-----|
40-
|**Audit**|Labs will show on the [compliance dashboard](../governance/policy/assign-policy-portal.md#identify-non-compliant-resources) as non-compliant when a template virtual machine is used for a lab.|
41-
|**Deny**|Lab creation to fail if “create a template virtual machine” option is used for a lab.|
46+
|----------|------------|
47+
|**Audit** |Labs will show on the [compliance dashboard](../governance/policy/assign-policy-portal.md#identify-non-compliant-resources) as non-compliant when a template virtual machine is used for a lab.|
48+
|**Deny** |Lab creation will fail if *Create a template virtual machine* option is used for a lab.|
4249

43-
## Lab Services requires non-admin user for labs
50+
### Lab Services requires non-admin user for labs
4451

45-
This policy is used to enforce using non-admin accounts while creating a lab. With the August 2022 Update, you can choose to add a non-admin account to the VM image. This new feature allows you to keep separate credentials for VM admin and non-admin users. For more information to create a lab with a non-admin user, see [Tutorial: Create and publish a lab](tutorial-setup-lab.md#create-a-lab), which shows how to give a student non-administrator account rather than default administrator account on the “Virtual machine credentials” page of the new lab wizard.
52+
Use this policy to enforce using non-admin accounts while creating a lab. With the August 2022 Update, you can choose to add a non-admin account to the VM image. This new feature allows you to keep separate credentials for VM admin and non-admin users. For more information to create a lab with a non-admin user, see [Tutorial: Create and publish a lab](tutorial-setup-lab.md#create-a-lab). The tutorial shows how to give a student a non-administrator account rather than default administrator account on the **Virtual machine credentials** page in the new lab wizard.
4653

47-
During the policy assignment, the lab administrator can choose the following effects.
54+
During the policy assignment, the lab administrator can choose the following effects:
4855

4956
|**Effect**|**Behavior**|
50-
|-----|-----|
51-
|**Audit**|Labs show on the [compliance dashboard](../governance/policy/assign-policy-portal.md#identify-non-compliant-resources) as non-compliant when non-admin accounts are not used while creating the lab.|
52-
|**Deny**|Lab creation will fail if “Give lab users a non-admin account on their virtual machines” is not checked while creating a lab.|
57+
|----------|------------|
58+
|**Audit** |Labs show on the [compliance dashboard](../governance/policy/assign-policy-portal.md#identify-non-compliant-resources) as non-compliant when non-admin accounts aren't used while creating the lab.|
59+
|**Deny** |Lab creation will fail if *Give lab users a non-admin account on their virtual machines* isn't checked while creating a lab.|
60+
61+
### Lab Services should restrict allowed virtual machine SKU sizes
5362

54-
## Lab Services should restrict allowed virtual machine SKU sizes
55-
This policy is used to enforce which SKUs can be used while creating the lab. For example, a lab administrator might want to prevent educators from creating labs with GPU SKUs since they are not needed for any classes being taught. This policy would allow lab administrators to enforce which SKUs can be used while creating the lab.
56-
During the policy assignment, the Lab Administrator can choose the following effects.
63+
This policy enforces which SKUs can be used while creating a lab. For example, a lab administrator might want to prevent educators from creating labs with GPU SKUs, since they aren't needed for any classes being taught.
64+
65+
During the policy assignment, the Lab Administrator can choose the following effects:
5766

5867
|**Effect**|**Behavior**|
59-
|-----|-----|
60-
|**Audit**|Labs show on the [compliance dashboard](../governance/policy/assign-policy-portal.md#identify-non-compliant-resources) as non-compliant when a non-allowed SKU is used while creating the lab.|
61-
|**Deny**|Lab creation will fail if SKU chosen while creating a lab is not allowed as per the policy assignment.|
68+
|----------|------------|
69+
|**Audit** |Labs show on the [compliance dashboard](../governance/policy/assign-policy-portal.md#identify-non-compliant-resources) as non-compliant when a non-allowed SKU is used while creating the lab.|
70+
|**Deny** |Lab creation will fail if the selected SKU while creating a lab isn't allowed as per the policy assignment.|
71+
72+
## Assigning built-in policies
73+
74+
To view the built-in policy definitions related to Azure Lab Services, use the following steps:
75+
76+
1. Go to **Azure Policy** in the [Azure portal](https://portal.azure.com).
77+
1. Select **Definitions**.
78+
1. For **Type**, select *Built-in*, and for **Category**, select **Lab Services**.
79+
80+
From here, you can select policy definitions to view them. While viewing a definition, you can use the **Assign** link to assign the policy to a specific scope, and configure the parameters for the policy. For more information, see [Assign a policy - portal](../governance/policy/assign-policy-portal.md).
81+
82+
You can also assign policies by using [Azure PowerShell](../governance/policy/assign-policy-powershell.md), [Azure CLI](../governance/policy/assign-policy-azurecli.md), and [templates](../governance/policy/assign-policy-template.md).
6283

6384
## Custom policies
6485

65-
In addition to the new built-in policies described above, you can create and apply custom policies. This technique is helpful in situations where none of the built-in policies apply or where you need more granularity.
86+
In addition to the new built-in policies described above, you can create and apply custom policies. This technique is helpful in situations where none of the built-in policies apply or where you need more granularity.
6687

6788
Learn how to create custom policies:
6889
- [Tutorial: Create and manage policies to enforce compliance](../governance/policy/tutorials/create-and-manage.md).
6990
- [Tutorial: Create a custom policy definition](../governance/policy/tutorials/create-custom-policy-definition.md).
7091

7192
## Next steps
7293

73-
See the following articles:
7494
- [How to use the Lab Services should restrict allowed virtual machine SKU sizes Azure policy](how-to-use-restrict-allowed-virtual-machine-sku-sizes-policy.md)
75-
- [Built-in Policies](../governance/policy/samples/built-in-policies.md#lab-services)
95+
- [Built-in policies for Azure Lab Services](./policy-reference.md)
7696
- [What is Azure policy?](../governance/policy/overview.md)

‎articles/lab-services/policy-reference.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
title: Built-in policy definitions for Lab Services
3+
description: Lists Azure Policy built-in policy definitions for Azure Lab Services. These built-in policy definitions provide common approaches to managing your Azure resources.
4+
ms.date: 11/08/2022
5+
ms.topic: reference
6+
author: ntrogh
7+
ms.author: nicktrog
8+
ms.service: lab-services
9+
ms.custom: subject-policy-reference
10+
---
11+
# Azure Policy built-in definitions for Azure Lab Services
12+
13+
This page is an index of [Azure Policy](../governance/policy/overview.md) built-in policy
14+
definitions for Azure Lab Services. For additional Azure Policy built-ins for other services, see
15+
[Azure Policy built-in definitions](../governance/policy/samples/built-in-policies.md).
16+
17+
The name of each built-in policy definition links to the policy definition in the Azure portal. Use
18+
the link in the **Version** column to view the source on the
19+
[Azure Policy GitHub repo](https://github.com/Azure/azure-policy).
20+
21+
## Azure Lab Services
22+
23+
[!INCLUDE [azure-policy-reference-rp-lab-services](../../includes/policy/reference/byrp/microsoft.labservices.md)]
24+
25+
## Next steps
26+
27+
- See the built-ins on the [Azure Policy GitHub repo](https://github.com/Azure/azure-policy).
28+
- Review the [Azure Policy definition structure](../governance/policy/concepts/definition-structure.md).
29+
- Review [Understanding policy effects](../governance/policy/concepts/effects.md).

0 commit comments

Comments
 (0)