Skip to content

Commit

Permalink
Merge branch 'patch-policy-denyaction-uami' of https://github.com/Azu…
Browse files Browse the repository at this point in the history
…re/Enterprise-Scale into patch-policy-denyaction-uami
  • Loading branch information
arjenhuitema committed Jun 6, 2024
2 parents 9d50702 + 9d678d4 commit 3693b8e
Show file tree
Hide file tree
Showing 4 changed files with 7 additions and 7 deletions.
2 changes: 1 addition & 1 deletion docs/wiki/ALZ-Policies.md
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ This management group contains all the platform child management groups, like ma
| **Enable ChangeTracking and Inventory for virtual machine scale sets**\* | **[Preview]: Enable ChangeTracking and Inventory for virtual machine scale sets** | `Policy Definition Set`, **Built-in** | This policy initiative enables ChangeTracking and Inventory for virtual machines scale sets. It uses a Data Collection Rule to define what data to collect and where to send it, and a user-assigned identity to authenticate the Azure Monitor Agent. | DeployIfNotExists, Disabled |
| **Enable ChangeTracking and Inventory for Arc-enabled virtual machines**\* | **[Preview]: Enable ChangeTracking and Inventory for Arc-enabled virtual machines** | `Policy Definition Set`, **Built-in** | This policy initiative enables ChangeTracking and Inventory for Arc-enabled servers. It uses a Data Collection Rule to define what data to collect and where to send it, and a user-assigned identity to authenticate the Azure Monitor Agent. | DeployIfNotExists, Disabled |
| **Enable Defender for SQL on SQL VMs and Arc-enabled SQL Servers**\* | **Configure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace** | `Policy Definition Set`, **Built-in** | This policy initiative enables Microsoft Defender for SQL and AMA on SQL VMs and Arc-enabled SQL Servers. | DeployIfNotExists, Disabled |
| **Do not allow deletion of the User Assigned Managed Identity used by AMA**\*| **Do not allow deletion of resource types** | `Policy Definition`, **Custom** | This policy provides a safeguard against accidental removal of the User Assigned Managed Identity used by AMA by blocking delete calls using deny action effect. | DenyAction |
| **Do not allow deletion of the User Assigned Managed Identity used by AMA**\*| **Do not allow deletion of specified resource and resource type** | `Policy Definition`, **Custom** | This policy provides a safeguard against accidental removal of the User Assigned Managed Identity used by AMA by blocking delete calls using deny action effect. | DenyAction |

> \* The AMA policies and initiatives are in effect for the portal implementation only. Terraform and Bicep will adopt these policies in the near future.
Expand Down
4 changes: 2 additions & 2 deletions docs/wiki/Whats-new.md
Original file line number Diff line number Diff line change
Expand Up @@ -47,9 +47,9 @@ Here's what's changed in Enterprise Scale/Azure Landing Zones:

### June 2024

#### Tooling
#### Policy

- Added new custom Policy that provides a safeguard against accidental removal of the User Assigned Managed Identity used by AMA. Assigned at the Platform Management it blocks delete calls using deny action effect.
- Added new custom policy [Do not allow deletion of specified resource and resource type](https://www.azadvertizer.net/azpolicyadvertizer/DenyAction-DeleteResources.html) that provides a safeguard against accidental removal of the User Assigned Managed Identity used by AMA. Assigned at the Platform Management Group, it blocks delete calls using the deny action effect.

### 🆕 AMA Updates

Expand Down
Loading

0 comments on commit 3693b8e

Please sign in to comment.