You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When assigning a built-in policy or initiative definition, it's optional to reference a version. Policy assignments of built-in definitions default to the latest version and automatically inherit minor version changes unless otherwise specified.
Copy file name to clipboardExpand all lines: articles/governance/policy/assign-policy-azurecli.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,6 +12,8 @@ The first step in understanding compliance in Azure is to identify the status of
12
12
13
13
Azure CLI is used to create and manage Azure resources from the command line or in scripts. This guide uses Azure CLI to create a policy assignment and to identify non-compliant resources in your Azure environment.
Copy file name to clipboardExpand all lines: articles/governance/policy/assign-policy-portal.md
+18-10Lines changed: 18 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,14 +1,16 @@
1
1
---
2
2
title: "Quickstart: Create policy assignment using Azure portal"
3
3
description: In this quickstart, you create an Azure Policy assignment to identify non-compliant resources using Azure portal.
4
-
ms.date: 02/29/2024
4
+
ms.date: 07/03/2024
5
5
ms.topic: quickstart
6
6
---
7
7
8
8
# Quickstart: Create a policy assignment to identify non-compliant resources using Azure portal
9
9
10
10
The first step in understanding compliance in Azure is to identify the status of your resources. In this quickstart, you create a policy assignment to identify non-compliant resources using Azure portal. The policy is assigned to a resource group and audits virtual machines that don't use managed disks. After you create the policy assignment, you identify non-compliant virtual machines.
- If you don't have an Azure account, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
@@ -21,11 +23,11 @@ In this quickstart, you create a policy assignment with a built-in policy defini
21
23
1. Sign in to the [Azure portal](https://portal.azure.com).
22
24
1. Search for _policy_ and select it from the list.
23
25
24
-
:::image type="content" source="./media/assign-policy-portal/search-policy.png" alt-text="Screenshot of the Azure portal to search for policy.":::
26
+
:::image type="content" source="./media/assign-policy-portal/search-policy.png" alt-text="Screenshot of the Azure portal to search for policy." lightbox="./media/assign-policy-portal/search-policy.png":::
25
27
26
28
1. Select **Assignments** on the **Policy** pane.
27
29
28
-
:::image type="content" source="./media/assign-policy-portal/select-assignments.png" alt-text="Screenshot of the Assignments pane that highlights the option to Assign policy.":::
30
+
:::image type="content" source="./media/assign-policy-portal/select-assignments.png" alt-text="Screenshot of the Assignments pane that highlights the option to Assign policy." lightbox="./media/assign-policy-portal/select-assignments.png":::
29
31
30
32
1. Select **Assign Policy** from the **Policy Assignments** pane.
31
33
@@ -35,21 +37,27 @@ In this quickstart, you create a policy assignment with a built-in policy defini
35
37
| ---- | ---- |
36
38
|**Scope**| Use the ellipsis (`...`) and then select a subscription and a resource group. Then choose **Select** to apply the scope. |
37
39
|**Exclusions**| Optional and isn't used in this example. |
38
-
|**Policy definition**| Select the ellipsis to open the list of available definitions. |
39
-
|**Available Definitions**| Search the policy definitions list for _Audit VMs that do not use managed disks_ definition, select the policy, and select **Add**. |
40
+
|**Resource selectors**| Skip resource selectors for this example. Resource selectors let you refine the resources affected by the policy assignment. |
41
+
|**Policy definition**| Select the ellipsis (`...`) to open the list of available definitions. |
42
+
|**Available Definitions**| Search the policy definitions list for _Audit VMs that do not use managed disks_ definition, select the policy, and select **Add**. There's a column that shows the latest version of the definition. |
43
+
|**Version (preview)**| Accept the version in format `1.*.*` to ingest major, minor, and patch versions. <br/><br/> Select the ellipsis (`...`) to view available versions and the options to enroll in minor version updates or preview versions. You must select a version to change the options. For more information, go to [definition version within assignment](./concepts/assignment-structure.md#policy-definition-id-and-version-preview). |
40
44
|**Assignment name**| By default uses the name of the selected policy. You can change it but for this example, use the default name. |
41
45
|**Description**| Optional to provide details about this policy assignment. |
42
46
|**Policy enforcement**| Defaults to _Enabled_. For more information, go to [enforcement mode](./concepts/assignment-structure.md#enforcement-mode). |
43
-
|**Assigned by**| Defaults to who is signed in to Azure. This field is optional and custom values can be entered. |
44
47
45
-
:::image type="content" source="./media/assign-policy-portal/select-available-definition.png" alt-text="Screenshot of filtering the available definitions.":::
48
+
:::image type="content" source="./media/assign-policy-portal/select-available-definition.png" alt-text="Screenshot of the policy assignment and available definitions that highlights policy version." lightbox="./media/assign-policy-portal/select-available-definition.png":::
49
+
50
+
1. After a Policy definition is selected, you can change the **Version (preview)** options.
51
+
52
+
For example, if you select the options shown in the image, the **Version (preview)** is changed to `1.0.*`.
53
+
54
+
:::image type="content" source="./media/assign-policy-portal/select-version.png" alt-text="Screenshot of the policy definition version options to enroll in minor or preview versions." lightbox="./media/assign-policy-portal/select-version.png":::
46
55
47
-
1. Select **Next** to view each tab for **Advanced**, **Parameters**, and **Remediation**. No changes are needed for this example.
56
+
1. Select **Next** to view each tab for **Parameters** and **Remediation**. No changes are needed for this example.
48
57
49
58
| Tab name | Options |
50
59
| ---- | ---- |
51
-
|**Advanced**| Includes options for [resource selectors](./concepts/assignment-structure.md#resource-selectors) and [overrides](./concepts/assignment-structure.md#overrides). |
52
-
|**Parameters**| If the policy definition you selected on the **Basics** tab included parameters, they're configured on **Parameters** tab. This example doesn't use parameters. |
60
+
|**Parameters**| If the policy definition you selected on the **Basics** tab has parameters, you configure them on the **Parameters** tab. This example doesn't use parameters. |
53
61
|**Remediation**| You can create a managed identity. For this example, **Create a Managed Identity** is unchecked. <br><br> This box _must_ be checked when a policy or initiative includes a policy with either the [deployIfNotExists](./concepts/effects.md#deployifnotexists) or [modify](./concepts/effects.md#modify) effect. For more information, go to [managed identities](../../active-directory/managed-identities-azure-resources/overview.md) and [how remediation access control works](./how-to/remediate-resources.md#how-remediation-access-control-works). |
54
62
55
63
1. Select **Next** and on the **Non-compliance messages** tab create a **Non-compliance message** like _Virtual machines should use managed disks_.
Copy file name to clipboardExpand all lines: articles/governance/policy/assign-policy-powershell.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,6 +12,8 @@ The first step in understanding compliance in Azure is to identify the status of
12
12
13
13
The Azure PowerShell modules can be used to manage Azure resources from the command line or in scripts. This article explains how to use Azure PowerShell to create a policy assignment.
Copy file name to clipboardExpand all lines: articles/governance/policy/assign-policy-rest-api.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,6 +11,8 @@ The first step in understanding compliance in Azure is to identify the status of
11
11
12
12
This guide uses REST API to create a policy assignment and to identify non-compliant resources in your Azure environment. The examples in this article use PowerShell and the Azure CLI `az rest` commands. You can also run the `az rest` commands from a Bash shell like Git Bash.
Copy file name to clipboardExpand all lines: articles/governance/policy/assign-policy-template.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,6 +17,8 @@ select the **Deploy to Azure** button. The template opens in the Azure portal.
17
17
18
18
:::image type="content" source="~/reusable-content/ce-skilling/azure/media/template-deployments/deploy-to-azure-button.svg" alt-text="Screenshot of the Deploy to Azure button to assign a policy with an Azure Resource Manager template." link="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2Fquickstarts%2Fmicrosoft.authorization%2Fazurepolicy-builtin-vm-managed-disks%2Fazuredeploy.json":::
Copy file name to clipboardExpand all lines: articles/governance/policy/assign-policy-terraform.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,6 +15,8 @@ machines that aren't using managed disks.
15
15
16
16
At the end of this process, you identify virtual machines that aren't using managed disks across subscription. They're _non-compliant_ with the policy assignment.
0 commit comments