Skip to content

Commit fd2f785

Browse files
TrishaMcTrishaMc
authored
Merge pull request #63813 from DCtheGeek/dmc-policy-az
Converting AzureRM to Az
2 parents eb8d9a6 + 31e18a0 commit fd2f785

File tree

60 files changed

+314
-301
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+314
-301
lines changed

‎articles/governance/policy/assign-policy-azurecli.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Use Azure CLI to create an Azure Policy assignment to identify non-
44
services: azure-policy
55
author: DCtheGeek
66
ms.author: dacoulte
7-
ms.date: 12/06/2018
7+
ms.date: 01/23/2019
88
ms.topic: quickstart
99
ms.service: azure-policy
1010
manager: carmonm
@@ -71,11 +71,11 @@ To view the resources that aren't compliant under this new assignment, get the p
7171
by running the following commands:
7272

7373
```azurepowershell-interactive
74-
$policyAssignment = Get-AzureRmPolicyAssignment | Where-Object { $_.Properties.DisplayName -eq 'Audit VMs without managed disks Assignment' }
74+
$policyAssignment = Get-AzPolicyAssignment | Where-Object { $_.Properties.DisplayName -eq 'Audit VMs without managed disks Assignment' }
7575
$policyAssignment.PolicyAssignmentId
7676
```
7777

78-
For more information about policy assignment IDs, see [Get-AzureRMPolicyAssignment](/powershell/module/azurerm.resources/get-azurermpolicyassignment).
78+
For more information about policy assignment IDs, see [Get-AzPolicyAssignment](/powershell/module/az.resources/get-azpolicyassignment).
7979

8080
Next, run the following command to get the resource IDs of the non-compliant resources that are
8181
output into a JSON file:

‎articles/governance/policy/assign-policy-powershell.md

+14-13
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Use Azure PowerShell to create an Azure Policy assignment to identi
44
services: azure-policy
55
author: DCtheGeek
66
ms.author: dacoulte
7-
ms.date: 12/06/2018
7+
ms.date: 01/23/2019
88
ms.topic: quickstart
99
ms.service: azure-policy
1010
manager: carmonm
@@ -17,22 +17,23 @@ this quickstart, you create a policy assignment to identify virtual machines tha
1717
managed disks. When complete, you'll identify virtual machines that are *non-compliant* with the
1818
policy assignment.
1919

20-
The AzureRM PowerShell module is used to create and manage Azure resources from the command line or
21-
in scripts. This guide explains how to use AzureRM to create a policy assignment. The policy
22-
identifies non-compliant resources in your Azure environment.
20+
The Azure PowerShell module is used to create and manage Azure resources from the command line or
21+
in scripts. This guide explains how to use Az to create a policy assignment. The policy identifies
22+
non-compliant resources in your Azure environment.
2323

2424
If you don't have an Azure subscription, create a [free](https://azure.microsoft.com/free/) account
2525
before you begin.
2626

27+
[!INCLUDE [az-powershell-update](../../../includes/updated-for-az.md)]
28+
2729
## Prerequisites
2830

2931
- If you haven't already, install the [ARMClient](https://github.com/projectkudu/ARMClient). It's a tool that sends HTTP requests to Azure Resource Manager-based APIs.
30-
- Before you start, make sure that the latest version of PowerShell is installed. See [How to install and configure Azure PowerShell](/powershell/azureps-cmdlets-docs) for detailed information.
31-
- Update your AzureRM PowerShell module to the latest version. If you need to install or upgrade, see [Install Azure PowerShell module](/powershell/azure/azurerm/install-azurerm-ps).
32+
- Before you start, make sure that the latest version of Azure PowerShell is installed. See [Install Azure PowerShell module](/powershell/azure/install-az-ps) for detailed information.
3233
- Register the Policy Insights resource provider using Azure PowerShell. Registering the resource provider makes sure that your subscription works with it. To register a resource provider, you must have permission to the register resource provider operation. This operation is included in the Contributor and Owner roles. Run the following command to register the resource provider:
3334

3435
```azurepowershell-interactive
35-
Register-AzureRmResourceProvider -ProviderNamespace 'Microsoft.PolicyInsights'
36+
Register-AzResourceProvider -ProviderNamespace 'Microsoft.PolicyInsights'
3637
```
3738

3839
For more information about registering and viewing resource providers, see [Resource Providers and Types](../../azure-resource-manager/resource-manager-supported-services.md)
@@ -46,9 +47,9 @@ in the policy definition.
4647
Run the following commands to create a new policy assignment:
4748

4849
```azurepowershell-interactive
49-
$rg = Get-AzureRmResourceGroup -Name '<resourceGroupName>'
50-
$definition = Get-AzureRmPolicyDefinition | Where-Object { $_.Properties.DisplayName -eq 'Audit VMs that do not use managed disks' }
51-
New-AzureRmPolicyAssignment -Name 'audit-vm-manageddisks' -DisplayName 'Audit VMs without managed disks Assignment' -Scope $rg.ResourceId -PolicyDefinition $definition
50+
$rg = Get-AzResourceGroup -Name '<resourceGroupName>'
51+
$definition = Get-AzPolicyDefinition | Where-Object { $_.Properties.DisplayName -eq 'Audit VMs that do not use managed disks' }
52+
New-AzPolicyAssignment -Name 'audit-vm-manageddisks' -DisplayName 'Audit VMs without managed disks Assignment' -Scope $rg.ResourceId -PolicyDefinition $definition
5253
```
5354

5455
The preceding commands use the following information:
@@ -67,11 +68,11 @@ Use the following information to identify resources that aren't compliant with t
6768
assignment you created. Run the following commands:
6869

6970
```azurepowershell-interactive
70-
$policyAssignment = Get-AzureRmPolicyAssignment | Where-Object { $_.Properties.DisplayName -eq 'Audit VMs without managed disks Assignment' }
71+
$policyAssignment = Get-AzPolicyAssignment | Where-Object { $_.Properties.DisplayName -eq 'Audit VMs without managed disks Assignment' }
7172
$policyAssignment.PolicyAssignmentId
7273
```
7374

74-
For more information about policy assignment IDs, see [Get-AzureRmPolicyAssignment](/powershell/module/azurerm.resources/get-azurermpolicyassignment).
75+
For more information about policy assignment IDs, see [Get-AzPolicyAssignment](/powershell/module/az.resources/get-azpolicyassignment).
7576

7677
Next, run the following command to get the resource IDs of the non-compliant resources that are
7778
output into a JSON file:
@@ -114,7 +115,7 @@ the Azure portal view.
114115
To remove the assignment created, use the following command:
115116

116117
```azurepowershell-interactive
117-
Remove-AzureRmPolicyAssignment -Name 'audit-vm-manageddisks' -Scope '/subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>'
118+
Remove-AzPolicyAssignment -Name 'audit-vm-manageddisks' -Scope '/subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>'
118119
```
119120

120121
## Next steps

‎articles/governance/policy/concepts/definition-structure.md

+9-7
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Describes how resource policy definition is used by Azure Policy to
44
services: azure-policy
55
author: DCtheGeek
66
ms.author: dacoulte
7-
ms.date: 12/12/2018
7+
ms.date: 01/23/2019
88
ms.topic: conceptual
99
ms.service: azure-policy
1010
manager: carmonm
@@ -66,6 +66,8 @@ For example, the following JSON shows a policy that limits where resources are d
6666

6767
All Azure Policy samples are at [Policy samples](../samples/index.md).
6868

69+
[!INCLUDE [az-powershell-update](../../../../includes/updated-for-az.md)]
70+
6971
## Mode
7072

7173
The **mode** determines which resource types will be evaluated for a policy. The supported modes
@@ -371,13 +373,13 @@ Policy, use one of the following methods:
371373
- Azure PowerShell
372374

373375
```azurepowershell-interactive
374-
# Login first with Connect-AzureRmAccount if not using Cloud Shell
376+
# Login first with Connect-AzAccount if not using Cloud Shell
375377
376-
# Use Get-AzureRmPolicyAlias to list available providers
377-
Get-AzureRmPolicyAlias -ListAvailable
378+
# Use Get-AzPolicyAlias to list available providers
379+
Get-AzPolicyAlias -ListAvailable
378380
379-
# Use Get-AzureRmPolicyAlias to list aliases for a Namespace (such as Azure Automation -- Microsoft.Automation)
380-
Get-AzureRmPolicyAlias -NamespaceMatch 'automation'
381+
# Use Get-AzPolicyAlias to list aliases for a Namespace (such as Azure Automation -- Microsoft.Automation)
382+
Get-AzPolicyAlias -NamespaceMatch 'automation'
381383
```
382384

383385
- Azure CLI
@@ -562,4 +564,4 @@ and `productName`. It uses two built-in policies to apply the default tag value.
562564
- Understand how to [programmatically create policies](../how-to/programmatically-create.md)
563565
- Learn how to [get compliance data](../how-to/getting-compliance-data.md)
564566
- Learn how to [remediate non-compliant resources](../how-to/remediate-resources.md)
565-
- Review what a management group is with [Organize your resources with Azure management groups](../../management-groups/overview.md)
567+
- Review what a management group is with [Organize your resources with Azure management groups](../../management-groups/overview.md)

‎articles/governance/policy/concepts/guest-configuration.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn how Azure Policy uses Guest Configuration to audit settings i
44
services: azure-policy
55
author: DCtheGeek
66
ms.author: dacoulte
7-
ms.date: 12/06/2018
7+
ms.date: 01/23/2019
88
ms.topic: conceptual
99
ms.service: azure-policy
1010
manager: carmonm
@@ -51,8 +51,8 @@ To register the resource provider for Guest Configuration through PowerShell, ru
5151
command:
5252

5353
```azurepowershell-interactive
54-
# Login first with Connect-AzureRmAccount if not using Cloud Shell
55-
Register-AzureRmResourceProvider -ProviderNamespace 'Microsoft.GuestConfiguration'
54+
# Login first with Connect-AzAccount if not using Cloud Shell
55+
Register-AzResourceProvider -ProviderNamespace 'Microsoft.GuestConfiguration'
5656
```
5757

5858
### Validation tools

‎articles/governance/policy/how-to/get-compliance-data.md

+28-22
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Azure Policy evaluations and effects determine compliance. Learn ho
44
services: azure-policy
55
author: DCtheGeek
66
ms.author: dacoulte
7-
ms.date: 12/06/2018
7+
ms.date: 01/23/2019
88
ms.topic: conceptual
99
ms.service: azure-policy
1010
manager: carmonm
@@ -33,6 +33,8 @@ updated and the frequency and events that trigger an evaluation cycle.
3333
> Resource Provider is registered and that the user has the appropriate role-based access control
3434
> (RBAC) permissions as described [here](../overview.md#rbac-permissions-in-azure-policy).
3535
36+
[!INCLUDE [az-powershell-update](../../../../includes/updated-for-az.md)]
37+
3638
## Evaluation triggers
3739

3840
The results of a completed evaluation cycle are available in the `Microsoft.PolicyInsights`
@@ -204,9 +206,9 @@ example code. Then replace the $restUri with the string in the examples to retri
204206
that can then be parsed.
205207

206208
```azurepowershell-interactive
207-
# Login first with Connect-AzureRmAccount if not using Cloud Shell
209+
# Login first with Connect-AzAccount if not using Cloud Shell
208210
209-
$azContext = Get-AzureRmContext
211+
$azContext = Get-AzContext
210212
$azProfile = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile
211213
$profileClient = New-Object -TypeName Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient -ArgumentList ($azProfile)
212214
$token = $profileClient.AcquireAccessToken($azContext.Subscription.TenantId)
@@ -360,32 +362,36 @@ For more information about querying policy events, see the [Policy Events](/rest
360362
### Azure PowerShell
361363

362364
The Azure PowerShell module for Policy is available on the PowerShell Gallery as
363-
[AzureRM.PolicyInsights](https://www.powershellgallery.com/packages/AzureRM.PolicyInsights). Using
364-
PowerShellGet, you can install the module using `Install-Module -Name AzureRM.PolicyInsights` (make sure you have the latest [Azure
365-
PowerShell](/powershell/azure/azurerm/install-azurerm-ps) installed):
365+
[Az.PolicyInsights](https://www.powershellgallery.com/packages/Az.PolicyInsights). Using
366+
PowerShellGet, you can install the module using `Install-Module -Name Az.PolicyInsights` (make sure you have the latest [Azure
367+
PowerShell](/powershell/azure/install-az-ps) installed):
366368

367369
```azurepowershell-interactive
368370
# Install from PowerShell Gallery via PowerShellGet
369-
Install-Module -Name AzureRM.PolicyInsights
371+
Install-Module -Name Az.PolicyInsights
370372
371373
# Import the downloaded module
372-
Import-Module AzureRM.PolicyInsights
374+
Import-Module Az.PolicyInsights
373375
374-
# Login with Connect-AzureRmAccount if not using Cloud Shell
375-
Connect-AzureRmAccount
376+
# Login with Connect-AzAccount if not using Cloud Shell
377+
Connect-AzAccount
376378
```
377379

378-
The module has three cmdlets:
380+
The module has the following cmdlets:
379381

380-
- `Get-AzureRmPolicyStateSummary`
381-
- `Get-AzureRmPolicyState`
382-
- `Get-AzureRmPolicyEvent`
382+
- `Get-AzPolicyStateSummary`
383+
- `Get-AzPolicyState`
384+
- `Get-AzPolicyEvent`
385+
- `Get-AzPolicyRemediation`
386+
- `Remove-AzPolicyRemediation`
387+
- `Start-AzPolicyRemediation`
388+
- `Stop-AzPolicyRemediation`
383389

384390
Example: Getting the state summary for the topmost assigned policy with the highest number of
385391
non-compliant resources.
386392

387393
```azurepowershell-interactive
388-
PS> Get-AzureRmPolicyStateSummary -Top 1
394+
PS> Get-AzPolicyStateSummary -Top 1
389395
390396
NonCompliantResources : 15
391397
NonCompliantPolicies : 1
@@ -397,7 +403,7 @@ Example: Getting the state record for the most recently evaluated resource (defa
397403
in descending order).
398404

399405
```azurepowershell-interactive
400-
PS> Get-AzureRmPolicyState -Top 1
406+
PS> Get-AzPolicyState -Top 1
401407
402408
Timestamp : 5/22/2018 3:47:34 PM
403409
ResourceId : /subscriptions/{subscriptionId}/resourceGroups/RG-Tags/providers/Mi
@@ -423,7 +429,7 @@ PolicyDefinitionCategory : tbd
423429
Example: Getting the details for all non-compliant virtual network resources.
424430

425431
```azurepowershell-interactive
426-
PS> Get-AzureRmPolicyState -Filter "ResourceType eq '/Microsoft.Network/virtualNetworks'"
432+
PS> Get-AzPolicyState -Filter "ResourceType eq '/Microsoft.Network/virtualNetworks'"
427433
428434
Timestamp : 5/22/2018 4:02:20 PM
429435
ResourceId : /subscriptions/{subscriptionId}/resourceGroups/RG-Tags/providers/Mi
@@ -450,7 +456,7 @@ Example: Getting events related to non-compliant virtual network resources that
450456
specific date.
451457

452458
```azurepowershell-interactive
453-
PS> Get-AzureRmPolicyEvent -Filter "ResourceType eq '/Microsoft.Network/virtualNetworks'" -From '2018-05-19'
459+
PS> Get-AzPolicyEvent -Filter "ResourceType eq '/Microsoft.Network/virtualNetworks'" -From '2018-05-19'
454460
455461
Timestamp : 5/19/2018 5:18:53 AM
456462
ResourceId : /subscriptions/{subscriptionId}/resourceGroups/RG-Tags/providers/Mi
@@ -476,20 +482,20 @@ PrincipalOid : {principalOid}
476482
```
477483

478484
The **PrincipalOid** field can be used to get a specific user with the Azure PowerShell cmdlet
479-
`Get-AzureRmADUser`. Replace **{principalOid}** with the response you get from the previous
485+
`Get-AzADUser`. Replace **{principalOid}** with the response you get from the previous
480486
example.
481487

482488
```azurepowershell-interactive
483-
PS> (Get-AzureRmADUser -ObjectId {principalOid}).DisplayName
489+
PS> (Get-AzADUser -ObjectId {principalOid}).DisplayName
484490
Trent Baker
485491
```
486492

487493
## Log Analytics
488494

489495
If you have a [Log Analytics](../../../log-analytics/log-analytics-overview.md) workspace with the
490496
`AzureActivity` solution tied to your subscription, you can also view non-compliance results from
491-
the evaluation cycle using simple Kusto queries and the `AzureActivity` table. With details in Log
492-
Analytics, alerts can be configured to watch for non-compliance.
497+
the evaluation cycle using simple Azure Data Explorer queries and the `AzureActivity` table. With
498+
details in Log Analytics, alerts can be configured to watch for non-compliance.
493499

494500
![Policy Compliance using Log Analytics](../media/getting-compliance-data/compliance-loganalytics.png)
495501

0 commit comments

Comments
 (0)