After creating the VM, I should see that periodic assesment option to be enabled a when I navigate to update section. how it can be achieved?

Hi , Thanks to reaching us Enable Periodic Assessment for your Azure machines by using Azure Policy Go to Policy in the Azure portal and select Authoring > Definitions . From the Category dropdown, select Update Manager . Select Configure periodic checking for missing system updates on Azure virtual machines for Azure machines. When Policy definition opens, select Assign . On the Basics tab, select your subscription as your scope. You can also specify a resource group within your subscription as the scope. Select Next . On the Parameters tab, clear Only show parameters that need input or review so that you can see the values of parameters. In Assessment mode, select AutomaticByPlatform > Operating system > Next . You need to create separate policies for Windows and Linux. On the Remediation tab, select Create a remediation task so that periodic assessment is enabled on your machines. Select Next . On the Non-compliance message tab, provide the message that you want to see if there was noncompliance. For example, use Your machine doesn't have periodic assessment enabled. Select Review + Create. On the Review + Create tab, select Create to trigger Assignment and Remediation Task creation, which can take a minute or so. You can monitor the compliance of resources under Compliance and remediation status under Remediation on the Azure Policy home page. **OR** Also, you can do from Update Manager to control the update settings on your Azure virtual machines (VMs) a for one or more machines. Sign in to the Azure portal . In Azure Update Manager , select Overview , select your Subscription , and select Update settings . In Change update settings , select +Add machine to select the machine for which you want to change the update settings. In Select resources , select the machine and select Add . In the Change update settings page, you will see the machine classified as per the operating system with the list of following updates that you can select and apply. The following update settings are available for configuration for the selected machines: Periodic assessment : The periodic assessment is set to run every 24 hours. You can either enable or disable this setting. Please find the docs https://learn.microsoft.com/en-us/azure/update-manager/manage-update-settings?tabs=manage-single-overview%2Cmanage-scale-overview https://learn.microsoft.com/en-us/azure/update-manager/periodic-assessment-at-scale Kindly accept answer , if it helps , Thanks!

In addition to the azure policy and update setting routes in portal, you can setup an automation like Azure automation runbooks, Azure Functions to periodically check if any vms are there with periodic assessment not enabled. If yes, please trigger api calls to enable periodic assessment. You can also setup a log search alert rule to query vms which do not have periodic assessment set, so whenever this is found, an alert will fire and as an action on that alert trigger an automation runbook/azure function/webhook etc. via action groups to enable periodic assessment. You can also receive emails/sms etc. via action groups.

Enabling periodic assessment automatically for the VM

Accepted answer

Deepanshukatara-6769 10,300 Reputation points

2024-03-30T11:14:17.15+00:00
Hi , Thanks to reaching us

Enable Periodic Assessment for your Azure machines by using Azure Policy

Go to Policy in the Azure portal and select Authoring > Definitions.

From the Category dropdown, select Update Manager. Select Configure periodic checking for missing system updates on Azure virtual machines for Azure machines.

When Policy definition opens, select Assign.

On the Basics tab, select your subscription as your scope. You can also specify a resource group within your subscription as the scope. Select Next.

On the Parameters tab, clear Only show parameters that need input or review so that you can see the values of parameters. In Assessment mode, select AutomaticByPlatform > Operating system > Next. You need to create separate policies for Windows and Linux.

On the Remediation tab, select Create a remediation task so that periodic assessment is enabled on your machines. Select Next.

On the Non-compliance message tab, provide the message that you want to see if there was noncompliance. For example, use Your machine doesn't have periodic assessment enabled. Select Review + Create.

On the Review + Create tab, select Create to trigger Assignment and Remediation Task creation, which can take a minute or so.

You can monitor the compliance of resources under Compliance and remediation status under Remediation on the Azure Policy home page.

**OR**

Also, you can do from Update Manager to control the update settings on your Azure virtual machines (VMs) a for one or more machines.

Sign in to the Azure portal.

In Azure Update Manager, select Overview, select your Subscription, and select Update settings.

In Change update settings, select +Add machine to select the machine for which you want to change the update settings.

In Select resources, select the machine and select Add.

In the Change update settings page, you will see the machine classified as per the operating system with the list of following updates that you can select and apply. The following update settings are available for configuration for the selected machines: Periodic assessment: The periodic assessment is set to run every 24 hours. You can either enable or disable this setting.

Please find the docs https://learn.microsoft.com/en-us/azure/update-manager/manage-update-settings?tabs=manage-single-overview%2Cmanage-scale-overview

https://learn.microsoft.com/en-us/azure/update-manager/periodic-assessment-at-scale

Kindly accept answer , if it helps , Thanks!
Please sign in to rate this answer.
Varma 1,385 Reputation points

2024-03-30T13:21:49.54+00:00

HI Deepanshu,

Thank you.

Could you Please clarify my 3 follow up questions:

1.

What is the purpose of remediate task enabled? what would happened if I don't select?

2.

and so by enabling this periodic assessment using policy, so can I expect that when VM gets created manually automatically periodic assement will be enabled? if so can you share any MS document mentioning that?

last one I see in the above document it can also be done using update manager, but still that involves selecting machine manually and add the machine, this process is still manual , am i correct?

Deepanshukatara-6769 10,300 Reputation points

2024-03-30T13:59:13.0566667+00:00

Sure, I'd be happy to clarify your follow-up questions:

Purpose of Remediation Task: Enabling the remediation task ensures that any non-compliant resources identified during the periodic assessment are automatically brought into compliance. If you choose not to select this option, non-compliant resources will not be remediated automatically. Essentially, without the remediation task enabled, you would need to manually address any non-compliance issues identified during the assessment.

Automatic Periodic Assessment with Azure Policy: Enabling periodic assessment using Azure Policy does not automatically trigger the assessment for newly created VMs. You would need to specifically configure policies to target newly created VMs. with Azure Policy, you would set up policies at the subscription or resource group level you which should apply to new VMs as they are created within those scopes.

Manual Process with Update Manager: Yes, you are correct that configuring periodic assessment using Azure Update Manager involves a manual process of selecting and adding machines. This means you would need to manually specify which machines you want to include in the assessment. However, it provides more granular control over individual machines compared to Azure Policy, which operates at a broader scope.

As requested , Doc for creating/assigning policy in Azure through portal https://learn.microsoft.com/en-us/azure/governance/policy/assign-policy-portal

Please accept ,if it works now for you, Thanks in advance

Varma 1,385 Reputation points

2024-03-30T15:58:54.6433333+00:00

HI Deepanshu,

Could you please provide more info on first 2 points:

1.

On what we assess machine as non compliant?

and how do and where do we check whether machine is non compliant or not?

2.

I am not clear on this. suppose i created periodic assessment policy at the subscription level and then after couple of minutes I created VM in that subscription, then will that machine will have periodic assessment enabled? ( i should not go and enable that periodic assessment for that VM)

Deepanshukatara-6769 10,300 Reputation points

2024-03-30T16:46:35.8833333+00:00

Hi,

Answering on 1st point -->

. The Azure Policy dashboard displays results from Azure Policy evaluations. This data keeps you informed about the compliance status of your resources and we can asses machine as non complaint on all things we define in policy definitions for example if you have a policy that mandates all virtual machines must have encryption enabled, any VM found without encryption enabled would be assessed as non-compliant.

Refer doc -->https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/virtual-machines-windows-virtual-machines-security-baseline

Answering on2nd point -->

When you create a periodic assessment policy at the subscription level, it applies to all resources within that subscription, including virtual machines created after the policy is set up. Therefore, if you create a VM in a subscription where a periodic assessment policy is already defined, the VM will automatically be subject to the assessment without requiring additional configuration.

This means that the periodic assessment policy will be applied to the VM as soon as it's created, and you don't need to manually enable the assessment for each individual VM. The policy will govern the assessment process for all resources within the subscription, ensuring consistent compliance monitoring across your environment

NOTE: A resource is deployed to or updated within a scope with an assignment via Azure Resource Manager, REST API, or a supported SDK. In this scenario, the effect event (append, audit, deny, deploy) and compliant status information for the individual resource becomes available in the portal and SDKs around 15 minutes later. This event doesn't cause an evaluation of other resources

Refer doc --> https://learn.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data#evaluation-triggers

I hope this answers to your questions , if yes , please accept and Thanks!

Varma 1,385 Reputation points

2024-03-31T03:59:50.08+00:00

HI Deepanshu,

Regarding 1st point, so when policy enabled, then only compilane comes in to picuture, otherwise no? I want to know where exactly we do check if machine is not compliance?

Regarding 2nd point when perodic policy enabled, and then I will create VM, i understand perodic assessment will be enabled, but could you provide me exact document for this , above document is referring different one. Thank you.

Deepanshukatara-6769 10,300 Reputation points

2024-03-31T06:08:27.92+00:00

Hi ,

Regarding 1st point , if you check this https://learn.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data you can find out all data of compliance/non-compliance in Azure Policy dashboard

Regarding 2 Point --> if you in the above doc https://learn.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data#evaluation-triggers itself , you can see this point regarding your query

Varma 1,385 Reputation points

2024-03-31T09:40:50.4033333+00:00

Hi Deepanshu,

I am on clear on first point.

regarding 2nd point, what you have highlighted that para is talking about specific to compliance status but not abut specific to enabling periodic assessment specifically? could you please clarify on this?

Deepanshukatara-6769 10,300 Reputation points

2024-03-31T12:03:58.76+00:00

Hi, Let me explain you in detail

The option "AutomaticByPlatform" mentioned in below do typically refers to a configuration in Azure Policy that allows for automatic platform detection (Windows or Linux) when applying policies to virtual machines (VMs). When you select this option and specify the operating system, Azure Policy will automatically apply the appropriate policies based on the detected platform when VMs are assessed.

Here's how the process generally works:

Policy Configuration: You define policies that you want to apply to your VMs. These policies could include security configurations, tagging requirements, compliance standards, or any other rules you want to enforce.

Automatic Platform Detection: When configuring policy assignments in Azure Policy, you may have the option to choose "AutomaticByPlatform" for assessment. This option instructs Azure Policy to automatically detect the platform (Windows or Linux) of the VMs being assessed.

Separate Policies for Windows and Linux: Depending on your requirements, you may need to create separate policies for Windows and Linux VMs. This allows you to define platform-specific rules or configurations. For example, security settings may differ between Windows and Linux environments.

Policy Assignment: You assign these policies to the appropriate scope within your Azure environment, such as resource groups, subscriptions, or management groups.

Automatic Assessment: Azure Policy continuously evaluates resources against the assigned policies. When new VMs are created, Azure Policy automatically assesses them based on the configured assessment settings, including the "AutomaticByPlatform" option.

Ref doc -->https://learn.microsoft.com/en-us/azure/update-manager/tutorial-assessment-deployment-using-policy

If its clear , please accept and if not , I could connect with you over meeting and explain the same , Thanks!

Varma 1,385 Reputation points

2024-03-31T16:38:09.9233333+00:00

HI Deepanshu,

Thank you for sharing

My requirement is simple, I want below periodic assessment to enabled automatically as soon as I create the VM. and If I go and navigate to below update settings, I should see periodic assessment enabled after I created VM manually. is it possible?

1.

For that what are the steps to be followed?

2.

ours windows and linux machine, so I need to create 2 polices here? to full my requirement?

I am not seeing assessment option when I tried to create a policy as below

where is the assesment option below?

SwathiDhanwada-MSFT 18,771 Reputation points

2024-04-01T06:03:46.1333333+00:00

@Varma In Parameters section, uncheck "Only show parameters that need input or review". You can view the suggested options.

Varma 1,385 Reputation points

2024-04-01T06:12:01.6533333+00:00

Hi Swathi,

Yes, now i have unchecked above option you are referring, and created the policy

and then after creating the policy and i created VM, how long it will take for VM to make periodic assesment to get enabled?

and looks like there i have to create same policy for window machines separately and linux machine separately since I see option either to choose windows or linux when I was trying to create policy.

SwathiDhanwada-MSFT 18,771 Reputation points

2024-04-01T06:29:39.2566667+00:00

@Varma A new policy or initiative assignment takes about five minutes to be applied. New or updated resources within scope of an existing assignment become available in about 15 minutes. A standard compliance scan occurs every 24 hours. For more information, see evaluation triggers. Yes, you need to assign separate policies for windows and linux machines.

Varma 1,385 Reputation points

2024-04-01T06:35:20.6966667+00:00

Hi Swathi,

Yes, I see new VM it is taking less than 5 minutes to get that policy appled. thank you

and what about windows and linux machines , do we need to create separate same policy for windows and linux machines?

SwathiDhanwada-MSFT 18,771 Reputation points

2024-04-01T06:54:13.99+00:00

@Varma Yes, you need to create separate policies for Windows and Linux.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.