Forum Discussion
Microsoft Security Compliance Toolkit 1.0 and Azure Automanage Machine Configuration
I'm looking at deploying a number of Windows images in Azure with Security Baselines applied from the Microsoft Security Compliance Toolkit, all being managed by https://learn.microsoft.com/en-us/azure/governance/machine-configuration/?view=dsc-2.0 .
1) Has anyone already done this? Are there tips/tricks/lessons learned that can be shared?
2) Is there any "pre-integrated" methodology to deploy Azure Windows VMs with current Security Compliance Toolkit Security Baselines, similar to the DoD STIG "Easy Button" approach? (see https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-stig-windows-vm) [Apologies in Advance - Azure Automanage newbie...]
- To deploy Windows images in Azure with Security Baselines applied from the Microsoft Security Compliance Toolkit, you can follow these general steps:
Prepare the Security Baseline: Download and extract the Microsoft Security Compliance Toolkit, which contains the Security Baselines for various Windows versions. Select the appropriate Security Baseline for your Windows images and review the configuration settings.
Create a custom Windows image: Set up a virtual machine (VM) in Azure with the desired Windows version. Install the necessary software, applications, and updates on the VM. Apply the Security Baseline settings manually to configure the security policies on the VM.
Generalize the VM: Use the Sysprep tool or Azure Image Builder service to generalize the VM. This process removes unique system information and prepares the VM for image creation.
Capture the VM image: Capture the generalized VM as a custom VM image in Azure. This image will serve as the base image with the Security Baseline applied.
Provision VMs using the custom image: Use the custom VM image to deploy new VMs in Azure. You can use various methods, such as Azure portal, Azure PowerShell, Azure CLI, or Azure Resource Manager (ARM) templates, to provision VMs based on the custom image.
Scale and manage the deployed VMs: Depending on your requirements, you can scale the number of VM instances using features like Azure Virtual Machine Scale Sets. You can also use Azure Automation or Azure Policy to manage and enforce security configurations and policies on the deployed VMs. Steve_Saunders
Have you had any success with this? If you've already accomplished it, I would appreciate it if you could provide me with the details since I'm considering doing the same thing.
