Implementing a configuration management strategy
Implement a configuration management strategy
Drift is the problem being solved
Version desired state in source control, assess the existing estate, and choose the assignment behavior that matches the required remediation policy:
Machine Configuration has three assignment types. Audit reports state without changing it. ApplyAndMonitor applies the configuration once and reports later drift without automatically correcting it. ApplyAndAutoCorrect corrects detected drift at the next evaluation. An initial audit supplies evidence for deciding which machines need remediation; it is not a what-if plan and does not require remediating every finding.
Immutable versus mutable
| Approach | Handling drift |
|---|---|
| Mutable | Make a scoped update to existing resources; ApplyAndAutoCorrect can continuously remediate assigned machines |
| Immutable | Redeploy replacement resources from the latest versioned configuration instead of updating running targets in place |
Both approaches require a versioned definition. Choose replacement or in-place update according to workload and deployment constraints; neither label is an absolute property of a workload.
Secrets never live in the definition
Never store plaintext sensitive values in versioned pipeline or configuration files. For Azure Pipelines, a Key Vault-linked variable group maps secret names and fetches current values from the vault at runtime. For an application, a managed identity can authenticate to Key Vault and other Azure services without an explicit application credential.
If a secret is committed, revoke or rotate it first. Removing it from repository history is a separate, coordinated and disruptive process; existing clones or forks can retain copies.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/01-overview-concepts
- https://learn.microsoft.com/en-us/azure/governance/machine-configuration/concepts/remediation-options
- https://learn.microsoft.com/en-us/devops/deliver/what-is-infrastructure-as-code
- https://learn.microsoft.com/en-us/azure/well-architected/operational-excellence/workload-supply-chain
- https://learn.microsoft.com/en-us/azure/devops/pipelines/security/overview
- https://learn.microsoft.com/en-us/azure/devops/pipelines/library/link-variable-groups-to-key-vaults
- https://learn.microsoft.com/en-us/azure/key-vault/general/authentication
- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository