Describe features and tools in Azure for governance and compliance

Question 1

Az

Azure Blueprints

Answer 1

-Easily create, deploy, and update compliant environments

Package of various Azure components (artifacts):
-Resource Groups
-ARM Templates
-Policy Assignments
-Role Assignments

-Centralized storage for organizationally approved design patterns
-Blueprint definition – describing what should happen (reusable package)
-Blueprint assignment – describing where it should happen (package deployment)

Question 2

Azure Policy

Answer 2

-Designed to help with resource governance, security, compliance, cost management, etc.
-Policies focus on resource properties (RBAC focused on user actions)

Policy definition – Defines what should happen:
-Define the condition (if/else) and the effect (deny, audit, append, modify, etc.)
-Examples include allowed resource types, allowed locations, allowed SKUs, inherit resource tags

-Built-in and custom policies are supported
-Policy initiative – a group of policy definitions
-Policy assignment – assignment of a policy definition/initiative to a scope

-Scopes can be assigned to: management groups, subscriptions, resource groups, and
resources
-Policies allow for exclusions of scopes
-Checked during resource creation or updates and existing ones with remediation tasks

Question 3

Azure Resource Lock

Answer 3

-Designed to prevent accidental deletion and/or modification
-Used in conjunction with RBAC

Two types of locks:
-Read-only (ReadOnly) – only read actions are allowed
-Delete (CanNotDelete) – all actions except delete are allowed

-Scopes are hierarchical (inherited)
–Subscriptions > Resource Groups > Resources

-Management Groups can’t be locked
-Only Owner and User Access Administrator roles can manage locks (built-in roles)

Question 4

Service Trust Portal (STP)

Answer 4

Is a critical component of Microsoft’s commitment to transparency, security, and compliance in its cloud services, including Azure, Microsoft 365, and Dynamics 365.

The purpose of the Service Trust Portal is to provide customers with essential information, reports, and resources related to the security, compliance, and privacy practices of Microsoft’s cloud services.