Compute - oWretch/policy GitHub Wiki

Policy Effects by Policy

Category	Policy	Platform	Landing Zones	Production	Decommissioned	Management	Corp	Connectivity	Sandbox	Identity
Compute	Configure disk access resources to use private DNS zones Use private DNS zones to override the DNS resolution for a private endpoint. A private DNS zone links to your virtual network to resolve to a managed disk. Learn more at: https://aka.ms/disksprivatelinksdoc.						DeployIfNotExists Disabled
Compute	Deploy Virtual Machine Auto Shutdown Schedule Deploys an auto shutdown schedule to a virtual machine				deployIfNotExists
Compute	Deploy VM CPU Alert Policy to audit/deploy VM CPU Alert	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Deploy VM Data Disk Read Latency Alert Policy to audit/deploy VM dataDiskReadLatency Alert	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Deploy VM Data Disk Space Alert Policy to audit/deploy VM data Disk Space Alert	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Deploy VM Data Disk Write Latency Alert Policy to audit/deploy VM dataDiskWriteLatency Alert	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Deploy VM HeartBeat Alert Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Deploy VM Memory Alert Policy to audit/deploy VM Memory Alert	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Deploy VM Network Read Alert Policy to audit/deploy VM Network Read Alert	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Deploy VM Network Write Alert Policy to audit/deploy VM Network Out Alert	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Deploy VM OS Disk Read Latency Alert Policy to audit/deploy VM OSDiskreadLatency Alert	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Deploy VM OS Disk Space Alert Policy to audit/deploy VM OSDiskSpace Alert	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Deploy VM OS Disk Write Latency Alert Policy to audit/deploy VM OSDiskwriteLatency Alert	deployIfNotExists disabled	deployIfNotExists disabled
Compute	Managed disks should be double encrypted with both platform-managed and customer-managed keys High security sensitive customers who are concerned of the risk associated with any particular encryption algorithm, implementation, or key being compromised can opt for additional layer of encryption using a different encryption algorithm/mode at the infrastructure layer using platform managed encryption keys. The disk encryption sets are required to use double encryption. Learn more at https://aka.ms/disks-doubleEncryption.	Deny Disabled Audit	Deny Disabled Audit
Compute	Managed disks should disable public network access Disabling public network access improves security by ensuring that a managed disk isn't exposed on the public internet. Creating private endpoints can limit exposure of managed disks. Learn more at: https://aka.ms/disksprivatelinksdoc.						Audit Disabled
Compute	OS and data disks should be encrypted with a customer-managed key Use customer-managed keys to manage the encryption at rest of the contents of your managed disks. By default, the data is encrypted at rest with platform-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at https://aka.ms/disks-cmk.	Deny Disabled Audit	Deny Disabled Audit
Compute	Virtual machines and virtual machine scale sets should have encryption at host enabled Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk. Learn more at https://aka.ms/vm-hbe.	Deny Disabled Audit	Deny Disabled Audit	Audit Deny Disabled
Compute	Virtual machines should be migrated to new Azure Resource Manager resources Use new Azure Resource Manager for your virtual machines to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management			Audit Deny Disabled

Policy Parameters by Policy

Category	Policy	Platform	Landing Zones	Production	Decommissioned	Management	Corp	Connectivity	Sandbox	Identity
Compute	Configure disk access resources to use private DNS zones Use private DNS zones to override the DNS resolution for a private endpoint. A private DNS zone links to your virtual network to resolve to a managed disk. Learn more at: https://aka.ms/disksprivatelinksdoc.						azureDiskAccessPrivateDnsZoneId = `--DNSZonePrefix--privatelink.blob.core....`
Compute	Deploy VM CPU Alert Policy to audit/deploy VM CPU Alert	VMPercentCPUThreshold = `85` VMPercentCPUOperator = `GreaterThan` VMPercentCPUAlertState = `true` VMPercentCPUFailingPeriods = `1` VMPercentCPUAutoResolveTime = `00:10:00` VMPercentCPUTimeAggregation = `Count` VMPercentCPUWindowSize = `PT15M` VMPercentCPUAutoMitigate = `true` VMPercentCPUAutoResolve = `true` VMPercentCPUEvaluationFrequency = `PT5M` VMPercentCPUAlertSeverity = `2`	VMPercentCPUThreshold = `85` VMPercentCPUOperator = `GreaterThan` VMPercentCPUAlertState = `true` VMPercentCPUFailingPeriods = `1` VMPercentCPUAutoResolveTime = `00:10:00` VMPercentCPUTimeAggregation = `Count` VMPercentCPUWindowSize = `PT15M` VMPercentCPUAutoMitigate = `true` VMPercentCPUAutoResolve = `true` VMPercentCPUEvaluationFrequency = `PT5M` VMPercentCPUAlertSeverity = `2`
Compute	Deploy VM Data Disk Read Latency Alert Policy to audit/deploy VM dataDiskReadLatency Alert	VMDataDiskReadLatencyEvaluationPeriods = `1` VMDataDiskReadLatencyEvaluationFrequency = `PT5M` VMDataDiskReadLatencyWindowSize = `PT15M` VMDataDiskReadLatencyThreshold = `30` VMDataDiskReadLatencyAutoResolve = `true` VMDataDiskReadLatencyAlertSeverity = `2` VMDataDiskReadLatencyOperator = `GreaterThan` VMDataDiskReadLatencyTimeAggregation = `Count` VMDataDiskReadLatencyAutoResolveTime = `00:10:00` VMDataDiskReadLatencyComputersToInclude = *`[""]` VMDataDiskReadLatencyAlertState = `true` VMDataDiskReadLatencyAutoMitigate = `true` VMDataDiskReadLatencyFailingPeriods = `1`**	VMDataDiskReadLatencyEvaluationPeriods = `1` VMDataDiskReadLatencyEvaluationFrequency = `PT5M` VMDataDiskReadLatencyWindowSize = `PT15M` VMDataDiskReadLatencyThreshold = `30` VMDataDiskReadLatencyAutoResolve = `true` VMDataDiskReadLatencyAlertSeverity = `2` VMDataDiskReadLatencyOperator = `GreaterThan` VMDataDiskReadLatencyTimeAggregation = `Count` VMDataDiskReadLatencyAutoResolveTime = `00:10:00` VMDataDiskReadLatencyComputersToInclude = *`[""]` VMDataDiskReadLatencyAlertState = `true` VMDataDiskReadLatencyAutoMitigate = `true` VMDataDiskReadLatencyFailingPeriods = `1`**
Compute	Deploy VM Data Disk Space Alert Policy to audit/deploy VM data Disk Space Alert	VMDataDiskSpaceEvaluationPeriods = `1` VMDataDiskSpaceFailingPeriods = `1` VMDataDiskSpaceAlertSeverity = `2` VMDataDiskSpaceAutoResolve = `true` VMDataDiskSpaceOperator = `GreaterThan` VMDataDiskSpaceWindowSize = `PT15M` VMDataDiskSpaceAutoMitigate = `true` VMDataDiskSpaceThreshold = `10` VMDataDiskSpaceAlertState = `true` VMDataDiskSpaceTimeAggregation = `Count` VMDataDiskSpaceComputersToInclude = *`[""]` VMDataDiskSpaceEvaluationFrequency = `PT5M` VMDataDiskSpaceAutoResolveTime = `00:10:00`**	VMDataDiskSpaceEvaluationPeriods = `1` VMDataDiskSpaceFailingPeriods = `1` VMDataDiskSpaceAlertSeverity = `2` VMDataDiskSpaceAutoResolve = `true` VMDataDiskSpaceOperator = `GreaterThan` VMDataDiskSpaceWindowSize = `PT15M` VMDataDiskSpaceAutoMitigate = `true` VMDataDiskSpaceThreshold = `10` VMDataDiskSpaceAlertState = `true` VMDataDiskSpaceTimeAggregation = `Count` VMDataDiskSpaceComputersToInclude = *`[""]` VMDataDiskSpaceEvaluationFrequency = `PT5M` VMDataDiskSpaceAutoResolveTime = `00:10:00`**
Compute	Deploy VM Data Disk Write Latency Alert Policy to audit/deploy VM dataDiskWriteLatency Alert	VMDataDiskWriteLatencyAlertSeverity = `2` VMDataDiskWriteLatencyWindowSize = `PT15M` VMDataDiskWriteLatencyEvaluationPeriods = `1` VMDataDiskWriteLatencyThreshold = `30` VMDataDiskWriteLatencyComputersToInclude = *`[""]` VMDataDiskWriteLatencyAutoResolve = `true` VMDataDiskWriteLatencyFailingPeriods = `1` VMDataDiskWriteLatencyTimeAggregation = `Count` VMDataDiskWriteLatencyAutoResolveTime = `00:10:00` VMDataDiskWriteLatencyAutoMitigate = `true` VMDataDiskWriteLatencyOperator = `GreaterThan` VMDataDiskWriteLatencyEvaluationFrequency = `PT5M` VMDataDiskWriteLatencyAlertState = `true`**	VMDataDiskWriteLatencyAlertSeverity = `2` VMDataDiskWriteLatencyWindowSize = `PT15M` VMDataDiskWriteLatencyEvaluationPeriods = `1` VMDataDiskWriteLatencyThreshold = `30` VMDataDiskWriteLatencyComputersToInclude = *`[""]` VMDataDiskWriteLatencyAutoResolve = `true` VMDataDiskWriteLatencyFailingPeriods = `1` VMDataDiskWriteLatencyTimeAggregation = `Count` VMDataDiskWriteLatencyAutoResolveTime = `00:10:00` VMDataDiskWriteLatencyAutoMitigate = `true` VMDataDiskWriteLatencyOperator = `GreaterThan` VMDataDiskWriteLatencyEvaluationFrequency = `PT5M` VMDataDiskWriteLatencyAlertState = `true`**
Compute	Deploy VM HeartBeat Alert Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription	VMHeartBeatRGAlertSeverity = `1` VMHeartBeatRGComputersToInclude = *`[""]` ALZMonitorResourceGroupLocation = `eastus` VMHeartBeatRGTimeAggregation = `Count` VMHeartBeatRGEvaluationFrequency = `PT5M` VMHeartBeatRGAutoResolveTime = `00:10:00` VMHeartBeatRGAutoResolve = `true` VMHeartBeatRGAlertState = `true` VMHeartBeatRGAutoMitigate = `true` VMHeartBeatRGFailingPeriods = `1` VMHeartBeatRGOperator = `GreaterThan` VMHeartBeatRGWindowSize = `PT6H` VMHeartBeatRGThreshold = `10` ALZMonitorResourceGroupName = `rg-amba-monitoring-001` ALZMonitorResourceGroupTags = `{"Project":"amba-monitoring"}`**	VMHeartBeatRGAlertSeverity = `1` VMHeartBeatRGComputersToInclude = *`[""]` VMHeartBeatRGTimeAggregation = `Count` VMHeartBeatRGEvaluationFrequency = `PT5M` VMHeartBeatRGAutoResolveTime = `00:10:00` VMHeartBeatRGAutoResolve = `true` VMHeartBeatRGAlertState = `true` VMHeartBeatRGAutoMitigate = `true` VMHeartBeatRGFailingPeriods = `1` VMHeartBeatRGOperator = `GreaterThan` VMHeartBeatRGWindowSize = `PT6H` VMHeartBeatRGThreshold = `10`**
Compute	Deploy VM Memory Alert Policy to audit/deploy VM Memory Alert	VMPercentMemoryAlertState = `true` VMPercentMemoryOperator = `GreaterThan` VMPercentMemoryWindowSize = `PT15M` VMPercentMemoryFailingPeriods = `1` VMPercentMemoryEvaluationFrequency = `PT5M` VMPercentMemoryAutoMitigate = `true` VMPercentMemoryThreshold = `10` VMPercentMemoryAlertSeverity = `2` VMPercentMemoryTimeAggregation = `Count` VMPercentMemoryAutoResolve = `true` VMPercentMemoryAutoResolveTime = `00:10:00`	VMPercentMemoryAlertState = `true` VMPercentMemoryOperator = `GreaterThan` VMPercentMemoryWindowSize = `PT15M` VMPercentMemoryFailingPeriods = `1` VMPercentMemoryEvaluationFrequency = `PT5M` VMPercentMemoryAutoMitigate = `true` VMPercentMemoryThreshold = `10` VMPercentMemoryAlertSeverity = `2` VMPercentMemoryTimeAggregation = `Count` VMPercentMemoryAutoResolve = `true` VMPercentMemoryAutoResolveTime = `00:10:00`
Compute	Deploy VM Network Read Alert Policy to audit/deploy VM Network Read Alert	VMNetworkInAutoMitigate = `true` VMNetworkInAlertState = `true` VMNetworkInWindowSize = `PT15M` VMNetworkInEvaluationFrequency = `PT5M` VMNetworkInTimeAggregation = `Count` VMNetworkInAutoResolve = `true` VMNetworkInComputersToInclude = *`[""]` VMNetworkInAutoResolveTime = `00:10:00` VMNetworkInThreshold = `10000000` VMNetworkInOperator = `GreaterThan` VMNetworkInAlertSeverity = `2` VMNetworkInEvaluationPeriods = `1` VMNetworkInFailingPeriods = `1`**	VMNetworkInAutoMitigate = `true` VMNetworkInAlertState = `true` VMNetworkInWindowSize = `PT15M` VMNetworkInEvaluationFrequency = `PT5M` VMNetworkInTimeAggregation = `Count` VMNetworkInAutoResolve = `true` VMNetworkInComputersToInclude = *`[""]` VMNetworkInAutoResolveTime = `00:10:00` VMNetworkInThreshold = `10000000` VMNetworkInOperator = `GreaterThan` VMNetworkInAlertSeverity = `2` VMNetworkInEvaluationPeriods = `1` VMNetworkInFailingPeriods = `1`**
Compute	Deploy VM Network Write Alert Policy to audit/deploy VM Network Out Alert	VMNetworkOutEvaluationPeriods = `1` VMNetworkOutAutoMitigate = `true` VMNetworkOutEvaluationFrequency = `PT5M` VMNetworkOutAutoResolveTime = `00:10:00` VMNetworkOutAutoResolve = `true` VMNetworkOutComputersToInclude = *`[""]` VMNetworkOutTimeAggregation = `Count` VMNetworkOutAlertSeverity = `2` VMNetworkOutFailingPeriods = `1` VMNetworkOutThreshold = `10000000` VMNetworkOutOperator = `GreaterThan` VMNetworkOutAlertState = `true` VMNetworkOutWindowSize = `PT15M`**	VMNetworkOutEvaluationPeriods = `1` VMNetworkOutAutoMitigate = `true` VMNetworkOutEvaluationFrequency = `PT5M` VMNetworkOutAutoResolveTime = `00:10:00` VMNetworkOutAutoResolve = `true` VMNetworkOutComputersToInclude = *`[""]` VMNetworkOutTimeAggregation = `Count` VMNetworkOutAlertSeverity = `2` VMNetworkOutFailingPeriods = `1` VMNetworkOutThreshold = `10000000` VMNetworkOutOperator = `GreaterThan` VMNetworkOutAlertState = `true` VMNetworkOutWindowSize = `PT15M`**
Compute	Deploy VM OS Disk Read Latency Alert Policy to audit/deploy VM OSDiskreadLatency Alert	VMOSDiskReadLatencyAlertState = `true` VMOSDiskReadLatencyWindowSize = `PT15M` VMOSDiskReadLatencyAutoResolve = `true` VMOSDiskReadLatencyEvaluationFrequency = `PT5M` VMOSDiskReadLatencyTimeAggregation = `Count` VMOSDiskReadLatencyFailingPeriods = `1` VMOSDiskReadLatencyEvaluationPeriods = `1` VMOSDiskReadLatencyAlertSeverity = `2` VMOSDiskReadLatencyAutoResolveTime = `00:10:00` VMOSDiskReadLatencyOperator = `GreaterThan` VMOSDiskReadLatencyComputersToInclude = *`[""]` VMOSDiskReadLatencyAutoMitigate = `true` VMOSDiskReadLatencyThreshold = `30`**	VMOSDiskReadLatencyAlertState = `true` VMOSDiskReadLatencyWindowSize = `PT15M` VMOSDiskReadLatencyAutoResolve = `true` VMOSDiskReadLatencyEvaluationFrequency = `PT5M` VMOSDiskReadLatencyTimeAggregation = `Count` VMOSDiskReadLatencyFailingPeriods = `1` VMOSDiskReadLatencyEvaluationPeriods = `1` VMOSDiskReadLatencyAlertSeverity = `2` VMOSDiskReadLatencyAutoResolveTime = `00:10:00` VMOSDiskReadLatencyOperator = `GreaterThan` VMOSDiskReadLatencyComputersToInclude = *`[""]` VMOSDiskReadLatencyAutoMitigate = `true` VMOSDiskReadLatencyThreshold = `30`**
Compute	Deploy VM OS Disk Space Alert Policy to audit/deploy VM OSDiskSpace Alert	VMOSDiskSpaceAlertState = `true` VMOSDiskSpaceEvaluationFrequency = `PT5M` VMOSDiskSpaceAutoResolveTime = `00:10:00` VMOSDiskSpaceFailingPeriods = `1` VMOSDiskSpaceAutoMitigate = `true` VMOSDiskSpaceOperator = `GreaterThan` VMOSDiskSpaceThreshold = `10` VMOSDiskSpaceComputersToInclude = *`[""]` VMOSDiskSpaceEvaluationPeriods = `1` VMOSDiskSpaceAutoResolve = `true` VMOSDiskSpaceAlertSeverity = `2` VMOSDiskSpaceWindowSize = `PT15M` VMOSDiskSpaceTimeAggregation = `Count`**	VMOSDiskSpaceAlertState = `true` VMOSDiskSpaceEvaluationFrequency = `PT5M` VMOSDiskSpaceAutoResolveTime = `00:10:00` VMOSDiskSpaceFailingPeriods = `1` VMOSDiskSpaceAutoMitigate = `true` VMOSDiskSpaceOperator = `GreaterThan` VMOSDiskSpaceThreshold = `10` VMOSDiskSpaceComputersToInclude = *`[""]` VMOSDiskSpaceEvaluationPeriods = `1` VMOSDiskSpaceAutoResolve = `true` VMOSDiskSpaceAlertSeverity = `2` VMOSDiskSpaceWindowSize = `PT15M` VMOSDiskSpaceTimeAggregation = `Count`**
Compute	Deploy VM OS Disk Write Latency Alert Policy to audit/deploy VM OSDiskwriteLatency Alert	VMOSDiskWriteLatencyFailingPeriods = `1` VMOSDiskWriteLatencyAlertState = `true` VMOSDiskWriteLatencyAutoResolveTime = `00:10:00` VMOSDiskWriteLatencyAutoMitigate = `true` VMOSDiskWriteLatencyEvaluationFrequency = `PT5M` VMOSDiskWriteLatencyAlertSeverity = `2` VMOSDiskWriteLatencyOperator = `GreaterThan` VMOSDiskWriteLatencyTimeAggregation = `Count` VMOSDiskWriteLatencyAutoResolve = `true` VMOSDiskWriteLatencyComputersToInclude = *`[""]` VMOSDiskWriteLatencyWindowSize = `PT15M` VMOSDiskWriteLatencyThreshold = `30` VMOSDiskWriteLatencyEvaluationPeriods = `1`**	VMOSDiskWriteLatencyFailingPeriods = `1` VMOSDiskWriteLatencyAlertState = `true` VMOSDiskWriteLatencyAutoResolveTime = `00:10:00` VMOSDiskWriteLatencyAutoMitigate = `true` VMOSDiskWriteLatencyEvaluationFrequency = `PT5M` VMOSDiskWriteLatencyAlertSeverity = `2` VMOSDiskWriteLatencyOperator = `GreaterThan` VMOSDiskWriteLatencyTimeAggregation = `Count` VMOSDiskWriteLatencyAutoResolve = `true` VMOSDiskWriteLatencyComputersToInclude = *`[""]` VMOSDiskWriteLatencyWindowSize = `PT15M` VMOSDiskWriteLatencyThreshold = `30` VMOSDiskWriteLatencyEvaluationPeriods = `1`**

⚠️ GitHub.com Fallback ⚠️