Whats new · AzureEnterprise-Scale Wiki

Whats new

Jump to bottom

github-actions edited this page Apr 26, 2023 · 116 revisions

In this Section

• In this Section
• Updates
  • April 2023
  • March 2023
  • February 2023
  • January 2023
  • December 2022
  • November 2022
  • October 2022
  • September 2022
  • August 2022
  • July 2022
  • June 2022
  • May 2022
  • April 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • August 2021
  • July 2021
  • June 2021

Enterprise Scale/Azure Landing Zones is updated regularly. This page is where you'll find out about the latest updates to Enterprise Scale/Azure Landing Zones for:

• CAF (Cloud Adoption Framework) Documentation Updates
  • Check out the CAF specific What's new in the Microsoft Cloud Adoption Framework for Azure page
• Improvements to existing guidance and artifacts
• Azure Policy changes
• Bug fixes
• Tooling updates:
  • AzOps
    • Releases
  • Terraform Module for Cloud Adoption Framework Enterprise-scale
    • Releases
  • ALZ-Bicep Modules
    • Releases

Note: Please check the latest release notes for each of the tools, as these will contain more detailed notes relating to changes in each of the tools.

This article will be updated as and when changes are made to the above and anything else of relevance for Enterprise Scale/Azure Landing Zones. Make sure to check back here often to keep up with new updates and changes.

Important: Previous changes to the above in relation to Enterprise Scale will not be listed here. However going forward, this page will be updated.

Updates

Here's what's changed in Enterprise Scale/Azure Landing Zones:

April 2023

We are pleased to announce that we are starting regular Azure Policy reviews for Azure Landing Zone. This includes a review of new built-in policies released and their suitability for ALZ, built-in policies that can replace custom ALZ policies, built-in policies that have been deprecated and addition of new ALZ custom policies and initiatives as identified based on best practices, issues raised and customer feedback. Most importantly, we have also provided default assignments for all the new policies at the appropriate ALZ Management Group level. This will ensure that all new policies are automatically assigned to the appropriate scope and will be in compliance with the ALZ baseline. This will also ensure that the ALZ is always up to date with the latest Azure Policy definitions.

This update includes many ALZ Azure Policies and Initiatives that have been added or updated to enhance the security, governance, and management of ALZ. As part of our commitment to continuous improvement, we have also enhanced our policy review process, with a focus on transitioning away from deprecated policies where possible, move from custom to built-in policies providing the same or enhanced functionality, and implementing new policies to keep ALZ as part of the current review cycle. We have also implemented non-compliance messages where supported to provide a better user experience when a policy is non-compliant.

This is the first major review and refresh of Azure Policy since ALZ was GA'd. Since GA many new built-in policies and initiatives have been released which has driven the need for this review. We believe that a regular review cycle will allow us to stay on top of emerging trends and new policies, ensuring that our Azure environment remains secure and compliant. Should you identify policies or initiatives that should be considered for ALZ, kindly submit an GitHub issue. For more information, please refer to the ALZ Policies or the new Excel spreadsheet version.

We strongly advise staying up-to-date to ensure the best possible security posture for your Azure environment, see Keep your Azure landing zone up to date. For those with existing deployments or policies, we have provided Brownfield guidance to help you navigate the process of updating to the latest policies. We recognize that there may be breaking changes when upgrading an existing deployment or policies and for details follow our recently released guidance to support you in this process:

• Update Azure landing zone custom policies
• Migrate Azure landing zone policies to Azure built-in policies

Please note that, in some cases, moving to the new Built-In Policy definitions, deploying changes to existing custom policies or removing deprecated policies will require a new Policy Assignment and removing the previous Policy Assignment, which will mean compliance history for the Policy Assignment will be lost. However, if you have configured your Activity Logs and Security Center to export to a Log Analytics Workspace, Policy Assignment historic data will be stored here as per the retention duration configured. Thank you for your cooperation, and we look forward to continuing to work with you to ensure the security and compliance of our Azure environment.

While we've made every effort to test the stability of this release, should you have any issues and the guidance provided does not resolve your issue, please open a GitHub issue so we can do our best to support you and document the fix for others.

Policy

Breaking Changes

Note that a number of initiatives have been updated that will fail to deploy if you have existing deployments. This is due to the fact that the number of parameters and default values have changed, as we've added or removed policies from the initiative. To resolve this, you will need to remove the existing initiative assignments and then redeploy the updated initiative.

New

• New Initiative for the Decommissioned landingzones including policies:
  • Initiative name: Enforce-ALZ-Decomm
    • Allowed resource types - resources are not allowed to be deployed, however, authorization, lock and tag management are permitted.
    • New policy to deploy an auto shutdown policy for virtual machines - Deploy-Vm-autoShutdown
    • Portal accelerator updated with additional tab and options to enable this initiative.
• New Initiative for the Sandboxes landingzones including policies:
  • Initiative name: Enforce-ALZ-Sanbox
    • Not allowed resource types - blocking the deployment of ER/VPN/vWAN
    • Deny vNet peering cross subscription.
    • Portal accelerator updated with additional tab and options to enable this initiative.
• Added initiative assignment [Preview]: Deploy Microsoft Defender for Endpoint agent to 'Intermediate Root' Management Group.
• Added assignment of Network interfaces should not have public IPs built-in Policy to the 'Corp' Management Group.
• Added new initiative and assignment to implement recommended guardrails for Azure Key Vault at the landing zones management group
  • Initiative name: ENFORCE-Guardrails-KeyVault
  • Policies included: ALZ Polices
  • Portal accelerator updated
• Added two new policy assignments to govern Corp Management Group networking:
  • DENY-HybridNetworking - blocks the provisioning of vWAN/ER/VPN, including gateways, in Corp
  • AUDIT-PeDnsZones - audits the provisioning of Private Link Private DNS Zones in Corp
    • NOTE: The policy default values include all the static Private DNS Zones only. When assigned via the ALZ portal experience the assignment includes all the Private DNS Zones that are deployed as part of the ALZ Portal experience, including the geo code/regional zones for Azure Backup, AKS etc.
• Added new policy assignment to audit WAF enabled on Application Gateways (Audit-AppGW-WAF)
• Added new initiative and assignment to enable Azure Compute Security Baseline compliance auditing for Windows and Linux virtual machines (Enforce-ACSB)
• Added new Diagnostic setting category for Host Pools Diagnostic Settings to Deploy-Diagnostics-WVDHostPools
  • ConnectionGraphicsData
• Added new Diagnostic setting category for EventGrid Topics Diagnostic Settings to Deploy-Diagnostics-EventGridTopic
  • DataPlaneRequests
• Added two new policy initiative assignments to enable Advanced Threat Detection for databases at intermediate root:
  • Configure Advanced Threat Protection to be enabled on open-source relational databases
  • Configure Azure Defender to be enabled on SQL Servers and SQL Managed Instances
• Add new Azure Policy Initiative and assignment (Audit-UnusedResourcesCostOptimization), at the intermediate root management group (e.g. contoso), to audit unused resources that are driving costs.
• Added new assignment to deny deployment of virtual machines and virtual machine scale sets using unmanaged OS disks.
• Added a policy assignment to deny Classic resources at the Intermediate Root management group

Update

• Removed deprecated policy [Deprecated]: Latest TLS version should be used in your API App (azadvertizer.net) from initiative Deny or Deploy and append TLS requirements and SSL enforcement on resources without Encryption in transit (azadvertizer.net) as recommended policy is already included in the initiative.
  • BREAKING CHANGE (parameters changed):
    • Delete assignment Deny or Deploy and append TLS requirements and SSL enforcement on resources without Encryption in transit (azadvertizer.net).
    • Delete custom initiative prior to applying updates as parameters have changed, then re-assign.
    • Delete orphaned indentity on Landing Zone scope.
    • Deploy new initiative on Landing Zone scope.
• Updated initiative Deny or Audit resources without Encryption with a customer-managed key (CMK) (azadvertizer.net) deprecated policy [Deprecated]: SQL servers should use customer-managed keys to encrypt data at rest to new policy Azure Policy definition SQL servers should use customer-managed keys to encrypt data at rest
• Updated intiative and assignment Deploy Microsoft Defender for Cloud configuration to include the new policies:
  • [Preview]: Configure Microsoft Defender for APIs should be enabled
  • Configure Microsoft Defender CSPM to be enabled
  • Configure machines to receive a vulnerability assessment provider
  • Deploy Azure Policy Add-on to Azure Kubernetes Service clusters
  • Configure Azure Kubernetes Service clusters to enable Defender profile
• Replaced policy assignment "Auditing on SQL server should be enabled" with "Configure SQL servers to have auditing enabled to Log Analytics workspace" on Landing Zones Management Group, to suitably assign respective DINE policy definition, instead of AINE
• Deprecated Deny-RDP-From-Internet and added new policy Deny-MgmtPorts-From-Internet which is more flexible and blocks port 22 and 3389 by default
• Updated the initiative Deny-PublicPaaSEndpoints to include additional policies available to block public access for PaaS services
  • Updated storage and Key Vault to use new policies using the /publicNetworkAccess alias
• Added new policy to inintiative that enablies diagnostic settings for VWAN S2S and added as part of diagnostic settings policy initiative.
• Updated ALZ Policies wiki:
  • Removed the "Version" column to improve readability.
  • Added the option to download an Excel file with all the policy/initiative assigments.
• Update ALZ Policies wiki: Excel file with all the policy/initiative assigments.
• Renamed Policies from WVD to AVD - Display names and Descriptions only
• Update the Deploy SQL Database built-in SQL security configuration initiative to point to the built-in policy Deploy SQL DB transparent data encryption instead of the deprecated custom policy Deploy SQL Database built-in SQL security configuration.
• Update policy Append-Redis-disableNonSslPort: remove not applicable 'modify' effect.

Retire

• Deprecated the custom ALZ policy Deploy SQL Database Transparent Data Encryption as there is now a built-in policy available in Azure Policy Deploy SQL DB transparent data encryption.
• No longer assign Databricks custom policies at Corp management group scope. Policies:
  • Deny-Databricks-NoPublicIp
  • Deny-Databricks-Sku
  • Deny-Databricks-VirtualNetwork

If you are not using these policies, we advise you remove the assignment at Corp management group level, if you are not utilizing them.

Portal Accelerator

• FIX: Updated the Fairfax (US Gov) portal accelerator experience so it now works as expected.

March 2023

Docs

• Added new question and answer to FAQ for "Why hasn't Azure landing zones migrated to the Azure Monitor Agent yet?"
• Published new CAF docs for Azure landing zones and multiple Azure Active Directory tenants - aka.ms/ALZ/MultiTenant

Tooling

• Added additional deployment telemetry collection data point for Zero Trust Networking intent as documented here.
• Defaulted Azure Firewall SKU/Tier to Premium from Standard. SKU/Tier can still be set back to Standard if desired

February 2023

Policy

• Updated Deploy-Diagnostics-Databricks.json policy with missing log categories
• Updated Deploy-Diagnostics-PostgreSQL.json policy to include setting Diagnostic Settings on PostgreSQL flexible server
• Updated Deploy-Diagnostics-Website.json policy to set Diagnostic Settings based on the AppService plan, as the Premium Tier has more categories available.
• Removed duplicated category entry from Deploy-Diagnostics-VNetGW.json policy.

Tooling

• Added note to the portal experience on the "Platform DevOps and automation" blade warning that a management/platform subscription must be selected otherwise the blade will be blank

January 2023

Policy

• Updated Deploy-SQLVulnerabilityAssessments.json policy to use Storage Account Contributor for storing the logs.
• Updated the same policy parameter description for email recipients explaining string type and how to format input.
• Fix typo in Deny-MachineLearning-PublicAccessWhenBehindVnet.json.

Other

• ALZ External Community Call held. Recording and slides can be found here.

December 2022

Docs

• Migrated the following pages to the Enterprise-Scale Wiki

• Updated the guidance for contributing to the Azure/Enterprise-Scale repository

Tooling

• Added ALZ Custom RBAC Role Definitions, as listed here to ALZ Portal Experience. Fixing #1079

Policy

• Updated "Deploy Diagnostic Settings to Azure Services" initiative replacing deprecated policy for diagnostic settings on Storage Account
• Removed all exclusions (parameters) from the Microsoft Cloud Security Benchmark (currently Azure Security Benchmark) initiative assignment to standardize across reference architectures and align with best practice. Impacted assignment: Deploy-ASC-Monitoring
• Updated "**Deploy Diagnostic Settings for Data Factory to Log Analytics workspace" to include new categories of: SandboxPipelineRuns & SandboxActivityRuns
• Add missing minimalSeverity parameter to Deploy-ASC-SecurityContacts Policy Definition

Tooling

• Removed ActivityLog Solution as an option to be deployed into the Log Analytics Workspace. As this has been superseded by the Activity Log Insights Workbook, as documented here.

November 2022

Docs

• Renamed Azure DDoS Standard Protection references to Azure DDoS Network Protection.
• Added ALZ deprecated policies section to the Wiki.
• Included documentation on how to Migrate ALZ custom policies to Azure builtin policies to the Wiki.
• Added links to the superseding policies on the ALZ Deprecated Services page.
• Renamed Azure Security Benchmark references to Microsoft Cloud Security Benchmark.

Tooling

• Updated ALZ Portal Accelerator to support all available Availability Zones as listed here
• Update ALZ Portal Accelerator Private DNS Zones for Private Link, fixing issue #1073

Policy

• "Deploy Diagnostic Settings for Log Analytics to Log Analytics workspace" definition added and also added to Deploy-Diagnostics-LogAnalytics initiative

• "Deploy Diagnostic Settings for Databricks to Log Analytics workspace" definition update

  • Version 1.1.0 -> 1.2.0
  • Added missing log categories

• "Deploy SQL Database security Alert Policies configuration with email admin accounts" definition update

  • Version 1.0.0 -> 1.1.1
  • Changed email addresses from hardcoding to array parameter

• "Deploy SQL Database Transparent Data Encryption" definition update

  • Version 1.0.0 -> 1.1.0
  • Added system databases master, model, tempdb, msdb, resource to exclusion parameter as default values
  • Added as Policy Rule 'notIn' which will exclude the above databases from the policy

• Updated "Deploy-Private-DNS-Zones" Custom initiative for Azure Public Cloud, with latest built-in Policies. Policies were added for the following Services:

  • Azure Automation
  • Azure Cosmos DB (all APIs: SQL, MongoDB, Cassandra, Gremlin, Table)
  • Azure Data Factory
  • Azure HDInsight
  • Azure Migrate (missing Private DNS Zone also added)
  • Azure Storage (Blob, Queue, File, Static Web, DFS and all relative secondaries)
  • Azure Synapse Analytics
  • Azure Media Services
  • Azure Monitor

• Minor fixes related to "Deploy-Private-DNS-Zones" Custom Initiative and respective Assignment:

  • Added missing Zones for "WebPubSub" and "azure-devices-provisioning", so Initiative Assignment works correctly
  • Minor correction related to ASR Private DNS Zone variable, so Initiative Assignment works correctly
  • Conversion of "Azure Batch" Private DNS Zone (from regional to global), to properly align with latest respective documentation and functionality

• Renamed Azure DDoS Standard Protection references to Azure DDoS Network Protection.

• Incremented version for policy Deploy-DDoSProtection from "version":"1.0.0" to "version": "1.0.1"

• Added Configure Microsoft Defender for Azure Cosmos DB to be enabled to the Deploy Microsoft Defender for Cloud configuration initiative and updated version to 3.1.0 - Fixing issue issue #1081

• Added AZFWFlowTrace category for Azure Firewall in associated Diagnostic Policy

• Deprecated the following ALZ policies

  • Deploy-Nsg-FlowLogs
  • Deploy-Nsg-FlowLogs-to-LA
  • Deny-PublicIpin favour of Azure built-in policies with the same or enhanced functionality.

• ""Deploy-ASC-SecurityContacts"" definition update

  • displayName and description update to "Deploy Microsoft Defender for Cloud Security Contacts"
  • Added new parameter minimalSeverity with settings
    • Default value High
    • Allowed values: High, Medium, Low

• ""Deploy-MDFC-Config"" definition update

  • Updated policy definitions set Deploy-MDFC-Config, Deploy-MDFC-Config(US Gov), Deploy-MDFC-Config (China)
    • added new parameter minimalSeverity.
    • added default value for multiple parameters.

Other

• No updates, yet.

October 2022

Docs

• Added 2 new FAQ Q&As based on issue #1080
  • What happens if I have existing Management Groups that have the same Name/IDs as ones that will be deployed in the ALZ Portal Accelerator?
  • What are the ALZ Portal Accelerator Management Group Name/IDs that are created?

Tooling

• Release v2.4.1 of the Azure landing zones Terraform module adds a new diagnostic category for Azure Firewall, as reported in issue #1063
• Update the Azure landing zone portal accelerator to use Resource Graph with a generic drop down UI element to improve user experience for subscription selection.
• Update the Azure landing zone portal accelerator to have more unique naming for deployment names in same tenant, using utcNow() function in deploymentSuffix variable - fixes #1077
• Update the Azure landing zone portal accelerator to have more unique naming for vNet names - fixes #881
  • vNet naming pattern changed:
    • From:
      • Identity vNet: <Subscription ID>-<Root ID Prefix>-vnet-<Region Short Name>
      • Corp vNets: <Subscription ID>-<Root ID Prefix>-vnet-<Region Short Name>
    • To:
      • Identity vNet: <Root ID Prefix>-vnet-<Region Short Name>-<Subscription ID> (then trimmed to 64 characters, using take() function, starting at front - so Subscription ID will get trimmed)
      • Corp vNets: <Root ID Prefix>-vnet-<Region Short Name>-<Subscription ID> (then trimmed to 64 characters, using take() function, starting at front - so Subscription ID will get trimmed)
  • ⚠️This is a breaking change, only if you attempt to redeploy the Azure landing zone portal accelerator over the top of an existing Azure landing zone portal accelerator deployment that was deployed prior to 12/10/2022 (12th October 2022)⚠️
    • The outcome if you do this will be that new vNets will be created based on what you input into the Azure landing zone portal accelerator form when you fill it out. Even if you input exactly the same inputs and details as the first time you deployed it.
      • However, this is a very uncommon action and if you are impacted please raise an issue on the repo and we can assist further
• Release of various ALZ-Bicep versions:
  • v0.10.6
  • v0.10.5
  • v0.10.4
• Updated Azure landing zone portal accelerator with a note around existing Management Group Name/IDs on "Azure core setup" blade linking to FAQ Q&As

Policy

• Added Configure Microsoft Defender for Azure Cosmos DB to be enabled to the Deploy Microsoft Defender for Cloud configuration initiative and updated version to 3.1.0 - Fixing issue issue #1081
• Updated the Diagnostic Settings Policies to leverage the profileName parameter properly, rather than hardcoded value (setByPolicy) - Fixing issue issue #478

Other

• No updates, yet.

September 2022

Docs

• Updated the Enterprise-scale Wiki to reflect the latest updates on Azure landing zone accelerator.

  • Deploy Azure landing zone portal accelerator
  • Deployment guidance for Small Enterprises
  • How to deploy without hybrid connectivity
  • Deployment with hub and spoke network topology
  • Deployment with Azure VWAN network topology

Tooling

• Release v2.4.0 of the Azure landing zones Terraform module
• Updated Automation Account region mapping in the Terraform implementation option

Policy

• No updates, yet.

Other

• No updates, yet.

August 2022

Docs

• No updates, yet.

Tooling

• Updated the eslzArm implementation (Portal accelerator) to use a new policies.json file. This file is now programmatically generated from a library of individual resource definitions using a Bicep template, and was introduced to:
  • Simplify maintenance of individual policies
  • Improve traceability and testability of policy changes
  • Provide universal support across multiple cloud environments, including AzureCloud (public), AzureChinaCloud and AzureUSGovernment
  • As a bonus, we have also improved consistency of metadata implemented across the policies
• Updated Azure Backup geo codes for new regions across ARM, Bicep and Terraform implementation options

Policy

• No updates, yet.

Other

• No updates, yet.

July 2022

Docs

• Updated the ALZ Terraform module Wiki to reflect the latest fixes.
• Various updates to CAF ALZ Docs
  • Identity and Access Management
  • Network Topology and Connectivity
  • Management
  • Platform Automation and DevOps

Tooling

• ALZ Terraform module hotfix release v2.1.2, for regional private endpoint DNS zones
• ALZ Bicep modules release v0.9.2 released
  • Added Landing Zone Management Group Children Flexibility
  • Added Policy Assignments for Mooncake (Azure China)
  • Fixed Azure Backup Private DNS Zone Geo Codes bug, fixing issue #279
• ALZ Accelerator (Portal Experience) updated to fix Azure Backup Private DNS Zone Geo Codes, fixing issue #1004

Policy

• No updates, yet.

Other

• No updates, yet.

June 2022

Docs

• Updated the Policies included in Enterprise-Scale Landing Zones page.
• Updated the ALZ Terraform module Wiki with new examples and improved coverage of variable configuration.

Tooling

• Fixed issue #979 by adding support for the additional Log Analytics Solutions of SQLVulnerabilityAssessment and SQLAdvancedThreatProtection to the Azure Landing Zone Accelerator (portal experience)
• ALZ Terraform module minor release v2.1.0, to provide feature parity on the fix for issue #979
• ALZ Terraform module hotfix release v2.1.1 (see release notes for more information).

Policy

• Renamed Diagnostic Settings Policies from WVD to AVD - Fixing issue issue #962
  • displayName and description updated only. name left as WVD to avoid in-place update issues for existing deployments
  • Add 2 new categories for Host Pools Diagnostic Settings
    • NetworkData
    • SessionHostManagement
• Added AVD Scaling Plans Diagnostic Settings called Deploy-Diagnostics-AVDScalingPlans for Azure Public only - as not supported in Fairfax or Mooncake as per https://learn.microsoft.com/azure/virtual-desktop/autoscale-scaling-plan - Fixing issue issue #962
  • Added to Deploy-Diagnostics-LogAnalytics Policy Initiative
• Added additional log categories to Deploy-Diagnostics-Firewall for Azure Firewall Diagnostic Settings Policy - Fixing issue issue #985
• Added additional log categories to Deploy-Diagnostics-APIMgmt for Azure API Management Diagnostic Settings Policy - Fixing issue issue #986
• Added new Policy for for Azure Bastion Diagnostic Settings Policy called Deploy-Diagnostics-Bastion - Fixing issue issue #968
  • Added to Deploy-Diagnostics-LogAnalytics Policy Initiative
• Updated Deny-MachineLearning-ComputeCluster-RemoteLoginPortPublicAccess mode from Indexed to All - Fixing issue issue #978
• Updated Deploy-Storage-sslEnforcement existence condition - Fixing issue issue #971
• Updated Deploy-Diagnostics-MlWorkspace metrics and categories - Fixing issue issue #893

Other

• No updates, yet.

May 2022

Docs

• Updated the What is an Azure landing zone? page
• Updated the Azure landing zone - design principles page
• Updated the Azure landing zone design areas overview page
• Updated the Landing zone implementation options page

Tooling

• Updating Azure Firewall to use Availability Zones inside of Azure Virtual WAN Secure Hub: Azure Firewall Updates and Azure Firewall with Availability Zones
• ALZ Terraform module patch release v2.0.2 - three minor bugs squashed 🐛 🐛 🐛 🥳

Policy

• No updates, yet.

Other

• Published resources from the third Azure Landing Zones Community Call - held on the 2nd May 2022
  • Meeting recording and PowerPoint slides published in Wiki
  • See issue #949 for meeting details

April 2022

Docs

• New CAF document Plan for virtual machine remote access
• New CAF document Use Terraform to deploy Azure landing zones
  • Helps you to understand what Terraform approach and module to use to deploy, manage and operate ALZ
• New CAF document Tailor the Azure landing zone architecture to meet requirements
  • Guidance to help you understand how to tailor the ALZ architecture to meet your additional requirements
• New CAF document Independent software vendor (ISV) considerations for Azure landing zones

Tooling

• Azure Landing Zones Terraform Module v2.0.0 released 🥳
  • Adds support for Virtual WAN plus much more
  • Checkout release notes for details on all the changes and fixes
  • Checkout upgrade guide for details on how to upgrade to the latest release
• Updated Private DNS Zones that are created for Private Link/Endpoints in Portal Experience as per documentation here: Azure Private Endpoint DNS configuration
  • Also fixes issue 944
• Added Telemetry to Portal Experience. More info here Telemetry Tracking Using Customer Usage Attribution (PID)
• Increase preparingToLaunch deployment delay in portal experience to improve scenario in issue 902
• Added warnings to use dedicated Subscriptions for platform services when selecting the dedicated model to help avoid deployment failures seen when selecting the same Subscription in the dedicated platform Subscription model for Management, Identity and Connectivity
  • Improving experience as suggested in issue 910
  • Customers wanting a single subscription for platform services should select the 'Single' option on the 'Azure Core Setup' blade

Policy

• Added new custom policy definition called Deny vNet peering to non-approved vNets
  • This is useful in scenarios where you only want to allow vNet peering to say a central hub vNet and not allow other vNet peerings between landing zones to be enabled.

Other

• No updates, yet.

February 2022

Docs

• Added new FAQ question and answer for AzureDiagnostic table limits for Log Analytics Workspaces
  • The AzureDiagnostics table in my Log Analytics Workspace has hit the 500 column limit, what should I do?

Tooling

• The Bicep version of Azure Landing Zone (formerly Enterprise-scale) is here! 🥳
  • Check out the ALZ-Bicep repo to get started!
• Updated accelerator (portal) experience to deploy an Azure Firewall Policy Premium SKU instead of Standard when Premium is selected for the Azure Firewall in a Hub & Spoke VNet Connectivity model.
  • PR 890 fixing issue 889
• Updated accelerator (portal) experience to deploy an Azure Firewall Policy for customers using the Virtual WAN connectivity model.

Policy

• Renamed Deploy-ASCDF-Config to Deploy-MDFC-Config and updated version to 3.0.0 - fixing issue 923

Other

• No updates, yet.

January 2022

Docs

• No updates, yet.

Tooling

• New release v1.1.0 of the caf-enterprise-scale Terraform module, providing updates to the published policies and a number of bug fixes.

Policy

• Updated Deny-Subnet-Without-Nsg & Deny-Subnet-Without-Udr to version 2.0.0
  • Fixes scenario described in issue issue #407
• Updated Deploy-ASCDF-Config policy initiative with changes relating to new Microsoft Defender for Cloud Containers plan as documented in issue #874
  • Updated in Public (Commercial), Fairfax (Gov) and Mooncake (China)
  • Updated portal experiences for Public and Fairfax

Other

• No updates, yet.

December 2021

Docs

• CAF ready lots of doc updates relating to Azure Landing Zones/Enterprise Scale
  • Added doc on Adopting policy driven guardrails
  • Added doc called Scenario: Transition existing Azure environments to the Azure landing zone conceptual architecture
    • More of these to come, let us know via issues on other scenarios you'd like to see documented
  • Design Areas updated and reorganized in TOC (navigation pane)

• Updated DIY instructions for deploying Enterprise-Scale in Azure China with:
  • Additional details of some deployment steps
  • Microsoft Defender for Cloud configuration policy set definition and policy assignment specific to Azure China
  • Differentiate between Az VM Backup policy assignment for identity management group, and landing zone management group in the DIY guidance

Policy

• The following policy definitions for Microsoft Defender for Cloud configurations are not available as built-in in Azure China. The policy set definition will be updated as when these policy definitions are available:
  • defenderForOssDb, defenderForSqlServerVirtualMachines, defenderForAppServices, defenderForAppServices, defenderForStorageAccounts, defenderForKeyVaults, defenderForDns, defenderForArm

November 2021

Docs

• No updates, yet.

Tooling

• New release v1.1.0 of the caf-enterprise-scale Terraform module, providing updates to the published policies and a number of bug fixes.

Policy

• Replaced Deploy-Default-Udr policy with Deploy-Custom-Route-Table that allows deploying custom route tables with an arbitrary set of UDRs (including a 0/0 default route if needed). See here for usage details.

• Updated Deploy-Budget policy, to v1.1.0, adding new parameter of budgetName that defaults to: budget-set-by-policy - closing issue #842

  • Including Fairfax
  • Also Mooncake (Azure China) even though not in use yet

• Added AuditEvent to Deploy-Diagnostics-AA Policy Definition to ensure correct compliance reporting on Automation Account used for diagnostics - closing issue #864

Other

• Published resources from the second Enterprise Scale Community Call - held on the 17th November 2021
  • Meeting recording and PowerPoint slides published in Wiki
  • See issue #803 for meeting details

October 2021

Docs

• Updates to User Guide to include instructions for deploying each of the reference implementations.
• Updated Deploying Enterprise Scale wiki page with updated workflow steps. (https://github.com/Azure/Enterprise-Scale/pull/827)
• Updated implementation FAQ and moved to the Wiki
• Added architecture FAQ to the CAF docs

Tooling

• Terraform Enterprise Scale Module reaches GA (V1.0.0) - see release notes
• ESLZ reference implementation updated with built-in (11) policies for Azure Security Center, enforcing (DeployIfNotExists) Azure Security Center with Standard Tier for Azure Defender for the following services:
  • Kubernetes
  • App Services
  • VMs
  • Key Vault
  • Azure Resource Manager
  • DNS
  • Open-source relational databases
  • SQL on VMs
  • SQL databases
  • Storage
  • Container Registries

Policy

• No updates, yet.

Other

• No updates, yet.

September 2021

Docs

• Added reference to Enterprise-Scale Analytics (https://github.com/Azure/Enterprise-Scale/pull/809)
• Added Do-It-Yourself instructions for deploying Enterprise-Scale in Azure China regions (https://github.com/Azure/Enterprise-Scale/pull/802)

Tooling

• Added Option to select Azure Firewall SKU (https://github.com/Azure/Enterprise-Scale/pull/793)
• AzOps release v1.5.0
• Enabled support for Enterprise-Scale landing zones deployments to Azure gov (https://github.com/Azure/Enterprise-Scale/pull/820)

Policy

Other

• No updates, yet.

August 2021

Docs

• Updated Enterprise Agreement enrollment and Azure Active Directory tenants CAF doc
  • Added CSP, MCA & other billing offers
  • Added information on how an EA relates to Azure AD and ties in with RBAC
• Lots of updates to the Terraform Module for Cloud Adoption Framework Enterprise-scale wiki

Tooling

• Terraform Module for Cloud Adoption Framework Enterprise-scale release v0.4.0
  • Brings support for Hub Connectivity & Identity landing zone peering - read more in the release notes linked above
• Do-It-Yourself deployment instructions for Enterprise-Scale using Azure PowerShell released
• Update subscription filter in reference implementation UI experience. Subscriptions with state != "Enabled" will be excluded from the list of available subscriptions.
• Removed old codebase for the different reference implementations, and converged to a single ARM codebase
• Improved Network CIDR Range Validation within the Azure Portal experience (https://github.com/Azure/Enterprise-Scale/pull/767).

Policy

• Some minor changes to parameters and variables, tidying up some code.
  • See PR #727
• Updated policy Deploy-VNET-HubSpoke to address #726 and #728
  • See PR #772

Other

• Published resources from the first Enterprise Scale Community Call - held on the 25th August 2021
  • Meeting recording and PowerPoint slides published in Wiki
  • See issue #668 for meeting details

July 2021

Docs

• Added guidance for Resource Group usage for Azure Networking topologies in Hub & Spoke & Virtual WAN CAF docs - closing issue #632
• Updated Connectivity to Azure PaaS services CAF docs based on customer feedback around Private Link /Service Endpoints differences and guidance, including ExpressRoute peering options relating to this. Closing issue - #519 on CAF repository
• Updated Contoso, Adventure Works & Wingtip Toys reference implementations with new Deploy To Azure buttons for new portal experience
  • Also updated guidance and option availability for each of them respectively
• User Guide updated to reflect latest release and new portal experience
• New Article to Deploy Azure Red Hat OpenShift (ARO) in enterprise-scale landing zones

Tooling

• Portal Experience Updated
  • Merged Contoso, AdventureWorks, and Wingtip into one ESLZ deployment experience via first-party deployment in the portal ("Deploy To Azure" button) experience
    • Support "N" network topologies in same experience (Hub and Spoke, Virtual WAN, Hub and Spoke with NVA)
    • Added option for VNET Peering the Identity subscription's VNET to the Connectivity subscription's Hub VNET
    • Added option for VNET peering Landing Zones to Connectivity subscription when Hub & Spoke is the selected topology (Virtual WAN is excluded due to concurrency issues, at this time) - closing issue #517
    • Navigate policy assignment for identity, when using single vs dedicated subscriptions for platform purposes
    • Optimized the execution graph
• Re-structured the ARM templates for all resource deployments
  • eslzArm.json is used to orchestrate the E2E composition of ESLZ, and subsequent resource deployments based on user input from the portal ("Deploy To Azure" button) experience
  • The composite ARM templates can be sequenced on their own, independently of each other (although strict sequencing is required to ensure the same outcome)
    • Guidance coming soon for this
  • Customers can deploy from private repository if they want to sequence at their own pace.
• AzOps release v1.3.0
• AzOps release v1.3.1
• AzOps release v1.4.0

Policy

• Various custom ESLZ Azure Policies have moved to Built-In Azure Policies, see below table for more detail:

You may continue to use the ESLZ custom Azure Policy as it will still function as it does today. However, we recommend you move to assigning the new Built-In version of the Azure Policy.

Please note that moving to the new Built-In Policy Definition will require a new Policy Assignment and removing the previous Policy Assignment, which will mean compliance history for the Policy Assignment will be lost. However, if you have configured your Activity Logs and Security Center to export to a Log Analytics Workspace; Policy Assignment historic data will be stored here as per the retention duration configured.

Policy Definitions Updates

Policy Initiatives Updates

• Moved several of the diagnostics Policies to built-in, and updating the diagnostics Initiative
  • This means there's a new resource name as update of existing one is not be allowed due to removal of parameters
• Added Policy Initiative for enforcing Private DNS Zone Association with Private Link (using built-in)
• Added Policy Initiative for denying Public Endpoints (using built-in)
• Updated description and display name for all Policy Assignments

Other

No updates, yet.

June 2021

Docs

• "What's New?" page created
• Azure DDoS Network Protection design considerations and recommendations added to CAF docs (Virtual WAN & Hub & Spoke) - closing issue #603
• Connectivity to other cloud providers CAF document released
• Testing approach for enterprise-scale CAF document released
• Updated pricing section on "What is Enterprise Scale" wiki page to provide further clarity.
• Updated DNS for on-premises and Azure resources - related to issue #609
• Update Hub & Spoke guidance related to BGP propagation on UDRs for transit connectivity - to close issue #618
• Added guidance to Management group and subscription organization - CAF Docs for Azure Subscription Policies, which allow you to control Azure Subscription Tenant transfers to/from your AAD Tenant.

Tooling

• AzOps release v1.2.0
• Terraform Module for Cloud Adoption Framework Enterprise-scale release v0.3.3

Policy

• Updated Deny-Subnet-Without-UDR policy, to v1.1.0, to allow exclusion of subnets like the AzureBastionSubnet - closing issue #604
  • Also updated ESLZ-Policies.md with changes
• Updated Deny-Subnet-Without-Nsg policy, to v1.1.0, to allow exclusion of subnets like the GatewaySubnet, AzureFirewallSubnet and AzureFirewallManagementSubnet - closing issue #456
  • Also updated ESLZ-Policies.md with changes
• Updated Deny-VNet-Peering and Deny-VNET-Peer-Cross-Sub policies mode to All from Indexed. - closing issue #583
  • Also updated ESLZ-Policies.md with changes

Other

• Contoso Reference Implementation Update - Virtual WAN Hub default CIDR changed from /16 to /23 - closing issue #440

This wiki is being actively developed

If you discover any documentation bugs or would like to request new content, please raise them as an issue.

Contributions to this wiki are done through the main repo under docs/wiki.