Merge pull request #95349 from JnHs/jh-policyatscale

New topic and TOC update

Author: American-Dipper

articles/lighthouse/how-to/policy-at-scale.md

@@ -0,0 +1,93 @@
+---
+title: Deploy Azure Policy to delegated subscriptions at scale
+description: Learn how Azure delegated resource management lets you deploy a policy definition and policy assignment across multiple tenants.  
+author: JnHs
+ms.author: jenhayes
+ms.service: lighthouse
+ms.date: 11/8/2019
+ms.topic: overview
+manager: carmonm
+---
+
+# Deploy Azure Policy to delegated subscriptions at scale
+
+As a service provider, you may have onboarded multiple customer tenants for Azure delegated resource management. Azure Lighthouse allows service providers to perform operations at scale across several tenants at once, making management tasks more efficient.
+
+This topic shows you how to use [Azure Policy](https://docs.microsoft.com/azure/governance/policy/) to deploy a policy definition and policy assignment across multiple tenants using PowerShell commands. In this example, the policy definition ensures that storage accounts are secured by allowing only HTTPS traffic.
+
+## Use Azure Resource Graph to query across customer tenants
+
+You can use [Azure Resource Graph](https://docs.microsoft.com/azure/governance/resource-graph/) to query across all subscriptions in the customer tenants that you manage. In this example, we’ll identify any storage accounts in these subscriptions that do not currently require HTTPS traffic.  
+
+```powershell
+$MspTenant = "insert your managing tenantId here"
+
+$subs = Get-AzSubscription
+
+$ManagedSubscriptions = Search-AzGraph -Query "ResourceContainers | where type == 'microsoft.resources/subscriptions' | where tenantId != '$($mspTenant)' | project name, subscriptionId, tenantId" -subscription $subs.subscriptionId
+
+Search-AzGraph -Query "Resources | where type =~ 'Microsoft.Storage/storageAccounts' | project name, location, subscriptionId, tenantId, properties.supportsHttpsTrafficOnly" -subscription $ManagedSubscriptions.subscriptionId | convertto-json
+```
+
+## Deploy a policy across multiple customer tenants
+
+The example below shows how to use an [Azure Resource Manager template](https://github.com/Azure/Azure-Lighthouse-samples/blob/master/Azure-Delegated-Resource-Management/templates/policy-enforce-https-storage/enforceHttpsStorage.json) to deploy a policy definition and policy assignment across delegated subscriptions in multiple customer tenants. This policy definition requires all storage accounts to use HTTPS traffic, preventing the creation of any new storage accounts that don’t comply and marking existing storage accounts without the setting as non-compliant.
+
+```powershell
+Write-Output "In total, there are $($ManagedSubscriptions.Count) delegated customer subscriptions to be managed"
+
+foreach ($ManagedSub in $ManagedSubscriptions)
+{
+    Select-AzSubscription -SubscriptionId $ManagedSub.subscriptionId
+
+    New-AzDeployment -Name mgmt `
+                     -Location eastus `
+                     -TemplateUri "https://raw.githubusercontent.com/Azure/Azure-Lighthouse-samples/master/Azure-Delegated-Resource-Management/templates/policy-enforce-https-storage/enforceHttpsStorage.json" `
+                     -AsJob
+}
+```
+
+## Validate the policy deployment
+
+After you’ve deployed the Azure Resource Manager template, you can confirm that the policy definition was successfully applied by attempting to create a storage account with **EnableHttpsTrafficOnly** set to **false** in one of your delegated subscriptions. Because of the policy assignment, you should be unable to create this storage account.  
+
+```powershell
+New-AzStorageAccount -ResourceGroupName (New-AzResourceGroup -name policy-test -Location eastus -Force).ResourceGroupName `
+                     -Name (get-random) `
+                     -Location eastus `
+                     -EnableHttpsTrafficOnly $false `
+                     -SkuName Standard_LRS `
+                     -Verbose                  
+```
+
+## Clean up resources
+
+When you’re finished, remove the policy definition and assignment created by the deployment.
+
+```powershell
+foreach ($ManagedSub in $ManagedSubscriptions)
+{
+    select-azsubscription -subscriptionId $ManagedSub.subscriptionId
+
+    Remove-AzDeployment -Name mgmt -AsJob
+
+    $Assignment = Get-AzPolicyAssignment | where-object {$_.Name -like "enforce-https-storage-assignment"}
+
+    if ([string]::IsNullOrEmpty($Assignment))
+    {
+        Write-Output "Nothing to clean up - we're done"
+    }
+    else
+    {
+
+    Remove-AzPolicyAssignment -Name 'enforce-https-storage-assignment' -Scope "/subscriptions/$($ManagedSub.subscriptionId)" -Verbose
+
+    Write-Output "Deployment has been deleted - we're done"
+    }
+}
+```
+
+## Next steps
+
+- Learn about [Azure Policy](https://docs.microsoft.com/azure/governance/policy/).
+- Learn about [cross-tenant management experiences](../concepts/cross-tenant-management-experience.md).

articles/lighthouse/toc.yml

@@ -13,10 +13,10 @@
 - name: Concepts
   items:
   - name: Azure delegated resource management
-    displayName: delegation
+    displayName: delegation, projection
     href: ./concepts/azure-delegated-resource-management.md
   - name: Cross-tenant management experiences
-    displayName: scenarios
+    displayName: scenarios, supported, enhanced, services, limitations, current
     href: ./concepts/cross-tenant-management-experience.md
   - name: Tenants, roles, and users
     displayName: Azure AD, Azure Active Directory
@@ -39,16 +39,22 @@
     displayName: resource management
     href: ./how-to/onboard-customer.md
   - name: Publish Managed Services offers to Azure Marketplace 
-    displayName: managed services offer, azure marketplace, publish
+    displayName: managed services offer, azure marketplace, publish, marketplace
     href: ./how-to/publish-managed-services-offers.md
   - name: View and manage customers 
-    displayName: managed services offer, azure marketplace, publish
+    displayName: my customers
     href: ./how-to/view-manage-customers.md
   - name: View and manage service providers 
-    displayName: managed services offer, azure marketplace, publish
+    displayName: customer, update
     href: ./how-to/view-manage-service-providers.md
-  - name: Deploy a policy that can be remediated
-    href: ./how-to/deploy-policy-remediation.md
+  - name: Azure Policy integration
+    items:
+    - name: Deploy a policy at scale
+      displayName: storage
+      href: ./how-to/policy-at-scale.md
+    - name: Deploy a policy that can be remediated
+      displayName: deployIfNotExists, modify, managed identities, managed identity
+      href: ./how-to/deploy-policy-remediation.md
 - name: Reference
   items:
   - name: Azure CLI