From d19eb7e15faf2e03d92220a856e671bebbe02cf2 Mon Sep 17 00:00:00 2001 From: Jan Egil Ring Date: Tue, 20 Oct 2026 09:31:54 +0000 Subject: [PATCH] Enhance documentation for Endpoint protection API testing and policy-permission validation Signed-off-by: Jan Egil Ring --- .../resources/tests/readme.md | 33 +++++++++++++++++-- .../walkthrough/challenge-01/solution-01.md | 12 +++++++ 2 files changed, 42 insertions(+), 3 deletions(-) diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/tests/readme.md b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/tests/readme.md index 07308d2f4..3163ce4cb 100644 --- a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/tests/readme.md +++ b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/resources/tests/readme.md @@ -53,9 +53,36 @@ bounded propagation and shared-hook wiring. These tests do not enable paid plans The Endpoint protection API was tested off/on in an authorized test subscription on 2026-10-19 and restored to enabled, without changing its existing P1 plan. -That does not validate this new P2 automation live. A fresh Console deployment -must verify P2 and Endpoint protection, followed by a normal participant login, -VM onboarding and Challenge 1 modify-policy identity/RBAC/remediation testing. +On 2026-10-20, after a successful fresh Console deployment, the signed-in +participant `labuser-0007` independently read `Standard` / `P2` and +`WDATP.properties.enabled=true` in `traininglab-57`. No Defender settings were +changed during verification. Individual VM extension/device onboarding remains +a separate acceptance check. + +### Participant policy-permission validation + +The same participant had Owner on `rg-labuser-0007` and subscription-level +Resource Policy Contributor and Security Reader, without subscription Owner or +User Access Administrator. Using that account, the live test successfully: + +- Created a subscription-level custom modify definition and an RG-scoped assignment + with a system-assigned managed identity. +- Granted that identity Contributor on the participant RG. +- Remediated a pre-existing empty storage account and independently read back + `DataClassification=Sovereign`, preserving its other tags. The test definition + restricted modification to that exact storage account, not existing lab resources. + +The initial `ReEvaluateCompliance` task remained in `Evaluating` during observation, +even after the account appeared as NonCompliant. It was canceled and its canceled +state confirmed before retrying with `ExistingNonCompliant`. The retry succeeded +with one successful deployment and zero failures. This verifies the participant +permissions and actual remediation, not completion of the original evaluation task. + +The test account, both remediation tasks, assignment, custom definition and +identity role assignment were removed afterward; existing lab resources were +preserved. The Task 3 built-in require-tag policy was separately confirmed to use +`deny`, which does not support automatic remediation. These findings do not +establish the historical assignment or permissions in `traininglab-11`. ## Hosted tag-policy unit tests diff --git a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-01/solution-01.md b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-01/solution-01.md index 55b8e8d49..d20623007 100644 --- a/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-01/solution-01.md +++ b/03-Azure/01-03-Infrastructure/01_Sovereign_Cloud/walkthrough/challenge-01/solution-01.md @@ -228,6 +228,9 @@ az policy assignment create \ ### Step 1: Assign the "Require a tag and its value" Policy This policy requires that resources have a specific tag with a specific value. +It uses **deny**, not **modify**: no managed identity or remediation task is +available for this assignment. To add missing tags to existing resources, use +the separate modify policy in **Task 10**. **Policy Definition ID:** @@ -919,6 +922,15 @@ Verify all your Tasks 2-5 assignments show `DoNotEnforce`, and allow propagation - **Remediation Task**: A job that applies DINE or Modify effects to existing resources - **Managed Identity**: Required for remediation tasks to have permissions to modify resources +If **Remediate** is unavailable, first check the assigned definition: Task 3's +**Require Data Classification Tag** policy uses **deny** and cannot be remediated. +Select **Add DataClassification Tag with Remediation**, created below, instead. +For that modify assignment, verify both its managed identity and the identity's +Contributor role on your resource group. Creating the identity and granting it +access are separate operations; Resource Policy Contributor alone cannot grant +roles. Ask the facilitator to check your resource-group Owner access if the role +assignment fails; subscription-level Owner is not needed for this RG-scoped task. + ### Before Remediation: Create an Untagged Test Resource Verify Task 9's three assignments are back in **DoNotEnforce**. Before creating the modify assignment below, create one empty storage account without `DataClassification`, using the Test 3 portal settings and a new unique name. This time it should be created. Alternatively: