Skip to content

Commit 82768e9

Browse files
v-shilsv-shils
authored
Merge pull request #307990 from MutemwaRMasheke/baseline
Baselines Documentation
2 parents 2f2fe9f + d7aa9c6 commit 82768e9

35 files changed

Lines changed: 1449 additions & 5 deletions

File tree

‎articles/governance/machine-configuration/how-to/assign-built-in-policies.md‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
---
2+
title: Discover And Assign Built In Machine Configuration Policies
3+
description: Learn how to discover, configure, and assign built-in Azure Machine Configuration policies to audit and enforce compliance across Windows and Linux machines in your environment.
4+
ms.date: 11/07/2025
5+
ms.topic: conceptual
6+
ms.custom: references_regions
7+
---
8+
9+
# Discover and Assign Built-In Machine Configuration Policies
10+
11+
Azure Policy provides a unified framework for defining and enforcing governance rules across your Azure resources.
12+
Machine Configuration extends this capability to the guest OS level, allowing you to audit and enforce configurations *inside* Windows and Linux machines—helping ensure your workloads remain secure and compliant with internal and industry standards.
13+
14+
This section explains how to discover built-in Machine Configuration policies, understand what they do, and assign them to your environment. We'll also walk through an example—using the Audit Windows Time Zone policy—to illustrate how parameters are used to tailor configurations to your organization's needs.
15+
16+
## Discover Built-In Machine Configuration Policies
17+
18+
Azure Policy definitions describe *what* is being evaluated and *how* compliance is determined. Built-in definitions are maintained by Microsoft and automatically updated to align with current security and compliance standards.
19+
20+
To view and explore these built-in policies:
21+
22+
1. Navigate to **Azure Portal → Policy → Definitions**.
23+
24+
2. In the left-hand navigation, select **Definitions** under the *Authoring* section.
25+
26+
3. Open the **Category** filter and select **Guest Configuration** and **Built-in** on Policy Type to display all built-in policies related to OS auditing and compliance.
27+
28+
[![Screenshot of Azure Policy Definitions page with Guest Configuration filter applied.](../media/discover-and-assign-built-in-machine-configuration-policies/azure-policy-definitions-guest-config-filter.png)](../media/discover-and-assign-built-in-machine-configuration-policies/azure-policy-definitions-guest-config-filter.png#lightbox)
29+
30+
4. Browse the list to review available definitions, such as:
31+
32+
- *Audit Linux machines that have the specified applications installed*
33+
34+
- *Audit Windows machines that are not set to the specified time zone*
35+
36+
- *Windows machines should meet requirements for the Azure compute security baseline*
37+
38+
5. Click any policy name to open its details page. You can inspect:
39+
40+
- The JSON definition
41+
42+
- Available parameters and versions
43+
44+
- Metadata such as category, mode, and required providers
45+
46+
[![Screenshot of policy definition details page showing JSON definition and parameters.](../media/discover-and-assign-built-in-machine-configuration-policies/policy-definition-details-json-parameters.png)](../media/discover-and-assign-built-in-machine-configuration-policies/policy-definition-details-json-parameters.png#lightbox)
47+
48+
## Assign a Built-In Machine Configuration Policy
49+
50+
A **policy assignment** determines *where* and *how* a policy definition is applied—whether to a management group, subscription, or resource group.
51+
When you assign a Machine Configuration policy, Azure evaluates all in-scope machines and reports compliance directly in the **Azure Policy → Compliance** blade.
52+
53+
### Example: Assigning the "Audit Windows Time Zone" Policy
54+
55+
Let’s use one of the built-in Machine Configuration policies—**Audit Windows machines that are not set to the specified time zone**—as an example.
56+
57+
1. From the **Policy Definitions** page, select
58+
**Audit Windows machines that are not set to the specified time zone**.
59+
60+
2. Click **Assign Policy** at the top of the page.
61+
62+
3. In the **Basics** tab:
63+
64+
1. Choose the **Scope** (subscription or management group).
65+
66+
2. Confirm that **Machine Configuration prerequisites** are deployed. (A link to deploy prerequisites appears automatically if not.)
67+
68+
3. Optionally specify exclusions if certain resources shouldn't be evaluated.
69+
70+
[![Screenshot of policy assignment Basics tab showing scope selection and prerequisites.](../media/discover-and-assign-built-in-machine-configuration-policies/policy-assignment-basics-scope-prerequisites.png)](../media/discover-and-assign-built-in-machine-configuration-policies/policy-assignment-basics-scope-prerequisites.png#lightbox)
71+
72+
4. In the **Parameters** tab:
73+
74+
1. Set **Include Arc connected servers** to true if your environment includes Arc-enabled machines.
75+
76+
2. Choose the desired **Time zone** (for example, "Pacific Time (US & Canada)").
77+
78+
[![Screenshot of policy assignment Parameters tab showing Arc servers option and time zone selection.](../media/discover-and-assign-built-in-machine-configuration-policies/policy-assignment-parameters-arc-timezone.png)](../media/discover-and-assign-built-in-machine-configuration-policies/policy-assignment-parameters-arc-timezone.png#lightbox)
79+
80+
5. Review your configuration under **Review + create**, then click **Create**.
81+
82+
Once assigned, the policy will automatically begin evaluating machines within scope. Compliance results will surface in the **Policy → Compliance** view, where you can drill down to specific resources or export results.
83+
84+
> [!NOTE]
85+
> The same process is applicable to other built-in Machine Configuration policies—such as those auditing Linux baselines, password settings, or required applications. Parameters vary by definition and allow you to customize the audit scope without creating new policies.
86+
87+
## Programmatic Access and Automation
88+
89+
While this guide focuses on portal-based workflows, you can also assign and manage Machine Configuration policies programmatically through CLI, PowerShell, or REST API.
90+
91+
| **Interface** | **Command/Reference** | **Documentation** |
92+
|----|----|----|
93+
| **Azure CLI** | az policy definition list and az policy assignment create | [Assign policy via Azure CLI][01] |
94+
| **PowerShell** | Get-AzPolicyDefinition and New-AzPolicyAssignment | [Assign policy via PowerShell][02] |
95+
| **REST API** | Microsoft.Authorization/policyAssignments | [Azure Policy REST API Reference][03] |
96+
| **Guest Configuration** | az guestconfig assignment list | [Guest Configuration REST API Reference][04] |
97+
| **Azure Resource Graph** | Query guestconfigurationresources table for compliance results | [Query Guest Configuration with Azure Resource Graph][05] |
98+
99+
## Next Steps
100+
101+
After assigning your policy, you can:
102+
103+
- [View Machine Configuration compliance reporting][06]
104+
- [Assign security baseline policies][07]
105+
- [Understand Azure Policy definitions and initiatives][08]
106+
- [Deploy Machine Configuration prerequisites][09]
107+
108+
<!-- Link reference definitions -->
109+
[01]: ../../policy/assign-policy-azurecli.md
110+
[02]: /powershell/module/az.policyinsights
111+
[03]: /rest/api/policy
112+
[04]: /rest/api/guestconfiguration
113+
[05]: ../../policy/how-to/get-compliance-data.md
114+
[06]: ./view-compliance.md
115+
[07]: ./assign-security-baselines/overview-page.md
116+
[08]: ../../policy/concepts/definition-structure.md
117+
[09]: ../../policy/concepts/guest-configuration.md

‎articles/governance/machine-configuration/how-to/assign-security-baselines/deploy-a-baseline-policy-assignment.md‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
title: Deploy A Baseline Policy Assignment
3+
description: Learn how to deploy a security baseline policy assignment for continuous security compliance tracking across Azure and Arc-enabled machines using Azure Policy and Machine Configuration.
4+
ms.date: 11/07/2025
5+
ms.topic: conceptual
6+
ms.custom: references_regions
7+
---
8+
9+
# Deploy a Security Baseline Policy Assignment
10+
11+
A security baseline policy assignment enables continuous compliance tracking, with results surfaced in the Azure portal to validate that your custom configurations are correctly applied across all target Windows and Linux machines. Policy assignments apply to Azure and non-Azure virtual machines (that are [Azure Arc-enabled servers][01]), extending security and compliance management across hybrid, multicloud, and edge environments. The following Policy definitions support customization:
12+
13+
- *Linux machines should meet requirements for the Azure compute security baseline*
14+
15+
- *Windows machines should meet requirements for the Azure compute security baseline*
16+
17+
- *\[Preview\]* *Official CIS Security Benchmarks for Linux Workloads*
18+
19+
Assignment of a security baseline policy is managed through [Machine Configuration][02], which enforces compliance by auditing machine settings against your chosen security baseline.
20+
21+
You can assign baselines via the Azure portal, Azure CLI, or automate the process in CI/CD pipelines for consistent rollout.
22+
23+
> [!IMPORTANT]
24+
> Before assigning any security baseline policy, make sure you deploy the Machine Configuration prerequisite initiative. This initiative installs the extension on virtual machines and enables secure communication with a managed identity.
25+
26+
## Deploy via the Azure portal
27+
28+
The portal provides the most direct path to create or test a baseline assignment.
29+
30+
### Step 1—Open Machine Configuration Policies
31+
32+
1. Go to **Azure portal \> Policy \> Machine Configuration**.
33+
34+
2. Under **Definitions**, choose your desired baseline—for example:
35+
36+
- *\[Preview\]* Official CIS Security Benchmarks for Linux Workloads
37+
38+
- *Azure Security Baseline for Windows*
39+
40+
- *Azure Security Baseline for Linux*
41+
42+
### Step 2—Select and Customize
43+
44+
1. Choose **Modify settings** to tailor which benchmarks and versions you want to include.
45+
46+
2. Review and optionally edit parameters for individual rules.
47+
48+
3. When satisfied, click **Review + download** to generate your customized settings JSON.
49+
50+
4. Press **Download All Baselines** to save the file.
51+
52+
Each JSON file encapsulates all selected parameters and metadata.
53+
Use this file later when creating the assignment.
54+
55+
### Step 3—Create the Assignment
56+
57+
1. Select **Create audit Policy Assignment**.
58+
59+
2. In the page, define:
60+
61+
- **Scope** (subscription or management group)
62+
63+
- **Assignment name** and optional description
64+
65+
3. Under the **Parameters** tab, locate **Baseline Settings**. You may need to uncheck *"Only show parameters that need input or review"*
66+
67+
[![Screenshot of Baseline Settings parameter configuration.](../../media/deploy-a-baseline-policy-assignment/baseline-settings-parameter-configuration.png)](../../media/deploy-a-baseline-policy-assignment/baseline-settings-parameter-configuration.png#lightbox)
68+
69+
4. Click **Browse** → Upload the JSON file you downloaded earlier.
70+
71+
5. Confirm **Effect** = AuditIfNotExists for compliance tracking.
72+
73+
6. Review and create.
74+
75+
This upload step passes your custom configuration to the BaselineSettings parameter within the relevant built-in policies.
76+
77+
For full assignment options (scope, remediation, noncompliance messages, managed identities), refer to [Assign a policy definition in the Azure portal][03].
78+
79+
## Deploy via Azure CLI or CI/CD Pipeline
80+
81+
For automated policy deployment, you can create the same assignment programmatically using the [Policy-as-code][07] SDK.
82+
83+
### Step 1—Prepare your JSON file
84+
85+
Ensure you download the baseline settings JSON generated from the portal. Example path:
86+
87+
```bash
88+
baselineFile="./CustomizedBaselineSettings.json"
89+
```
90+
91+
### Step 2—Assign the Policy
92+
93+
Use the Azure CLI to deploy the assignment:
94+
95+
```azurecli
96+
az policy assignment create \
97+
--name "CIS-Linux-Baseline-Custom" \
98+
--display-name "CIS Linux Baseline (Customized)" \
99+
--policy "/providers/Microsoft.Authorization/policyDefinitions/cis-linux-baseline" \
100+
--params @"$baselineFile" \
101+
--scope "/subscriptions/<subscription-id>" \
102+
--identity
103+
```
104+
105+
You can find other examples in [Assign policy with Azure CLI][04].
106+
107+
### View Existing Security Baseline Assignments
108+
109+
After deploying your customized baseline, you can verify its status and scope in the **Assignments** tab under **Policy → Machine Configuration** in the Azure portal.
110+
111+
[![Screenshot of policy assignments view showing deployed baseline policies.](../../media/deploy-a-baseline-policy-assignment/policy-assignments-view-deployed-baselines.png)](../../media/deploy-a-baseline-policy-assignment/policy-assignments-view-deployed-baselines.png#lightbox)
112+
113+
This view lists all baseline policy assignments, including their policy definition, management group or subscription, and resource group. You can use filters (for example, by policy name, subscription, or scope) to quickly locate your assignment. Selecting a specific assignment opens its details, where you can review parameter input (such as your imported JSON file), scope, and compliance status once evaluations complete.
114+
115+
> [!NOTE]
116+
> The compliance results in this view correspond to the same audit configuration surfaced in Azure Policy Compliance, ARG, and Guest Assignments—helping you validate that your custom baselines are applied correctly across all target machines.
117+
118+
119+
## Next steps
120+
121+
- [View Machine Configuration compliance reporting][05]
122+
- [Discover and assign built-in Machine Configuration policies][06]
123+
- [Policy as Code with Azure Policy][07]
124+
125+
<!-- Link reference definitions -->
126+
[01]: /azure/azure-arc/servers/overview
127+
[02]: ../../overview.md
128+
[03]: ../../../policy/assign-policy-portal.md
129+
[04]: ../../../policy/assign-policy-azurecli.md
130+
[05]: ../view-compliance.md
131+
[06]: ../assign-built-in-policies.md
132+
[07]: ../../../policy/concepts/policy-as-code.md

‎articles/governance/machine-configuration/how-to/assign-security-baselines/overview-page.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
title: Overview Page
3+
description: Learn how to configure and deploy customizable security baselines for continuous compliance monitoring across Azure and Arc-enabled machines using Azure Policy and Machine Configuration.
4+
ms.date: 11/07/2025
5+
ms.topic: conceptual
6+
---
7+
8+
# Security Baselines Overview
9+
10+
Customizable security baselines built on Azure Policy and Machine Configuration enable organizations to assess, monitor, and continuously improve server compliance against trusted industry benchmarks.
11+
12+
This capability introduces *audit* baselines for both Windows and Linux, empowering customers to align security posture with internal compliance frameworks and regulatory standards. By passing custom baseline parameter input directly into Azure Policy, you can now represent organization-specific controls at scale.
13+
14+
These baselines deliver a cloud-native governance experience for both Azure machines and non-Azure machines connected through [Azure Arc][01]. This includes machines that run on-premises, in other public clouds, or at the edge. Together, Policy and Machine Configuration establish a unified control plane for compliance visibility. This approach enables you to assess, monitor, and enforce consistent security standards across your entire estate, regardless of location or platform. This approach reflects Microsoft's Secure by Design and Secure by Default principles. It helps ensure robust security and compliance everywhere your workloads run.
15+
16+
## Key Scenarios
17+
18+
### Baseline Customization
19+
Create tailored baselines using the *Modify Settings* wizard under **Policy \> Machine Configuration**. Administrators can enable, exclude, or adjust rules from industry benchmarks (such as CIS Benchmarks or Microsoft baselines) to match internal standards. Each customization builds a downloadable JSON file that captures configuration intent—a reusable artifact compatible for policy-as-code workflows.
20+
21+
### Assign Audit Policies
22+
23+
Azure Policy deploys your customized baseline parameters across Azure and Arc-connected machines. When you assign an audit policy, Azure Policy:
24+
- Evaluates configuration states against selected benchmarks
25+
- Reports compliance in real time
26+
- Surfaces findings across Azure Policy, Azure Resource Graph (ARG), and the Guest Assignments view
27+
28+
### Integration and Automation
29+
Integrate baselines into CI/CD pipelines or configuration management workflows. Each baseline produces a declarative settings catalog (JSON) that can be version-controlled and deployed using CLI, ARM, or Bicep templates—ensuring reproducible compliance configurations across environments.
30+
31+
## Supported Standards
32+
33+
| **Standard** | **Description** |
34+
|----|----|
35+
| **Center for Internet Security (CIS) Linux Benchmarks** | Official CIS Benchmarks for all [Azure endorsed Linux distributions][02] in parity with what is published on the [CIS website][03]. |
36+
| **Azure Compute Security Baseline for Windows** | Applies customized values for Windows Server 2022 and Windows Server 2025. |
37+
| **Azure Compute Security Baseline for Linux** | Enforces consistent security controls aligned with Azure Compute guidance. |
38+
39+
40+
## Availability
41+
42+
All public Azure regions are supported.
43+
44+
> [!NOTE]
45+
> Support for Azure Government and Sovereign Clouds is not supported for Public Preview.
46+
47+
## Getting Started
48+
49+
### Process Overview
50+
51+
The end-to-end experience for configuring Customizable Security Baselines follows these high-level steps:
52+
53+
1. **Select a baseline** from the *Machine Configuration* blade under Azure Policy.
54+
55+
2. **Modify settings**—enable, exclude, or parameterize rules to match your internal requirements.
56+
57+
3. **Download the JSON file** representing your configured baseline.
58+
59+
4. **Assign the baseline policy** using the Azure portal, CLI, or CI/CD integration.
60+
61+
5. **Review compliance results** through Azure Policy, Azure Resource Graph, or the Guest Assignments page.
62+
63+
### Prerequisites
64+
65+
- Azure Machine Configuration prerequisite policy initiative must be deployed. The capability enables Guest Configuration policies and installs the required extension on virtual machines (VMs).
66+
67+
- An Azure subscription or management group containing supported Windows and Linux VMs.
68+
69+
- Sufficient permissions to create and assign custom policy definitions (Owner or Resource Policy Contributor roles).
70+
71+
## Next Steps
72+
73+
- [Deploy a baseline policy assignment][04]
74+
- [Specify custom parameters for baseline policy][05]
75+
- [Understand the baseline JSON format][06]
76+
- [View Machine Configuration compliance reporting][07]
77+
- [Discover and assign built-in Machine Configuration policies][08]
78+
79+
<!-- Link reference definitions -->
80+
[01]: /azure/azure-arc/servers/overview
81+
[02]: /azure/virtual-machines/linux/endorsed-distros
82+
[03]: https://www.cisecurity.org/
83+
[04]: ./deploy-a-baseline-policy-assignment.md
84+
[05]: ./specify-custom-parameters-for-baseline-policy.md
85+
[06]: ./understand-baseline-settings-parameter.md
86+
[07]: ../view-compliance.md
87+
[08]: ../assign-built-in-policies.md

0 commit comments

Comments
 (0)