Can i push Account lockout policy to all the servers in the subscriptions in a perticuler Tenent at once.

Question

in here there are about 700VMs in over 500 Subscriptions. but all are in the same Tennant.
I need to push the Account Lockout Policy for all these VMs.
what are the possibilities I can go with?

Answer 1

Hi @Anonymous ,

Welcome to Microsoft Q&A! Thanks for posting the question.

I understand that you are trying to enable Account Lockout policy to multiple VMs in Azure Subscription. There are many ways to achieve it at scale, and following are some of the options available:

Method 1 - Using Azure Active Directory Domain Services managed domains
If these VMs are connected to Azure Active Directory Domain Services managed domain, you may define Password and account lockout policies using Azure AD. For more details, please refer to Password and account lockout policies on Azure Active Directory Domain Services managed domains

Method 2 - Using Azure Policy
This involves multiple steps and understanding of Guest Configuration feature of Azure Policy. This is particularly useful if you want to manage local settings on VMs such as - OS settings, Application configuration or presence and Environment settings. This can also be used for auditing/applying local Group Polices. Therefore, if you want to enable the Account Lockout Policy on each VMs, you may use this option. This method involes:

• Creating a guest configuration content artifact (.zip)
• Validating the package meets requirements
• Installing the guest configuration agent locally for testing
• Validating the package can be used to audit settings in a machine
• Validating the package can be used to configure settings in a machine
• Publishing the package to Azure storage
• Creating a policy definition
• Publishing the policy

You may refer to this How-to-guide to understand this process in detail and the complete walkthrough. Some of the Azure Policy's built-in packages for guest configuration are available here for your reference - List of built-in packages for guest configuration - Azure Policy

Method 3 - Using PowerShell
Group Policy PowerShell module can be used to configure local policy for a machine. You may also use it in Azure Automation for automatic update of local group policy setting on all the VMs/subset of VMs.

Please let me know if you have any questions.

---
Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.