Module lab — Azure Policy in depth: safe rollout, exemptions, Modify and DeployIfNotExists remediation, count rules
لاب الدرس — Azure Policy بعمق: Rollout آمن، Exemptions، Remediation بالـ Modify والـ DeployIfNotExists، وقواعد بالـ count
Contoso's platform team owns the resource group rg-x2-pol (tag costCenter=CC-1001 ). It already contains a storage account without tags ( stx2legacy01 ), an NSG created years ago that opens SSH to the internet ( nsg-x2-legacy ) and a Log Analytics workspace ( law-x2 ). You will roll out governance the way a senior admin does it: first in audit-only mode, then enforced with a documented exemption, then auto-fixing tags with Modify , deploying diagnostic settings with DeployIfNotExists (including the evaluation delay and a remediation task for existing resources), and finally writing a custom definition that uses an alias with count . Two files are waiting in your Cloud Shell home: x2-nsg-policy.json (portal) and x2-nsg.rules.json + x2-nsg.params.json (CLI).
The 5 tasks you will do
- Task 1 — Roll out "Allowed locations" safely with DoNotEnforceالمهمة 1 — طبّق "Allowed locations" بأمان بالـ DoNotEnforce
- Task 2 — Enforce, then document the exception with a time-boxed exemptionالمهمة 2 — فعّل الـ Enforce، وبعدين وثّق الاستثناء بـ Exemption ليه مدة
- Task 3 — Modify: inherit the costCenter tag, with identity, role and remediationالمهمة 3 — Modify: ورّث Tag الـ costCenter، بالـ Identity والـ Role والـ Remediation
- Task 4 — DeployIfNotExists: diagnostic settings, evaluation delay and remediationالمهمة 4 — DeployIfNotExists: الـ Diagnostic settings والـ Evaluation delay والـ Remediation
- Task 5 — Custom definition with an alias and count (audit first)المهمة 5 — Custom definition بـ Alias و count (Audit الأول)