Skip to content

Commit 0269ee1

Browse files
author
Azure Policy Bot
committed
Built-in Policy Release 5ee9af9d
1 parent f5783b7 commit 0269ee1

File tree

7 files changed

+240
-19
lines changed

7 files changed

+240
-19
lines changed

‎built-in-policies/policyDefinitions/Cache/RedisCache_DisableAccessKeysAuth_Audit.json

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"properties": {
3+
"displayName": "Azure Cache for Redis should not use access keys for authentication",
4+
"policyType": "BuiltIn",
5+
"mode": "Indexed",
6+
"description": "Not using local authentication methods like access keys and using more secure alternatives like Microsoft Entra ID (recommended) improves security for your Azure Cache for Redis. Learn more at aka.ms/redis/disableAccessKeyAuthentication",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "Cache"
10+
},
11+
"version": "1.0.0",
12+
"parameters": {
13+
"effect": {
14+
"type": "String",
15+
"defaultValue": "Audit",
16+
"allowedValues": [
17+
"Audit",
18+
"Deny",
19+
"Disabled"
20+
],
21+
"metadata": {
22+
"displayName": "Effect",
23+
"description": "Enable or disable the execution of the policy"
24+
}
25+
}
26+
},
27+
"policyRule": {
28+
"if": {
29+
"allOf": [
30+
{
31+
"field": "type",
32+
"equals": "Microsoft.Cache/Redis"
33+
},
34+
{
35+
"field": "Microsoft.Cache/Redis/disableAccessKeyAuthentication",
36+
"equals": "false"
37+
}
38+
]
39+
},
40+
"then": {
41+
"effect": "[parameters('effect')]"
42+
}
43+
},
44+
"versions": [
45+
"1.0.0"
46+
]
47+
},
48+
"id": "/providers/Microsoft.Authorization/policyDefinitions/3827af20-8f80-4b15-8300-6db0873ec901",
49+
"name": "3827af20-8f80-4b15-8300-6db0873ec901"
50+
}

‎built-in-policies/policyDefinitions/Cognitive Services/CustomerManagedKey_Audit.json

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
{
22
"properties": {
3-
"displayName": "Cognitive Services accounts should enable data encryption with a customer-managed key",
3+
"displayName": "Azure AI Services resources should encrypt data at rest with a customer-managed key (CMK)",
44
"policyType": "BuiltIn",
55
"mode": "Indexed",
6-
"description": "Customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data stored in Cognitive Services to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more about customer-managed keys at https://go.microsoft.com/fwlink/?linkid=2121321.",
6+
"description": "Using customer-managed keys to encrypt data at rest provides more control over the key lifecycle, including rotation and management. This is particularly relevant for organizations with related compliance requirements. This is not assessed by default and should only be applied when required by compliance or restrictive policy requirements. If not enabled, the data will be encrypted using platform-managed keys. To implement this, update the 'Effect' parameter in the Security Policy for the applicable scope.",
77
"metadata": {
8-
"version": "2.1.0",
8+
"version": "2.2.0",
99
"category": "Cognitive Services"
1010
},
11-
"version": "2.1.0",
11+
"version": "2.2.0",
1212
"parameters": {
1313
"effect": {
1414
"type": "string",
@@ -31,13 +31,21 @@
3131
},
3232
"defaultValue": [
3333
"CognitiveServices",
34-
"Knowledge",
34+
"ContentSafety",
35+
"ImmersiveReader",
36+
"HealthInsights",
37+
"LUIS.Authoring",
3538
"LUIS",
3639
"QnAMaker",
37-
"TextAnalytics",
38-
"ComputerVision",
39-
"HealthDecisionSupport",
40-
"ImmersiveReader"
40+
"QnAMaker.V2",
41+
"AIServices",
42+
"MetricsAdvisor",
43+
"SpeechTranslation",
44+
"Internal.AllInOne",
45+
"ConversationalLanguageUnderstanding",
46+
"knowledge",
47+
"TranscriptionIntelligence",
48+
"HealthDecisionSupport"
4149
]
4250
}
4351
},
@@ -63,6 +71,7 @@
6371
}
6472
},
6573
"versions": [
74+
"2.2.0",
6675
"2.1.0"
6776
]
6877
},

‎built-in-policies/policyDefinitions/Security Center/ASC_Azure_Defender_AI_DINE.json

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"properties": {
3+
"displayName": "Enable threat protection for AI workloads",
4+
"policyType": "BuiltIn",
5+
"mode": "All",
6+
"description": "Microsoft threat protection for AI workloads provides contextualized, evidence-based security alerts aimed at protecting home grown Generative AI powered applications",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "Security Center"
10+
},
11+
"version": "1.0.0",
12+
"parameters": {
13+
"effect": {
14+
"type": "string",
15+
"defaultValue": "DeployIfNotExists",
16+
"metadata": {
17+
"displayName": "Effect",
18+
"description": "Enable or disable the execution of the policy"
19+
},
20+
"allowedValues": [
21+
"DeployIfNotExists",
22+
"Disabled"
23+
]
24+
}
25+
},
26+
"policyRule": {
27+
"if": {
28+
"field": "type",
29+
"equals": "Microsoft.Resources/subscriptions"
30+
},
31+
"then": {
32+
"effect": "[parameters('effect')]",
33+
"details": {
34+
"type": "Microsoft.Security/pricings",
35+
"name": "AI",
36+
"deploymentScope": "subscription",
37+
"existenceScope": "subscription",
38+
"roleDefinitionIds": [
39+
"/providers/Microsoft.Authorization/roleDefinitions/fb1c8493-542b-48eb-b624-b4c8fea62acd"
40+
],
41+
"existenceCondition": {
42+
"field": "Microsoft.Security/pricings/pricingTier",
43+
"equals": "Standard"
44+
},
45+
"deployment": {
46+
"location": "westeurope",
47+
"properties": {
48+
"mode": "incremental",
49+
"parameters": {},
50+
"template": {
51+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
52+
"contentVersion": "1.0.0.0",
53+
"parameters": {},
54+
"variables": {},
55+
"resources": [
56+
{
57+
"type": "Microsoft.Security/pricings",
58+
"apiVersion": "2023-01-01",
59+
"name": "AI",
60+
"properties": {
61+
"pricingTier": "Standard"
62+
}
63+
}
64+
],
65+
"outputs": {}
66+
}
67+
}
68+
}
69+
}
70+
}
71+
},
72+
"versions": [
73+
"1.0.0"
74+
]
75+
},
76+
"id": "/providers/Microsoft.Authorization/policyDefinitions/7e92882a-2f8a-4991-9bc4-d3147d40abb0",
77+
"name": "7e92882a-2f8a-4991-9bc4-d3147d40abb0"
78+
}

‎built-in-policies/policySetDefinitions/Azure Government/Security Center/AzureSecurityCenter.json

Lines changed: 45 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44
"policyType": "BuiltIn",
55
"description": "The Microsoft cloud security benchmark initiative represents the policies and controls implementing security recommendations defined in Microsoft cloud security benchmark, see https://aka.ms/azsecbm. This also serves as the Microsoft Defender for Cloud default policy initiative. You can directly assign this initiative, or manage its policies and compliance results within Microsoft Defender for Cloud.",
66
"metadata": {
7-
"version": "47.22.0",
7+
"version": "47.24.0",
88
"category": "Security Center"
99
},
10-
"version": "47.22.0",
10+
"version": "47.24.0",
1111
"policyDefinitionGroups": [
1212
{
1313
"name": "Azure_Security_Benchmark_v3.0_NS-1",
@@ -513,6 +513,18 @@
513513
"description": "Enable or disable reporting of system updates"
514514
}
515515
},
516+
"systemUpdatesAutoAssessmentModeEffect": {
517+
"type": "string",
518+
"defaultValue": "Audit",
519+
"allowedValues": [
520+
"Audit",
521+
"Disabled"
522+
],
523+
"metadata": {
524+
"displayName": "Machines should be configured to periodically check for missing system updates",
525+
"description": "Enable or disable monitoring of assessment mode"
526+
}
527+
},
516528
"systemConfigurationsMonitoringEffect": {
517529
"type": "string",
518530
"defaultValue": "AuditIfNotExists",
@@ -5159,6 +5171,19 @@
51595171
"Azure_Security_Benchmark_v3.0_PV-6"
51605172
]
51615173
},
5174+
{
5175+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bd876905-5b84-4f73-ab2d-2e7a7c4568d9",
5176+
"definitionVersion": "3.*.*-preview",
5177+
"policyDefinitionReferenceId": "systemUpdatesAutoAssessmentMode",
5178+
"parameters": {
5179+
"effect": {
5180+
"value": "[parameters('systemUpdatesAutoAssessmentModeEffect')]"
5181+
}
5182+
},
5183+
"groupNames": [
5184+
"Azure_Security_Benchmark_v3.0_PV-6"
5185+
]
5186+
},
51625187
{
51635188
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b0f33259-77d7-4c9e-aac6-3aabcfae693c",
51645189
"definitionVersion": "3.*.*",
@@ -6705,6 +6730,22 @@
67056730
"Azure_Security_Benchmark_v3.0_NS-2"
67066731
]
67076732
},
6733+
{
6734+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1b4d1c4e-934c-4703-944c-27c82c06bebb",
6735+
"definitionVersion": "1.*.*",
6736+
"policyDefinitionReferenceId": "diagnosticLogsInAzureAIServicesResourcesShouldBeEnabledMonitoring",
6737+
"groupNames": [
6738+
"Azure_Security_Benchmark_v3.0_LT-3"
6739+
]
6740+
},
6741+
{
6742+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d6759c02-b87f-42b7-892e-71b3f471d782",
6743+
"definitionVersion": "1.*.*",
6744+
"policyDefinitionReferenceId": "azureAIServicesResourcesShouldUseAzurePrivateLinkMonitoring",
6745+
"groupNames": [
6746+
"Azure_Security_Benchmark_v3.0_NS-2"
6747+
]
6748+
},
67086749
{
67096750
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ef619a2c-cc4d-4d03-b2ba-8c94a834d85b",
67106751
"definitionVersion": "1.*.*",
@@ -7115,6 +7156,8 @@
71157156
}
71167157
],
71177158
"versions": [
7159+
"47.24.0",
7160+
"47.23.0",
71187161
"47.22.0",
71197162
"47.21.0",
71207163
"47.20.0",

‎built-in-policies/policySetDefinitions/Regulatory Compliance/MCfS_Sovereignty_Baseline_Confidential_Policies.json

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
"policyType": "BuiltIn",
55
"description": "The Microsoft Cloud for Sovereignty recommends confidential policies to help organizations achieve their sovereignty goals by default denying the creation of resources outside of approved regions, denying resources that are not backed by Azure Confidential Computing, and denying data storage resources that are not using Customer-Managed Keys. More details can be found here: https://aka.ms/SovereigntyBaselinePolicies",
66
"metadata": {
7-
"version": "1.0.0-preview",
7+
"version": "1.0.1-preview",
88
"category": "Regulatory Compliance",
99
"preview": true
1010
},
11-
"version": "1.0.0-preview",
11+
"version": "1.0.1-preview",
1212
"policyDefinitionGroups": [
1313
{
1414
"additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/MCfS_Sovereignty_Baseline_Policy_SO.1",
@@ -360,7 +360,7 @@
360360
],
361361
"defaultValue": [],
362362
"metadata": {
363-
"description": "Any non-global resources attempted to be deployed outsize of this region will be",
363+
"description": "Any non-global resources attempted to be deployed outsize of this region will be blocked by default.",
364364
"displayName": "The list of Azure regions that are approved for usage",
365365
"strongType": "location"
366366
},
@@ -579,6 +579,7 @@
579579
}
580580
],
581581
"versions": [
582+
"1.0.1-PREVIEW",
582583
"1.0.0-PREVIEW"
583584
]
584585
},

‎built-in-policies/policySetDefinitions/Regulatory Compliance/MCfS_Sovereignty_Baseline_Global_Policies.json

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,18 @@
55
"description": "The Microsoft Cloud for Sovereignty recommends global policies to help organizations achieve their sovereignty goals by default denying the creation of resources outside of approved regions. More details can be found here: https://aka.ms/SovereigntyBaselinePolicies",
66
"metadata": {
77
"category": "Regulatory Compliance",
8-
"version": "1.0.0-preview",
8+
"version": "1.1.0-preview",
99
"preview": true
1010
},
11-
"version": "1.0.0-preview",
11+
"version": "1.1.0-preview",
1212
"policyDefinitionGroups": [
1313
{
1414
"additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/MCfS_Sovereignty_Baseline_Policy_SO.1",
1515
"name": "SO.1 - Data Residency"
16+
},
17+
{
18+
"additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/MCfS_Sovereignty_Baseline_Policy_SO.5",
19+
"name": "SO.5 - Trusted Launch"
1620
}
1721
],
1822
"parameters": {
@@ -88,7 +92,7 @@
8892
],
8993
"defaultValue": [],
9094
"metadata": {
91-
"description": "Any non-global resources attempted to be deployed outsize of this region will be.",
95+
"description": "Any non-global resources attempted to be deployed outsize of this region will be blocked by default.",
9296
"displayName": "The list of Azure regions that are approved for usage",
9397
"strongType": "location"
9498
},
@@ -137,9 +141,28 @@
137141
},
138142
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0473574d-2d43-4217-aefe-941fcdf7e684",
139143
"policyDefinitionReferenceId": "AllowedLocationsForAzureCosmosDB"
144+
},
145+
{
146+
"definitionVersion": "1.*.*",
147+
"groupNames": [
148+
"SO.5 - Trusted Launch"
149+
],
150+
"parameters": {},
151+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b03bb370-5249-4ea4-9fce-2552e87e45fa",
152+
"policyDefinitionReferenceId": "SupportTrustedLaunchVmImages"
153+
},
154+
{
155+
"definitionVersion": "1.*.*",
156+
"groupNames": [
157+
"SO.5 - Trusted Launch"
158+
],
159+
"parameters": {},
160+
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c95b54ad-0614-4633-ab29-104b01235cbf",
161+
"policyDefinitionReferenceId": "EnableTrustedLaunchVmImages"
140162
}
141163
],
142164
"versions": [
165+
"1.1.0-PREVIEW",
143166
"1.0.0-PREVIEW"
144167
]
145168
},

0 commit comments

Comments
 (0)