Chapter 5
Azure policies are the best way to ensure resources are configured as you need. The use of virtual machine guest policies, in particular, can help govern the operating system's configuration.
To support this, all virtual machines must have the guest extension installed and the following built-in guest policies applied at the relevant management group:
- Windows machines should meet requirements for Windows Firewall Properties
- Audit Windows machines that are not joined to the specified domain
The policy compliance dashboard can be used to report on non-compliant resources.
To enforce tagging, create a tagging initiative with the following built-in policies:
- Require a tag on resource groups
- Inherit a tag from the resource group if missing
Finally, to enforce the VNet, network security group, and storage account on every subscription, create an Azure blueprint with the VNet and network security group added, and a separate blueprint for the storage...
