AzPolicyAdvertizer

last sync: 2025-Jul-03 17:22:55 UTC

Windows machines should meet requirements for 'Security Options - Devices'

Azure BuiltIn Policy definition

-Source
+ Azure Portal
-Display name
+Windows machines should meet requirements for 'Security Options - Devices'
-Id
+ff4f-1a35-4e18-938f-0b22055067cd
-Version
+.0.0
  Details on versioning
-Versioning
+                        Versions supported for Versioning: 1
3.0.0
                         Built-in Versioning [Preview]
-Category
+Guest Configuration
 Microsoft Learn
-Description
+Windows machines should have the specified Group Policy settings in the category 'Security Options - Devices' for undocking without logging on, installing print drivers, and formatting/ejecting media. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.
-Cloud environments
+AzureCloud = true
AzureUSGovernment = true
AzureChinaCloud = unknown
-Available in AzUSGov
+The Policy is available in AzureUSGovernment cloud. Version: '2.0.0'
 Repository: Azure-Policy 8794ff4f-1a35-4e18-938f-0b22055067cd
-Mode
+Indexed
-Type
+BuiltIn
-Preview
+                False
-Deprecated
+False
-Effect
+                Default
AuditIfNotExists

                Allowed
AuditIfNotExists, Disabled
-RBAC role(s)
+                            none
-Rule aliases
+IF (7)


                    
                        Alias
                        Namespace
                        ResourceType
                        Path
                        PathIsDefault
                        DefaultPath
                        Modifiable
                    
                            
                                Microsoft.Compute/imageOffer
                                Microsoft.Compute
Microsoft.Compute
Microsoft.Compute
                                virtualMachines
virtualMachineScaleSets
disks
                                properties.storageProfile.imageReference.offer
properties.virtualMachineProfile.storageProfile.imageReference.offer
properties.creationData.imageReference.id
                                True
True
True
                                


                                False
False
False
                            
                            
                                Microsoft.Compute/imagePublisher
                                Microsoft.Compute
Microsoft.Compute
Microsoft.Compute
                                virtualMachines
virtualMachineScaleSets
disks
                                properties.storageProfile.imageReference.publisher
properties.virtualMachineProfile.storageProfile.imageReference.publisher
properties.creationData.imageReference.id
                                True
True
True
                                


                                False
False
False
                            
                            
                                Microsoft.Compute/imageSKU
                                Microsoft.Compute
Microsoft.Compute
Microsoft.Compute
                                virtualMachines
virtualMachineScaleSets
disks
                                properties.storageProfile.imageReference.sku
properties.virtualMachineProfile.storageProfile.imageReference.sku
properties.creationData.imageReference.id
                                True
True
True
                                


                                False
False
False
                            
                            
                                Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration
                                Microsoft.Compute
                                virtualMachines
                                properties.osProfile.windowsConfiguration
                                True
                                
                                True
                            
                            
                                Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType
                                Microsoft.Compute
                                virtualMachines
                                properties.storageProfile.osDisk.osType
                                True
                                
                                True
                            
                            
                                Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType
                                Microsoft.ConnectedVMwarevSphere
                                virtualmachines
                                properties.osProfile.osType
                                True
                                
                                False
                            
                            
                                Microsoft.HybridCompute/imageOffer
                                Microsoft.HybridCompute
                                machines
                                properties.osName
                                True
                                
                                False
                            
                    THEN-ExistenceCondition (2)

                    
                                        
                        Alias
                        Namespace
                        ResourceType
                        Path
                        PathIsDefault
                        DefaultPath
                        Modifiable
                    
                                                
                                Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus
                                Microsoft.GuestConfiguration
                                guestConfigurationAssignments
                                properties.complianceStatus
                                True
                                
                                False
                            
                            
                                Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash
                                Microsoft.GuestConfiguration
                                guestConfigurationAssignments
                                properties.parameterHash
                                True
                                
                                False
-Alias
+Modifiable
-Microsoft.Compute/imageOffer
+False
False
False
-Microsoft.Compute/imagePublisher
+False
False
False
-Microsoft.Compute/imageSKU
+False
False
False
-Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration
+True
-Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType
+True
-Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType
+False
-Microsoft.HybridCompute/imageOffer
+False
-Alias
+Modifiable
-Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus
+False
-Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash
+False
-Rule resource types
+                IF (3)

                                    Microsoft.Compute/virtualMachines
                    Microsoft.ConnectedVMwarevSphere/virtualMachines
                    Microsoft.HybridCompute/machines
-Compliance
+                    Not a Compliance control
-Initiatives usage
+Rows: 1-1 / 1
Records: Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators: 
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more
TableFilter v0.7.3
https://www.tablefilter.com/
©2015-2025 Max GuglielmiClose
?
 Page  of 1
                            
                                

                                    Initiative DisplayName
                                    Initiative Id
                                    Initiative Category
                                    State
                                    Type
                                    polSet in AzUSGov
                                
                            
                            
                                [Preview]: Windows machines should meet requirements for the Azure compute security baseline
                                be7a78aa-3e10-4153-a5fd-8c6506dbc821
                                Guest Configuration
                                Preview                                     BuiltIn
                                    true
                            
                        
No results
-Initiative DisplayName
+polSet in AzUSGov
-[Preview]: Windows machines should meet requirements for the Azure compute security baseline
+true
-History
+                                Date/Time (UTC ymd) (i)
                                Change type
                                Change detail
                            
                                                    
                                2022-01-28 17:51:01
                                change
                                Major (2.0.0 > 3.0.0)
                            
                            
                                2020-09-15 14:06:41
                                change
                                Previous DisplayName: [Preview]: Windows machines should meet requirements for 'Security Options - Devices' 
                            
                            
                                2020-08-20 14:05:01
                                add
                                8794ff4f-1a35-4e18-938f-0b22055067cd
-Date/Time (UTC ymd) (i)
+Change detail
--01-28 17:51:01
+Major (2.0.0 > 3.0.0)
--09-15 14:06:41
+Previous DisplayName: [Preview]: Windows machines should meet requirements for 'Security Options - Devices'
--08-20 14:05:01
+ff4f-1a35-4e18-938f-0b22055067cd
-JSON compare
+    "mode": "Indexed",
@@ -4,9 +4,9 @@
     "mode": "Indexed",
     "description": "Windows machines should have the specified Group Policy settings in the category 'Security Options - Devices' for undocking without logging on, installing print drivers, and formatting/ejecting media. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.",
     "metadata": {
         "category": "Guest Configuration",
-        "version": "2.0.0",
         "requiredProviders": [
             "Microsoft.GuestConfiguration"
         ],
         "guestConfiguration": {
@@ -21,9 +21,10 @@
         "IncludeArcMachines": {
             "type": "String",
             "metadata": {
                 "displayName": "Include Arc connected servers",
-                "description": "By selecting this option, you agree to be charged monthly per Arc connected machine."
             },
             "allowedValues": [
                 "true",
                 "false"
@@ -105,9 +106,9 @@
                                             "equals": "microsoft-dsvm"
                                         },
                                         {
                                             "field": "Microsoft.Compute/imageOffer",
-                                            "equals": "dsvm-windows"
                                         }
                                     ]
                                 },
                                 {
@@ -219,14 +220,34 @@
                             "value": "[parameters('IncludeArcMachines')]",
                             "equals": "true"
                         },
                         {
-                            "field": "type",
-                            "equals": "Microsoft.HybridCompute/machines"
-                        },
-                        {
-                            "field": "Microsoft.HybridCompute/imageOffer",
-                            "like": "windows*"
                         }
                     ]
                 }
             ]
     "mode": "Indexed",
     "description": "Windows machines should have the specified Group Policy settings in the category 'Security Options - Devices' for undocking without logging on, installing print drivers, and formatting/ejecting media. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.",
     "metadata": {
         "category": "Guest Configuration",
+        "version": "3.0.0",
         "requiredProviders": [
             "Microsoft.GuestConfiguration"
         ],
         "guestConfiguration": {
         "IncludeArcMachines": {
             "type": "String",
             "metadata": {
                 "displayName": "Include Arc connected servers",
+                "description": "By selecting this option, you agree to be charged monthly per Arc connected machine.",
+                "portalReview": "true"
             },
             "allowedValues": [
                 "true",
                 "false"
                                             "equals": "microsoft-dsvm"
                                         },
                                         {
                                             "field": "Microsoft.Compute/imageOffer",
+                                            "like": "dsvm-win*"
                                         }
                                     ]
                                 },
                                 {
                             "value": "[parameters('IncludeArcMachines')]",
                             "equals": "true"
                         },
                         {
+                            "anyOf": [
+                                {
+                                    "allOf": [
+                                        {
+                                            "field": "type",
+                                            "equals": "Microsoft.HybridCompute/machines"
+                                        },
+                                        {
+                                            "field": "Microsoft.HybridCompute/imageOffer",
+                                            "like": "windows*"
+                                        }
+                                    ]
+                                },
+                                {
+                                    "allOf": [
+                                        {
+                                            "field": "type",
+                                            "equals": "Microsoft.ConnectedVMwarevSphere/virtualMachines"
+                                        },
+                                        {
+                                            "field": "Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType",
+                                            "like": "windows*"
+                                        }
+                                    ]
+                                }
+                            ]
                         }
                     ]
                 }
             ]
-JSON
+                                api-version=2021-06-01

                                  EPAC
                                
                            
                        
                        
                            
                                {7 itemsdisplayName: "Windows machines should meet requirements for 'Security Options - Devices'",
policyType: "BuiltIn",
mode: "Indexed",
description: "Windows machines should have the specified Group Policy settings in the category 'Security Options - Devices' for undocking without logging on, installing print drivers, and formatting/ejecting media. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.",
metadata: {4 itemscategory: "Guest Configuration",
version: "3.0.0",
requiredProviders: [1 item"Microsoft.GuestConfiguration"
],
guestConfiguration: {3 itemsname: "AzureBaseline_SecurityOptionsDevices",
version: "1.*",
configurationParameter: {1 itemDevicesAllowedToFormatAndEjectRemovableMedia: "Devices: Allowed to format and eject removable media;ExpectedValue"
}
}
},
parameters: {3 itemsIncludeArcMachines: {4 itemstype: "String",
metadata: {3 itemsdisplayName: "Include Arc connected servers",
description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
portalReview: "true"
},
allowedValues: [2 items"true",
"false"
],
defaultValue: "false"
},
DevicesAllowedToFormatAndEjectRemovableMedia: {3 itemstype: "String",
metadata: {2 itemsdisplayName: "Devices: Allowed to format and eject removable media",
description: "Specifies who is allowed to format and eject removable NTFS media. You can use this policy setting to prevent unauthorized users from removing data on one computer to access it on another computer on which they have local administrator privileges."
},
defaultValue: "0"
},
effect: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Effect",
description: "Enable or disable the execution of this policy"
},
allowedValues: [2 items"AuditIfNotExists",
"Disabled"
],
defaultValue: "AuditIfNotExists"
}
},
policyRule: {2 itemsif: {1 itemanyOf: [2 items{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.Compute/virtualMachines"
},
{1 itemanyOf: [10 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
in: [7 items"esri",
"incredibuild",
"MicrosoftDynamicsAX",
"MicrosoftSharepoint",
"MicrosoftVisualStudio",
"MicrosoftWindowsDesktop",
"MicrosoftWindowsServerHPCPack"
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "MicrosoftWindowsServer"
},
{2 itemsfield: "Microsoft.Compute/imageSKU",
notLike: "2008*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "MicrosoftSQLServer"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
notLike: "SQL2008*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "microsoft-dsvm"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "dsvm-win*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "microsoft-ads"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
in: [2 items"standard-data-science-vm",
"windows-data-science-vm"
]
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "batch"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
equals: "rendering-windows2016"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "center-for-internet-security-inc"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "cis-windows-server-201*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "pivotal"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "bosh-windows-server*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "cloud-infrastructure-services"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "ad*"
}
]
},
{1 itemallOf: [2 items{1 itemanyOf: [2 items{2 itemsfield: "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration",
exists: "true"
},
{2 itemsfield: "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
like: "Windows*"
}
]
},
{1 itemanyOf: [2 items{2 itemsfield: "Microsoft.Compute/imageSKU",
exists: "false"
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imageSKU",
notLike: "2008*"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
notLike: "SQL2008*"
}
]
}
]
}
]
}
]
}
]
},
{1 itemallOf: [2 items{2 itemsvalue: "[parameters('IncludeArcMachines')]",
equals: "true"
},
{1 itemanyOf: [2 items{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.HybridCompute/machines"
},
{2 itemsfield: "Microsoft.HybridCompute/imageOffer",
like: "windows*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.ConnectedVMwarevSphere/virtualMachines"
},
{2 itemsfield: "Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType",
like: "windows*"
}
]
}
]
}
]
}
]
},
then: {2 itemseffect: "[parameters('effect')]",
details: {3 itemstype: "Microsoft.GuestConfiguration/guestConfigurationAssignments",
name: "AzureBaseline_SecurityOptionsDevices",
existenceCondition: {1 itemallOf: [2 items{2 itemsfield: "Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus",
equals: "Compliant"
},
{2 itemsfield: "Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash",
equals: 🔍"[
    base64(
        concat(
           'Devices: Allowed to format and eject removable media;ExpectedValue',
            '=',
             parameters('DevicesAllowedToFormatAndEjectRemovableMedia')
        )
    )
]"
}
]
}
}
}
}
}
                                 api-version=2021-06-01

                                  EPAC
                                 {7 itemsdisplayName: "Windows machines should meet requirements for 'Security Options - Devices'",
policyType: "BuiltIn",
mode: "Indexed",
description: "Windows machines should have the specified Group Policy settings in the category 'Security Options - Devices' for undocking without logging on, installing print drivers, and formatting/ejecting media. This policy requires that the Guest Configuration prerequisites have been deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol.",
metadata: {4 itemscategory: "Guest Configuration",
version: "3.0.0",
requiredProviders: [1 item"Microsoft.GuestConfiguration"
],
guestConfiguration: {3 itemsname: "AzureBaseline_SecurityOptionsDevices",
version: "1.*",
configurationParameter: {1 itemDevicesAllowedToFormatAndEjectRemovableMedia: "Devices: Allowed to format and eject removable media;ExpectedValue"
}
}
},
parameters: {3 itemsIncludeArcMachines: {4 itemstype: "String",
metadata: {3 itemsdisplayName: "Include Arc connected servers",
description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
portalReview: "true"
},
allowedValues: [2 items"true",
"false"
],
defaultValue: "false"
},
DevicesAllowedToFormatAndEjectRemovableMedia: {3 itemstype: "String",
metadata: {2 itemsdisplayName: "Devices: Allowed to format and eject removable media",
description: "Specifies who is allowed to format and eject removable NTFS media. You can use this policy setting to prevent unauthorized users from removing data on one computer to access it on another computer on which they have local administrator privileges."
},
defaultValue: "0"
},
effect: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Effect",
description: "Enable or disable the execution of this policy"
},
allowedValues: [2 items"AuditIfNotExists",
"Disabled"
],
defaultValue: "AuditIfNotExists"
}
},
policyRule: {2 itemsif: {1 itemanyOf: [2 items{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.Compute/virtualMachines"
},
{1 itemanyOf: [10 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
in: [7 items"esri",
"incredibuild",
"MicrosoftDynamicsAX",
"MicrosoftSharepoint",
"MicrosoftVisualStudio",
"MicrosoftWindowsDesktop",
"MicrosoftWindowsServerHPCPack"
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "MicrosoftWindowsServer"
},
{2 itemsfield: "Microsoft.Compute/imageSKU",
notLike: "2008*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "MicrosoftSQLServer"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
notLike: "SQL2008*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "microsoft-dsvm"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "dsvm-win*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "microsoft-ads"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
in: [2 items"standard-data-science-vm",
"windows-data-science-vm"
]
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "batch"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
equals: "rendering-windows2016"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "center-for-internet-security-inc"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "cis-windows-server-201*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "pivotal"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "bosh-windows-server*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imagePublisher",
equals: "cloud-infrastructure-services"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
like: "ad*"
}
]
},
{1 itemallOf: [2 items{1 itemanyOf: [2 items{2 itemsfield: "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration",
exists: "true"
},
{2 itemsfield: "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
like: "Windows*"
}
]
},
{1 itemanyOf: [2 items{2 itemsfield: "Microsoft.Compute/imageSKU",
exists: "false"
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Compute/imageSKU",
notLike: "2008*"
},
{2 itemsfield: "Microsoft.Compute/imageOffer",
notLike: "SQL2008*"
}
]
}
]
}
]
}
]
}
]
},
{1 itemallOf: [2 items{2 itemsvalue: "[parameters('IncludeArcMachines')]",
equals: "true"
},
{1 itemanyOf: [2 items{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.HybridCompute/machines"
},
{2 itemsfield: "Microsoft.HybridCompute/imageOffer",
like: "windows*"
}
]
},
{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.ConnectedVMwarevSphere/virtualMachines"
},
{2 itemsfield: "Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType",
like: "windows*"
}
]
}
]
}
]
}
]
},
then: {2 itemseffect: "[parameters('effect')]",
details: {3 itemstype: "Microsoft.GuestConfiguration/guestConfigurationAssignments",
name: "AzureBaseline_SecurityOptionsDevices",
existenceCondition: {1 itemallOf: [2 items{2 itemsfield: "Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus",
equals: "Compliant"
},
{2 itemsfield: "Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash",
equals: 🔍"[
    base64(
        concat(
           'Devices: Allowed to format and eject removable media;ExpectedValue',
            '=',
             parameters('DevicesAllowedToFormatAndEjectRemovableMedia')
        )
    )
]"
}
]
}
}
}
}
}