(gentle music)
Coming up, you're going to have a look
at how you can meet governance compliance
and organizational standards using Azure policy
for your apps, data and infrastructure.
I'm here with Ryan Willis from the Azure management team.
And today we're gonna talk about
how you can leverage Azure Arc
to apply policies to manage governance
and regulatory compliance standards directly from Azure.
So, Ryan, what can you tell us a little bit
about how Azure Arc can help you,
can help us with that?
Definitely.
So Azure policies are really fundamental part
of Azure Resource Manager
and every resource that resource manager is aware of.
So when you create a virtual machine in Azure
you can use policy to make sure
that people are creating machines
that are connected to the right networks
and aren't too big and too costly.
And so the real benefit for hybrid machines
with Azure Arc is that since Arc puts these resources,
whether it's Kubernetes, cluster SQL server
or Windows Linux server into Azure Resource Manager
it becomes in scope for Azure policy.
And so that's gonna open up a lot of opportunities
for you to make a centralized
like uniform compliance portal to see
how are my machines configured?
Are they meeting our internal
and regulatory compliance policies?
And which policies in general are most least compliant?
it's just a, it makes it a whole lot easier
for you as a central IT organization to get an understanding
of what's happening across your enterprise.
Now, this is awesome
because when I talk to customers a lot
especially when they move from
like a on-prem only environment
to a hybrid environment where they manage servers
and other parts of their infrastructure in Azure
but also at other cloud providers at their edge locations,
they start to use like group policies back in the days.
And now obviously they need something
which can a little bit more expand
because not like every server and every system
can take it like is connected to an active directory.
Yeah, definitely.
And also not every system runs Windows.
So there's often security concerns
about how your Linux machines are set up as well.
There's also kind of the metadata level of compliance things
like making sure that people have assigned the cost
on their tags to each of their resources.
So a lot of different things that people
are trying to collect data on.
And we built a really flexible platform
that can handle compliance both inside a Kubernetes cluster
or windows server looking at individual settings there,
as well as kind of at that metadata level
in Azure Resource Manager.
Oh, that is pretty cool,
because I spoke to a lot of,
like people who are in charge of compliance and security
and obviously they wanna leverage these capabilities
which is delivered by Azure and Azure Arc
in their environment to see if their compliance,
how is their state.
And I know that we have a couple of awesome features there
how we can actually do that.
So can you show us and tell us,
little bit more about that?
Yeah, let's take a look at a demo.
All right, so we are here in the Azure portal
on the policy page where you're kind of seeing an overview
of the current compliance status
for all the policies in the subscription that I'm managing.
So you'll see here, 75% of all the resources
I have are compliant.
Every policy, it applies to them checked out
but 25% need some help.
So let's go take a look deeper on the compliance tab
that all the policies we've assigned.
You'll see here, there's tons of policies.
They can cover really broad things
or they might be very specific.
For example, there's one here about making sure
that our IIS web servers running on windows, use TLS 1.2.
That's important from a security standpoint.
So let's drill in and take a look at
which servers are noncompliant.
For this specific policy,
we have three servers that are in scope
two of which are noncompliant, one of which is compliant.
And if we look into the details of this first server here
and click through to understand why it's not compliant
we'll be able to get some information
about what is actually happening to this machine.
Great, so now that this is loaded,
let's look at this reason over here
and you'll see that I've actually configured this machine
to not use any TLS or SSL protocols.
So this is a very non-compliant machine.
But all that information is provided here
for me to understand and go back
to the owner of that machine
and say, hey, you gotta fix that.
We also have a machine here that runs a database server
and might've been repurposed or something,
but it's currently not actually running IIS
but it got flagged by this policy anyways.
And we have a solution for that.
You can go through and create exemptions
if you have a machine which is known to be vulnerable
or non-compliant and you need to just
give it a temporary exemption for that
or it can be permanent if something was just misclassified
and is coming up as in scope, when it really shouldn't be.
So I'll just mark here
that this is no longer a public facing web server.
So that the next time we look at compliance,
this machine won't show up as noncompliant.
So, it's a nice platform here that I can go one place
and see all of my compliance data
for these servers settings across Azure,
other clouds and on Prem.
But let's also take a look at policies
that work at the Azure level.
So the previous policy was looking at OS settings,
but this one here enable Azure monitor for a VMs,
is saying, in order for our organization
to properly monitor all of our resources,
we wanna make sure we automatically
deploy the monitoring agent to every server.
Here, we see that there are a couple of servers
that did not have the monitoring agent installed.
So we can go and create a remediation task where we say,
here are my Linux, I policy that deploys
the Linux monitoring agents to those Linux servers.
And I'm gonna go and double check
that all these servers do not currently have it installed.
And if they don't, we'll automatically push out an extension
with that agent and configuration to those servers.
So that's a really nice way to help kind of automate things
in Azure as well, and get the compliance reporting
out of whether or not the automation was successful
and these machines are properly protected.
So let's take a look at definitions now.
There's a ton of built-in definitions in Azure
to help you get started with policy.
We've got everything from operational things
like checking up certificates are expiring
to security and regulatory compliance.
So if you're held to a specific regulatory standard,
you can go and assign
some of these benchmarks to your Azure subscription
so that you get some monitoring on some of the key controls
that your auditor might be curious about.
You'll also see a similar experience for this
in Azure security center,
if you prefer to use that interface.
You can also create your own policies.
So if there's something that you wanna monitor
with compliance, and it's not already available,
you can offer your own
using a very easy to use JSON format.
And if you have existing group policies and you want to go
and actually convert those to Azure policy
so you get centralized reporting
for both domain joined and non domain joined servers,
then you can actually convert your group policies
into Azure policies, upload them here
and assign it to those machines, which should be in scope.
So that's a great option if you've already invested
in things like your own internal baselines
or maybe some custom settings for specific applications
and you don't wanna have to recreate that yourself,
just convert, upload, assign, and off you go.
Now, this is awesome.
You showed so many awesome things right now.
It's just that we need to quickly recap
what you just showed me.
So, first of all,
you can obviously leverage Azure policy to like make sure
that your Azure environment is configured in the right way.
And with Azure guests, Azure policy guests configuration
we can do that for the operating systems
running inside Azure, virtual machines.
And now with Azure Arc,
we can basically take that and extend this
to machines running outside of Azure.
And I think one of the coolest things you just showed me
was also that we already have definitions out there
and policies for you out there
built in, into the Azure platform
which I just can go in and get started with it.
Absolutely, yep.
And it's not only limited to servers as well.
So if you're running like Kubernetes Clusters
you can set up policies to make sure that
your Kubernetes containers
are not exposing ports they shouldn't,
or are using approved images.
it's a really flexible platform
and it's designed to work any resource
that works with Azure Resource Manager.
So if I'm in security and compliance,
I really have the chance to really get, first of all,
the overview about my environment, what is going on.
I don't need to like check every resource.
I really get that overview.
And I can also assign my policy
I want to have like making sure that inside my organization
everything is compliant.
Yep.
So one thing I want to talk about
is now for IT pros, right?
So I obviously we had to look at it
now as a like responsible for compliance,
I have this overview about my environment.
Now, I know that with Azure Resource Manager and Azure Arc
we also get role-based access control.
So for example, not every admin, obviously
has access to the full view
of Azure policy and all of the subscriptions.
How will they basically now leverage these policies
and how can they make sure that their servers
in this example are configured and compliant?
Yeah, great question.
Let's take a look at a demo here.
So I'm pulling up the Azure portal again
but this time we'll actually had into an Arc server.
And the similar experience exists for Kubernetes
as well as Azure resources.
But when you open up the server on the left side
in the navigation tab, you'll see one that says policy.
Now the view here is pretty much identical
to what we just showed for the organization wide view.
But the policies you see are scoped
to just those that are applicable to this machine.
So you'll get a quick view as an it pro
as to what you're being measured on
and how you're currently doing
for each of these areas of compliance.
So if you need to drill into one of these
you can go and figure out again, why am I compliant or not?
And you could of course use this information in preparation
for your next audit, so that when it comes time to measure
whether or not your servers are ready,
you'll already have a good idea
that they're regularly updated
every single day with the latest information.
Pretty cool.
Again, I really feel that this really
like fits the whole picture where,
like if you're responsible for compliance,
you really can push out these policies.
And if you're a server admin
and you wanna know if you're actually compliant,
it's super easy for you to use Azure Arc
and go to the Azure portal and basically see the policies
which are assigned to my servers and if I'm compliant to it.
So you also mentioned, I think that, like, obviously,
if I already have group policies in my environment,
there is a way to actually convert these to Azure policies.
So I think that is absolutely a great solution.
And I'm sure we have now a lot of interest from people,
like especially if you're in charge of compliance and security.
So where would people go to learn more about this?
So we have some documentation
in the Azure Arc docs on how to get started with policy.
Look for some quick starts and tutorials there.
There's also a few examples
on the Azure, our jumpstart repo.
And if you actually go to the Azure policy section
in the portal, there is a getting started section
which has six recommended policies to get started with
which cover things like tag governance,
enable Azure monitor for VMs like I demonstrated,
and a few others.
So definitely check those out.
They'll help you get started.
And from there, you can learn the skills you need
to expand, to cover everything
you're trying to measure compliance of.
Thank you very much, Ryan.
This was really helpful.
And for you who are watching,
if you wanna learn more about hybrid architectures
and Azure Arc and how you can build your cloud environment,
check out the cloud adoption framework
in our Azure Architecture center.
(gentle music)