Support for 30 day guardrails

[KingBain]

Was wondering if anyone had looked at converting the cloud guardrails for cloud profile 3 into the custom policies in this repo.

I know some of the documentation for controls has been uploaded here
https://github.com/canada-ca/cloud-guardrails-azure

and here

https://github.com/canada-ca/cloud-guardrails

[obrien-j]

Thanks for the bump John, this is definitely on our roadmap. Happy to take community PR's though if others are interested in pitching in!

[KingBain]

I need a bit of help with how you would do this. IMO, not a good first issue :)

I have a bit of code that enabled the conditional access MFA of guardrail 1.

See

$conditions = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
$conditions.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
$conditions.Applications.IncludeApplications = "797f4846-ba00-4fd7-ba43-dac1f8f63013" #Azure Management Application

$conditions.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
$conditions.Users.IncludeUsers = "all"
$conditions.Users.ExcludeGroups = "" #Exclude BreakGlass Group ID

$controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
$controls._Operator = "OR"
$controls.BuiltInControls = "mfa"

New-AzureADMSConditionalAccessPolicy -DisplayName "Guard Rail 1  - Enable MFA" -State "enabled" -Conditions $conditions -GrantControls $controls

unsure of how to actually shim a power shell script into the directory structure you have here and then, how to creat the appropriate pipeline.

[igomaa]

Was wondering if anyone had looked at converting the cloud guardrails for cloud profile 3 into the custom policies in this repo.

I know some of the documentation for controls has been uploaded here https://github.com/canada-ca/cloud-guardrails-azure

and here

https://github.com/canada-ca/cloud-guardrails

Hello @KingBain ,
I just saw your comments, Fasttrack for Azure have a solution accelerator for Guardrails audit and mitigation, please let me know if you are interested.

[KingBain]

I just saw your comments, Fasttrack for Azure have a solution accelerator for Guardrails audit and mitigation, please let me know if you are interested.

Hey @igomaa I am very interested in this.

I was working to codify some of the 30 day rails, where possible but was running into challenges where configuring certain aspects of Azure wasnt possible. Like managing the private market place.

[jeffbarnes709]

Hi @igomaa and @KingBain - certainly interested as well. Especially in relation to applying Policy Initiatives to Azure resources

[SenthuranSivananthan]

Closed via #226 and #229