About this talk
This talk focuses on Azure policies and roll-based access control, emphasizing the importance of security principles from a developer's perspective. The speaker, Cecilia from Axis Solutions, explains the concept of Azure as a 'mansion' where access should be carefully managed, akin to using keys for different rooms. Key principles discussed include zero trust, least privilege, and just-in-time access, which aid in protecting Azure resources and reducing unnecessary access risks. Cecilia delves into role-based access control (RBAC) and privilege identity management (PIM), outlining their roles in governing who can perform actions and for how long. She also explains Azure policies, which set rules for how resources can be configured and ensures compliance within the organization's infrastructure.
Full transcript
So welcome welcome my session about basically Ashure policies and roll back access uh in Ashure. My name is Cecilia and I work at this company called Axis solution that now are part of a company called Evidi. We operate in the Nordics mostly but our customer is based Nordics in Europe. My part of the company and me is working a lot with developing applications for customers. I myself
do a lot of DevOps work AI solutions together with a lot of Ashure infrastructure security and stuff like that. So and I do love to take a complex topic and turn it into a simple explanation and so this is security complex topic and I trying to do it in a simple way so it will be easy and understandable understandable and focusing from a developer point of view
on stuff and when thinking about accessing things in Azure I like to compare Azure your subscription to to a mansion or a castle or something. So this is actually the Swedish castle where I live where the queen and king is living. [snorts] So they have a lot of rooms that hover up the wings. They have a lot of different buildings. So and when they are hiring contractors
or something, they don't basically hand out the master key to everything, right? They don't want to do that. If you do that, you're going to lose control really fast and don't know who has access and who has keys, who had turned them in, etc. It's going to be a mess. So, and the same thing goes for for Ashure. You don't hand out like a ownership role for
every single people going to do something. They're going to do have too much of an access. They're not supposed to access like the vault or like the wine celler or something just to paint a bedroom. So you need to think about in those terms in ashes too that just give what they need and preferably uh on u timed limited on time as well. They need to hand
in the key again kind of thought. with that in mind um we have a couple of principle that can be good to have in mind. You may have heard them before but it's really good ones. So the first one is called zero trust. So this is but that we we don't just trust someone that they have access just being there. So for you guys for example, I
shouldn't trust you that you are supposed to be here because you don't have a badge on you. But it's easy to it's easy to think that you are edgible to be here because you're here. So apparently you possibly have bought a ticket to this one. But that's that's kind of what what's um uh ser trust is. You need to like verify that you is you and you
are supposed to be there. Uh so in like the IT world is can be things like once you are on the corporate network you can access everything that's kind of a old silo doing things and you shouldn't assume things like that or when when you're on a specific device then it's okay or something you need to tell the system who you are so they can look up
if you're really supposed to be The next one is lease privilege. So this is kind of giving the key to castle, not giving the owner key. Give the key to the bedroom and the doors leading up to that and nothing else. So the default should be like no access and I give you access to exactly what you need. Nothing else. That's least privilege. The next one is
just in time. So we don't hand out the key and then they need can have it forever. They need to hand it in. Sometimes it's a deadline or something. So in in our world it is about having access to a resource during eight hours, two weeks etc. Uh so we remove the access basically uh when when when it's done. So these are really good design principle. We
can use them when we design systems, when we uh design our infrastructure and when we work with Azure. And this help us protect ourselves as a company if like your credential got lost or you get hacked in malware whatever. So they use your profile to do anything. If you're not the fault owner in production, that's really good. It may not be your fault or you did click
some email and something and then they will have access maybe to production through you. But if there is a process of approving or applying for access to it and it's shortlived the window for when you're vulnerable is smaller. So, so that's is this kind of what we want and also like accidentally thing if I have ownership for oh all the subscription and I'm supposed to kind of
remove something manually directly in portal and it maybe the naming of the resource is kind of the same between environments. I could accidentally remove uh resource in production and I don't really want to do that. It also protects myself from doing stupid things to do. Click. So, so we have uh a couple of different pieces we going through. They are free. So, the first one is about
role based access control and it's about who is allowed to do what and where. The other part is called privilege identity management and that that is like the just in time thing like when and how long are you supposed to do it and then we're also going to look at Azure policies and that is what are you um do with the resource like you are allowed to
do things but exactly what are you're allowed to You are allowed to create resources but how are they allowed to be configured when you do that that's policy so those are the different parts so we will start with role based access control usually called arbback you may have heard that term I'm going to use that term because it's easier than saying role-based access control every single time
as I said this is about who can do what and where. So we have three pieces in the puzzle here. So who is called principle. So this is a user or a group of user or an app or something. It's an identity on it. We have a role and a role is a definition on what you're allowed to do. You are allowed to create stuff. You are
allowed to read stuff. you are uh allowed to write certain things general or a specific resource type and the last is what scope do this apply to is it overall the whole subscription or a specific resource group etc. So these three parts is part of ro arbback. So let's start looking into the principle the identity. So this is basically entra ids entities. So we have users and
groups. We can assign a lot of different roles directly on a user but try to find a way to work with groups because that's simpler. Uh probably if one developer want to have one certain access and other developer in the same team will have the same access. And usually sometimes you have those AD groups set up for developers in general or developer in the the specific team
or something. So you may have that grouping already set up. Uh so assign the rules to those group makes it easier when people join and leave because that just adding them to the ad group going to give them all of the things that you set up for that group. So that make it more simple. Uh, and if you don't have a group, try to set an up
if you're like, oh, I need to this a like a database guy here to need like doing this and this and like, okay, we create a group for data access or Excel SQL access or something. Maybe he's the only one right now, but then we can add in more or remove uh people from that group. Why why do we do the other part? could be uh like
systems or application or something. Manage identities is an identity of an uh of a resource in So we say like this app service is the identity and you can apply rules on that one. Service principle is kind of the same thing but it's not tied directly to a specific resource. You can use it for any resource uh and you could also use it for other stuff like
aure devop build or etc. So so the identity of something is the principle. The second part was a role. So this is uh a list of things you can do and there's a lot of different roles and you can create your own. So it's basically a list of permissions and a couple of them some examples are owner. This is the one that we as a developer kind
of like to have because we don't have to like nag about getting more roles on it. But it also give you the possibility to remove stuff, add stuff like everything except applying roles you have here. There's a higher role for that. We have contributor. That's a really good general role for thing people that want to create uh resources and manage resources in Azure. Um this this will
be able to create stuff, configure stuff, removing stuff but in a more control way than owner that have more um access reader. As you hear, this is someone that just can see the resources, look at the properties, but can't really change And then we have more specific. So those are kind of general. So if you apply it to a resource, it's going to uh be the the
the reader resource there or the resource group. You're going to be read on the resource. But then we have more specific roles that have to do with a certain type of resource. uh example virtual machine contributor. This is a role that make you be able to work with virtual machine resources. You can create them, change them, delete them, sort of that that type. We have another example
called storage blob data reader. Also a very specific role. You can read data blobs. Um, and you can also create your own. Uh, if you want to apply least privilege, you want to have specific roles for stuff. Uh, and if it's feasible, you want to have you maybe have like four or five different reader contributors, etc. And you have to manage five assignments. But you can also
create your own roles. So this is just a list of permissions. So you can extract all the permissions and create your own roles. to camera role for devops or the data team or the developers etc. So if you don't want to have like contributor or reader you can create your own modify you can start with the reader but add more or something. So it's very flexible uh
and possible to extend and work with. We will see this in action very soon. And the third part is the scope like where do does this apply? So we can apply directly on the resource and say this resource for this person have this but that will be micromanagement I would say it will be it could be nice to do it like temporarily or something in the long
run it's really hard to like every single resource apply uh this kind of thing. So a better way is to use the resource group and make sure you have good grouping of resource group because the rules is rippling down. So if you have the resource group uh if you have uh um a role on that one the role is rippling down on the resource inside of the
resource group and the same is you can also apply it on a subscription level then it ripple down to the resource group and the resources in the resource group. So everything under the resource. So if you apply reader on the subscription, you can see everything inside of the subscription. And you also have another level called management group. Uh this is a container for subscription and or other
management group. So you can group your subscription. So if you have several subscription and want to handle them similarly with things like um arbback you can group them with management uh groups and you can have I think it's seven layers of them. So if you have a really complex structure with a lot of different dev subscription and QA and like testing and like production etc spread out
you can have a good structure with management group for that. yes so all these three pieces is called a role assignment. So we have the principal who is it is it a person a group an app we have the role the list of uh what you can do uh and then you set it on a scope on a resource group or a subscription or even a resource.
So that's called a role assignment. yes, let's do look at this in the portal. So let's see. I do here on the pink page. I tried to do it dark mode, but this was really hard to read. So it's you have to remember pink is the owner of this subscription. So I'm owner here. I'm the only role that I have uh given is owner to myself or
I got it when I created to the subscription basically. I have invited a user called Maria that's also me but another me. So Maria is not the admin uh owner of the subscription. Uh but I haven't given any role because the only role I had was owner of me. So Mar Maria is able to log in to it to the subscription. So if we switch over to
Maria that is plain gray browser. Uh this is what which you will see like hey you don't have a subscription here. You can log in but you don't really have anything here. So the first thing that I as a owner need to do is to assign something to Maria so she can see something. Um, I can specify a specific uh resource or a resource group or access
subscription or but I want to make her be able to see the whole subscription as the first step. So I'm going to give her reader access. So uh under subscription access add ro assignment and then I'm going to search because the list is long reader here and then I do next I select members or in this case the principal the identity etc. So this is a user
since I don't have groups here. Uh so I'm going to select member. Usually I need to search but I only have two people here. So select Maria I'm going to skip we're going to go back to this one when you're talking about privilege identity management. Uh so we're skipping that and then we assign And this will can take a little bit before it's apply. Uh so we
will look at uh more into the roles while you wait for it to to be rolled out. So if we are looking at let's see we can look at the reader we can view the details of it here. So in a role we have permissions and the permission are two different type. We oh okay we have actions and data actions. So action is what you can do
on resource you can like the properties on it and the data action is kind of inside of it. So if you have a data storage for some kind is the data inside of it. So for some resources you only have actions but on on some you have data actions. So like access inside of a key wault or a blob storage or etc. Then you have data action.
So reader have a lot of uh re um 8,800 permissions and we can see here grouped by type. Uh it's a lot of them only showing 500. So as I said read is a kind of generic um read all where it applies. So we'll have a lot of so we can search for uh data something or let's say blob so we will see that it has yeah
so Microsoft uh SQL resource you can read a couple of things uh storage can list the blob service and blob list of blob containers for example etc. But it's it's just outside of it. If you look at the data action, we have no access inside of uh so reader is not you can read the data inside. You can just read the the metadata on it and and
properties and kind of flickering with the sound. It's annoying. So if we back up and we look let's see we can look at contributor and contributor is a privilege role so this is a role that you should be careful with to just hand out there's a couple of of them 11 but you can use it of course so contributor we will have a lot of actions no
data actions And if you to look at blob there as well. You see scale web storage. Uh yeah, so it can delete the blob container, get the blob list. Uh but so it has more than the the reader didn't have delete for example. But we can also look at a more specific role as something for a blob data The name is just no here uh the name
is just a string but they do use the the name of reader contributor um stuff like that. So when you you will learn when you work with with roles kind of what what naming they have. So this is uh a role called blob storage blob data reader. So this is supposed to be giving the user access to read inside of the blob like the data. So let's
look at that. Uh it have three permissions. Uh on actions you can get the blob container list the blob containers. That's really useful when you go inside the blob to actually see what blobs you have. And then on the data actions you can read the blob. So data action is So and you see this is the most specific. So you don't really have to have that much
of uh uh per actions. Um there is really a JSON file JSON specific behind this. So this is how it look like. So if you are creating your own role, this is what you are going to copying, editing and use when you create So now let's see. I blob for a while. So let's see if we have gotten access to anything. So we can have still have
let's see filtered. Yeah. So here we are. So now I'm Maria. Maria can see the ashure subscription. I can look inside of it and see hopefully the resource groups that I created. No, not really. Oh, what's happening now? I just click a button without reading. That's really good. So, let's see here. Resource group. Yeah, resource group one, two, and three. That's what what I have in in
this subscription. So, that's good. Um, so now let's try to do do an do a task. So, Maria is supposed to uh add a tag to this resource group. We only have a tag here. That was dumb. Uh let's see. Remove that. Past Add preparation. Uh edit So now I'm the master removing it. So it's supposed to look like this. [snorts] So back to Maria. Uh and
then do a refresh. So So this is how it's supposed to be. We don't have any tag here, but Maria is tasked with tagging the resource group to the teams that are using it. So we'll try to do that. We have res resource group one here. So add a tag and the tag name should be team and we say this is the data team's um resource group.
So and we press save. Wait for a little while. And then we get a failure this account doesn't have authority to perform actions Microsoft resource tag right over this specific scope that is the resource So we need to make sure that Maria have this um access. So now we're going back to the owner and here's the owner. Um, and I going to put the access ro directly
on this resource group for this demo. So I'm going to access control here. And here we can see that we do two roles soon. Yeah. Uh check okay so this was what what I was showing so under role assignment you can see every role assigned to this resource and if it's inherit or if it's just there um specifically for that resource. So this is uh this is
a owner the me in this one uh I'm owner and by inheritance and Maria is reader by inheritance. So so she she can't do anything. So let's add a role assignment. So now I can try to figure out like what kind of role could this be? It could be something like a tag writer or a tag contributor probably on the naming. But I can also search by
permission here. So I can take that error code we had and see that hey we had two different roles that we can use. Something with red hat blah blah blah. Probably not what I want. It doesn't sound like a generic like a resource group role. I can view it and and see what this actually does um to figure it out. But tag contributor that seems to be
the one I want. The actions here. Um a lot of read stuff. Let's see. Do we have anything tag? Yes. So, I can read tag, write tag, delete tags. Uh there's no date actions in that contributor. Like a tag doesn't have anything in it. It's just a string. So, so that will be a good one. So, select that one. Uh add Maria again. Reassign so she should
be edgible now. So, we go back and I need to prove hopefully that it works. Team and then data and save doesn't. It's going to be a Just wait a little bit uh of a thing. It usually gets it failed. So I can I can show you a little bit later that it actually worked. But if I went to RG2 resource group, it will not work because
it's just in this scope. Uh can you check? So check my access. No, check. Okay, so here is my Oh, right. I did it. I did it wrong. Uh I used the privilege uh thing. I was not supposed to do that right now. Um So, can I change that? No, I can't. Damn it. So, let's redo that one more time. Roll assignment. I going to talk about
that part uh when we come to the last part. Uh no, I was supposed to ah that one. That one there. [clears throat] Maria, select next. Here I'm going to do it uh active permanent. That's the one I wanted to do. So now we'll see now it should work. So back to Maria. Um add a tag T team data. Save. Yes, now it works. So now she
has um the role of tag contributor on the resource Yes, that's for the demo. So that is how that is handled. now to the next part. Um we don't want to give it permanently. we want to time limit it and then we have this called privilege identity management or pin that is the word that we need to learn Uh so this is we do have people joining
the team leaving the team there are projects starting ending you know like nothing is constant uh we need to make people add remove uh we don't want to have access full access in the production unless you need need to and trying to figure out what's wrong or something. So this is a time for like when are you supposed to do it and for how long. So, and
it ties into the role assignments, but you need to have enter ID P2 feature. This uh so if you have P1 or something, this will not work. So, uh and you will see you're missing it in the dialogues I show you later on. So, but this could be uh a selling point to actually move to the enter ID P2 uh level. Uh but that's how it is.
So we're going to look at it and hopefully you can use it. Yeah. So yeah, I going to talk more first. [laughter] So without pim uh the workflow is like hey I need owner um privilege uh give me the owner role and you got you give the owner role to the person and probably it's the person is going to have it forever more or less until the
the account is disabled. But with PIM you are giving the user the possibility to be owner edible to be owner. So they get a role but it's just edgible. So it's not applied as I accidentally did here. I didn't got the role um for full and then when I need a role as a user I'm going to activate it. I going to justify why I need it.
>> [snorts] >> You could configure it so that someone needs to approve before you get got it or it's auto um doing it. When you activate it, you're going to tell for how long you want it and after that time it's going to be de deactivated again automatically. So that's the flow. Now back to the code. So [snorts] no, back to here. So now back to the
owner because the owner is the one that sets this up. So say that Maria are a person that's handling things like cost and like distributing the cost from for the Ashure subscription to the right team or something. So she really needs to a make sure that we have the right tags on like the team that we did before on all the resource groups and resources and making
sure that we do have uh a role that where she can look at the cost and make budgets or something. So so but we don't really want her to have like full access on the tag things all the time just when she need to. So, we are going to do that. Let's see. We're going to do that on a subscription level because that's makes most sense there
and access control because right now if we go back to Maria and we go to Argu 2 and we're trying to add tag team. uh this is kind of infert and then we are trying to add this fail we don't have access to do that so proof so we're going to add ro assignment the same as we did before so the tag contributor we're going to select
Maria or the group that Maria belongs to and then we have the assignment type if you don't have entra ID P2 you will not have this uh possibility here. Um but if you do you have it on the wrong assignment. So active is like the permanent version that we have. So if we don't want them to need to apply all the time. So if you have like
a dev subscription or something where the developers are should be allowed to do whatever they like whenever they like to could be a good way to give them either for the whole subscription or a specific um resource group uh the contributor role for example. But edible it's going to give you a timebound thing. It also is time bind in when you have um the edgible like you're
able to apply for this role. So uh I think the default time is one year. So this will be good. So has nothing to do when you actually apply it. Save this. No. So next. Next. And then we go here. And now I'm on Maria. I'm going to look at my Maria going to look at her own access control I'm going to see that I have one
active. This is read hopefully the edgible one as well. Yeah. So, and I have the edgible one. So, if I try to add a tag right now on this group, I will not be able to because I'm not tag contributor role. So, I need to activate it. Uh I can do it in a couple of different places, but right on the resource, I can go to this
and use activate. You can also go to the pim uh resource inside of of Azure. So, and I going to say for uh how long that a configurable thing from the admin view, but the default on most role is from zero. I don't think you can put zero. Can you do it? Yeah. And half an hour to eight hours. So, if it's a full work day and
I know we're going to be inside of doing this the whole day, eight hour makes sense. uh if I want shorter uh I just put what I want to have and then you have to apply a reason. uh this reason is used to if you have the process of it needs to be approved by someone they can read it but if like this we have an out
accept um it's something that goes into the logs so someone can look at like hey why did you activate like owner on production we didn't have any errors here or something like you can like auditing things so um need to add team tag Tag timing. Takes a couple of time. So a short note on the thing where you can configure it to someone should approve first. That
could be a really good way of handling it. Especially for kind of production things, you can have a group or person or something. But think about like if that person is not there, it shouldn't be one person. It should be a team. How should they handle it when like think of all the cases and make sure it actually works and for like easier all a tag contributor
you would really need someone to approve it like uh use it carefully I would say it will be kind of annoying and may lock everybody out if it's bad. Yeah. So now Yeah. So now it should be done. Two one go. like that and we will see if we can apply a tag on this now and I with this I can apply for every kind of resource
groups uh but I need to um activate the first year. Overview essentials add a tag there save and it works but in in two hours time it will not work again. So that's PIM. On the other side of PIM, we have like the admin bit. Um like I I did assign uh role with a PIM here. But I will have if I do this, I probably will
have more pin roles and I do want to manage them together, look at them, etc. So, so I go to I search for PIM. I go to privilege in management. I go to Azure and I'm going to look at I can go to a specific resource group or resource as well, but I'm going to look there manage resource. And on that I can see all the assignments
I have on it. I will only have one, but probably after a while I want to have I going to have several of them. Um I can see which one are edgible, what's active, and what's expired like um you're not edgible any anymore. Uh so you need to kind of renew it for the person or something. Um we can also look at from a role point of
view if you have a lot you want to group them. um better. So we can look at reader. Ah they got a lot of there is the the general reader. We have one there. We can go into a role. Um no. Yeah. So here we can specify and see how the reader is set up. Um for that one it's maximum 8 hours and all of this can
be changed from. So we can say that you can never apply to this role more than two hours at a time or something. We can um set the that you let's see go here instead edit uh the proofing. So you can force people to use their MFA again when they activate this role just to prove them that they are there. Again, um you can add that you
require approval and then you can add who's going to approve uh group or a person. Um you may want to have uh let's see there you can say how long you could be edible. One year is the longest but you can also say that you only hand out this role edgeible role for a month in a time or something. Um, if you're allowing permanent active assignments or
not on this role. Um, what kind of not notification do you like to when people are like u activating your role? Do you want to have like an email or uh just send a notification or something? So you can have if you have a role that's like I really want to know when owner is activated on production you can kind of do that here. So uh we
can also look at it's called activity log I think or is it no my audits. Yeah. So here is where uh Maria has got in the edgible role uh requested and then completed. So the request is so if you have denied it because the person need to approve it or something it's going to be denied but here you will see no is it on that one didn't
I ah there's a reason sorry I didn't it's on both so here's the reason that Maria wrote in as the reason so you can see that here and you can see all of what's happening um here for for this and you can also manage your different roles uh from this point of view. So here you can assign so you don't have to go to the resource you
can go to the pim and select the role and do all of that from here as well see the point back to this. So now we have our back who can do what and where we have pin when and for how long. Now we are going to talk about a policy. This is a little bit different but is this is more about what are you in more
detail allowed to do on the resources and you can still be like owner on a subscription and trying to create something like a resource and be denied from a policy. So this is overwriting everything else. Um and just will not allow you to do things. so an aure policy is um it's a lot of different policy but a policy is kind of a rule around a property
on a on a resource I could say. So uh some examples can be allowed locations. So the regent or location for a resource you can say like hey uh every resource have to be located in Sweden central where I live for example you have that a policy at your subscription company etc. You can set as a policy and then uh it's going to help you to align
to that rule because that's kind of a property. It could be tags that you're working now. We can add that you require team tag on all resources and unless you have set it, you won't be able to create your resource or you're going to get an alert that it was a resource or created depending on how you configure it. You could put policies that say that we're
not allowed to do public IP on this resource type like you are not allowed to do public access to to data storage or your VMs are not allowed to do public IPs. There are things coming there as well in the portal but those kind of things. Um, you can set skew restrictions. So you don't allow to select the really high expensive tiers when you create your resource
but just the ones that you have allowed for this subscription or whatever. Um, you can like in the encryption box needs to be on the storage account for example. uh you can require HTTPS only like lot of different you can demand private endpoint. So think about like all the the settings that you can do on a resource and those can be defined as rules. Okay. [laughter] Like
I was like is it the fire alarm or something else? >> [gasps] >> Um, so the policy is kind of one property is allowed to set to one. You can group several together, but more or less it's one property. [snorts] Uh, and we also add an effect. The highest effect is deny. We deny on a policy rule says that you are not allowed to create a resource
unless you obey the rule. It doesn't apply to something that you already have in the subscription, but it applies to the new stuff. The the things that already there, you will be able to see who breaks the rules, but it can't do anything about it. We have audit and that's like the nice version. It's just going to scan all your resources, new and old, and have a
report on who's breaking the rules. So if you have like a policy on location for example maybe all all everyone knows that you should create them in Sweden central but you can have a policy so you can look it up and see if everybody's doing that or if you have a lot of um resources uh all the knifing will come in as an audit as well uh
the the things that's already there and there is also one called append So if we don't have it add it basically and depending on what kind of property it is it could you may need to use deploy if not exist if it's kind of a resource maybe something about logging or something so need create stuff uh or it need to modify. So there's a kind of these
three are depending on what kind of property it is. It's kind of fix it um option you can say. So we can say that we modify to Sweden central no matter what. So you create it you select like Germany whatever uh data center in but when you're done you're going to have Sweden central anyway. So kind of forcing forcing it. Um if we have multiple policy definition
for the same thing but with different effects, the highest one will always win. So do if we have a deny, it's the deny that wins. So we can't really like put an audit and think that it's going to override on that specific resource even though we have a deny on subscription level. But we can add an exception on the deny policy and say don't include that res
resource group because that is a lab testing resource group or something. So the effect and as the same as arbback we need to apply it to some something. So we have the same thing here with the management group the subscription resource group and resources. So the management group and and here if we have more than like free subscription like one dev QA test and production. So we
have multiple dev multiple QA multiple products or multiple team subscription whatever then we really want to look into management groups so we can apply the policies overall. So all the dev subscription have kind of the same policies etc. [snorts] Um so that is could be really good to do. So we can add it on a management group and it going to ripple down to all of things
under we can apply it on subscription. It's going to ripple down resource group and on a specific resource if you want to. Uh but probably resource group management group going to be the one that you apply to and and this is kind usually subtriction level because you look at it in like the whole picture So let's go back to let's see time. So policy here. Um we're
going to Ashure poly. See there it is. So [sighs] let's see. So right now I I have one policy in place and that is because of demo because a policy takes a couple of minutes half an hour worst case to ripple down and report back and so on depending on how big your subscription is. So it will not be like instant on exactly what's going on. It
I do think the rule will apply right away but like scanning and auditing all the things will will take a time even though we like free resource groups only. So I do have a policy that is not compliant. That means that I have a rule that not everybody's following and I do have two resources out of three three that are compliant. So I have one resource that
break the rule. Um let's see what I'm doing. So we do have let's see definitions. So there's a lot of definitions here. Uh I don't even know if we have a count on them but let's see I want to to do we can look at tag actually let's see tag. No so we can search for for it and trying to figure out what they named it. There's
a couple of categories. So if you know you want a policy for for tag for example, we can filter for tag. It's kind of easier. So you need to find to figure out. So we have for example require a tag on resource group. I do want to have that And we s see the definitions here. Um and it's basically the type resource group where uh tag name
tag is uh the parameter list that I'm going to provide. So uh so see this JSON you can design your own policies as well. You can make sure to assign this uh here to some scope subscription or resource group management group. I don't have them here. So uh you can add exclusion if you don't want it to apply to a specific resource group for example. and we
also going to tell like the action is this is enforced or just auditing uh parameters. Damn it. Here. Uh so for here I can say like exactly what that I need a team tag. Uh depending on the policy I going to have different parameters here. Um and so on. So we can go and look at the assignment that I do have. So I have one called LA
location for resource uh I do have a list of saying that it's Sweden central nothing else. So that is what uh actually is broken here because resource group three is Italy north. So And let's see if I can create an other Italy. Yeah. So even here I am actually born and stop. But if I I can I think I can actually go away and try to create
it anyway. Oh, they locked it. But sometimes you can create it and you don't get warning. But it will fail anyway because you're not like I have like the deny setting on this one. So um there are a lot of things around policies. So if you are trying to be compliant with a public standard like ISO standard etc. we do have um those kind of policies let's
see and when when there's a group of policy it's called an initiative. So initiatives is a group of policies. So here you have a couple of uh known public one. Let's do ISO for example. So yeah this one recognize maybe recognize some of them. So they are a group of a couple of policies and this 58 uh all of them is usually audit in the first place
because when you apply this it's going to be like a lot of stuff to go through. uh and then you can switch it from audit to deny once you have cleaned up and making sure that we have everything in place and that it actually works and so on. So this is a great tool to help you following um like public policies uh standards or internal policies that
we say like hey we don't really follow a policy but we kind of align to this public policy uh or we going to do this and this rule no public access always private and public etc. And you can set it up as your own initiative or just um [clears throat] policies added 101. we are done there. So that's that RBback control who can do what and when
team controls when and we need to have enter P2 um tier and the policy control more detail what you're allowed to do on a broader scope not a specific person. So the question is what to do now? you've hopefully learned something new and [snorts] I do have a couple of suggestions just to kind of call to So the first thing do you have permanent owner in production?
[snorts] Shouldn't have. So if you do have it if it's a long list try to reduce it as much as you can. Maybe you have given out ownership to people left and right and you can remove them because it's not needed. If it's empty, protect it like that. If you're able to use pim, use it for the privilege role as owner, as cont uh contributor and and
those kind of thing where you can add the time timing and you can do it on a role assignment that's already been done. You can editing it for that and or if you don't have any policies in place, come up with some rule that you do have for for something and add it as a And if you do have policies in place, they may maybe all audit
try to find those that you actually can enforce to a deny. So we get one step further in in this journey. So they're just a couple of suggestion but more or less like go to yourself like if you auditing your subscription what what would you find around this area and think about like what would be the next action to take when you come back on Friday or
Monday uh to to change and make it more secure. So go and secure your environments and thank you for your session. >> [applause] >> I think we do have like one minute for questions if there are any. >> Yeah. >> What is a privilege role? Is that something that defines or is that something that I define? >> A privilege role. What is it? Uh it's something Ashure
have defined. They they are the role that have a lot of what you're allowed to do that are not read only I would say. So they have defined that these role are privileged. They are under a different tab in the UI. So when you're if you're searching for owner and are on the default first tab, you will not find it. So they hide it a little bit.
So it's just a definement from from them. So you can create your own role. That's a really high privilege, but that will not like be on that one [laughter] by automatically. Yeah. Thank you. And you're allowed to talk to me afterward of course or you online can be in chat if you have any questions. So, and I think it's time to go and get some more coffee,
right?
