Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Built-in Policy Release f9ebef38 #1243

Merged
merged 1 commit into from
Nov 28, 2023
Merged

Built-in Policy Release f9ebef38 #1243

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions built-in-policies/policyDefinitions/Azure Arc/GuestConfiguration_ArcESU_Deny.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
{
"properties": {
"displayName": "[Preview]: Deny Extended Security Updates (ESUs) license creation or modification.",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "This policy enables you to restrict the creation or modification of ESU licenses for Windows Server 2012 Arc machines. For more details on pricing please visit https://aka.ms/ArcWS2012ESUPricing",
"metadata": {
"version": "1.0.0-preview",
"category": "Azure Arc",
"preview": true
},
"version": "1.0.0-preview",
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"Deny",
"Disabled"
],
"defaultValue": "Deny"
}
},
"policyRule": {
"if": {
"field": "type",
"equals": "Microsoft.HybridCompute/licenses"
},
"then": {
"effect": "[parameters('effect')]"
}
}
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/4c660f31-eafb-408d-a2b3-6ed2260bd26c",
"name": "4c660f31-eafb-408d-a2b3-6ed2260bd26c"
}
123 changes: 123 additions & 0 deletions ...-in-policies/policyDefinitions/Azure Arc/GuestConfiguration_ArcESU_DeployIfNotExists.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,123 @@
{
"properties": {
"displayName": "[Preview]: Enable Extended Security Updates (ESUs) license to keep Windows 2012 machines protected after their support lifecycle has ended.",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "Enable Extended Security Updates (ESUs) license to keep Windows 2012 machines protected even after their support lifecycle has ended. Learn How to prepare to deliver Extended Security Updates for Windows Server 2012 through AzureArc please visit https://learn.microsoft.com/en-us/azure/azure-arc/servers/prepare-extended-security-updates. For more details on pricing please visit https://aka.ms/ArcWS2012ESUPricing",
"metadata": {
"version": "1.0.0-preview",
"category": "Azure Arc",
"preview": true
},
"version": "1.0.0-preview",
"parameters": {
"ESULicenseResourceId": {
"type": "string",
"metadata": {
"displayName": "Extended Security Updates (ESUs) license Resource ID.",
"description": "Resource ID of the Extended Security Updates (ESUs) license.",
"portalReview": "true",
"assignPermissions": true
}
},
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"DeployIfNotExists",
"Disabled"
],
"defaultValue": "DeployIfNotExists"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.HybridCompute/machines"
},
{
"field": "Microsoft.HybridCompute/imageOffer",
"like": "windows*"
},
{
"field": "Microsoft.HybridCompute/machines/licenseProfile.esuProfile.esuEligibility",
"equals": "Eligible"
}
]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"roleDefinitionIds": [
"/providers/Microsoft.Authorization/roleDefinitions/48b40c6e-82e0-4eb3-90d5-19e40f49b624",
"/providers/Microsoft.Authorization/roleDefinitions/088ab73d-1256-47ae-bea9-9de8e7131f31"
],
"name": "default",
"type": "Microsoft.HybridCompute/machines/licenseProfiles",
"existenceCondition": {
"field": "Microsoft.HybridCompute/machines/licenseProfiles/esuProfile.assignedLicense",
"equals": "[parameters('ESULicenseResourceId')]"
},
"deployment": {
"properties": {
"mode": "incremental",
"parameters": {
"vmName": {
"value": "[field('name')]"
},
"location": {
"value": "[field('location')]"
},
"type": {
"value": "[field('type')]"
},
"ESULicenseResourceId": {
"value": "[parameters('ESULicenseResourceId')]"
}
},
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"type": "string"
},
"location": {
"type": "string"
},
"type": {
"type": "string"
},
"ESULicenseResourceId": {
"type": "string"
}
},
"resources": [
{
"condition": "[equals(toLower(parameters('type')), toLower('Microsoft.HybridCompute/machines'))]",
"apiVersion": "2023-06-20-preview",
"type": "Microsoft.HybridCompute/machines/licenseProfiles",
"name": "[concat(parameters('vmName'), '/default')]",
"location": "[parameters('location')]",
"properties": {
"esuProfile": {
"assignedLicense": "[parameters('ESULicenseResourceId')]"
}
}
}
]
}
}
}
}
}
}
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/4864134f-d306-4ff5-94d8-ea4553b18c97",
"name": "4864134f-d306-4ff5-94d8-ea4553b18c97"
}
39 changes: 39 additions & 0 deletions ...policies/policyDefinitions/Azure Government/Azure Arc/GuestConfiguration_ArcESU_Deny.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
{
"properties": {
"displayName": "[Preview]: Deny Extended Security Updates (ESUs) license creation or modification.",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "This policy enables you to restrict the creation or modification of ESU licenses for Windows Server 2012 Arc machines. For more details on pricing please visit https://aka.ms/ArcWS2012ESUPricing",
"metadata": {
"version": "1.0.0-preview",
"category": "Azure Arc",
"preview": true
},
"version": "1.0.0-preview",
"parameters": {
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"Deny",
"Disabled"
],
"defaultValue": "Deny"
}
},
"policyRule": {
"if": {
"field": "type",
"equals": "Microsoft.HybridCompute/licenses"
},
"then": {
"effect": "[parameters('effect')]"
}
}
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/4c660f31-eafb-408d-a2b3-6ed2260bd26c",
"name": "4c660f31-eafb-408d-a2b3-6ed2260bd26c"
}
123 changes: 123 additions & 0 deletions ...cyDefinitions/Azure Government/Azure Arc/GuestConfiguration_ArcESU_DeployIfNotExists.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,123 @@
{
"properties": {
"displayName": "[Preview]: Enable Extended Security Updates (ESUs) license to keep Windows 2012 machines protected after their support lifecycle has ended.",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "Enable Extended Security Updates (ESUs) license to keep Windows 2012 machines protected even after their support lifecycle has ended. Learn How to prepare to deliver Extended Security Updates for Windows Server 2012 through AzureArc please visit https://learn.microsoft.com/en-us/azure/azure-arc/servers/prepare-extended-security-updates. For more details on pricing please visit https://aka.ms/ArcWS2012ESUPricing",
"metadata": {
"version": "1.0.0-preview",
"category": "Azure Arc",
"preview": true
},
"version": "1.0.0-preview",
"parameters": {
"ESULicenseResourceId": {
"type": "string",
"metadata": {
"displayName": "Extended Security Updates (ESUs) license Resource ID.",
"description": "Resource ID of the Extended Security Updates (ESUs) license.",
"portalReview": "true",
"assignPermissions": true
}
},
"effect": {
"type": "String",
"metadata": {
"displayName": "Effect",
"description": "Enable or disable the execution of the policy"
},
"allowedValues": [
"DeployIfNotExists",
"Disabled"
],
"defaultValue": "DeployIfNotExists"
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.HybridCompute/machines"
},
{
"field": "Microsoft.HybridCompute/imageOffer",
"like": "windows*"
},
{
"field": "Microsoft.HybridCompute/machines/licenseProfile.esuProfile.esuEligibility",
"equals": "Eligible"
}
]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"roleDefinitionIds": [
"/providers/Microsoft.Authorization/roleDefinitions/48b40c6e-82e0-4eb3-90d5-19e40f49b624",
"/providers/Microsoft.Authorization/roleDefinitions/088ab73d-1256-47ae-bea9-9de8e7131f31"
],
"name": "default",
"type": "Microsoft.HybridCompute/machines/licenseProfiles",
"existenceCondition": {
"field": "Microsoft.HybridCompute/machines/licenseProfiles/esuProfile.assignedLicense",
"equals": "[parameters('ESULicenseResourceId')]"
},
"deployment": {
"properties": {
"mode": "incremental",
"parameters": {
"vmName": {
"value": "[field('name')]"
},
"location": {
"value": "[field('location')]"
},
"type": {
"value": "[field('type')]"
},
"ESULicenseResourceId": {
"value": "[parameters('ESULicenseResourceId')]"
}
},
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"type": "string"
},
"location": {
"type": "string"
},
"type": {
"type": "string"
},
"ESULicenseResourceId": {
"type": "string"
}
},
"resources": [
{
"condition": "[equals(toLower(parameters('type')), toLower('Microsoft.HybridCompute/machines'))]",
"apiVersion": "2023-06-20-preview",
"type": "Microsoft.HybridCompute/machines/licenseProfiles",
"name": "[concat(parameters('vmName'), '/default')]",
"location": "[parameters('location')]",
"properties": {
"esuProfile": {
"assignedLicense": "[parameters('ESULicenseResourceId')]"
}
}
}
]
}
}
}
}
}
}
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/4864134f-d306-4ff5-94d8-ea4553b18c97",
"name": "4864134f-d306-4ff5-94d8-ea4553b18c97"
}
7 changes: 3 additions & 4 deletions ...policyDefinitions/Azure Government/Security Center/MDC_DfSQL_AMA_DefaultPipeline_Arc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,13 @@
{
"properties": {
"displayName": "[Preview]: Configure Arc-enabled SQL Servers to automatically install Microsoft Defender for SQL and DCR with a Log Analytics workspace",
"displayName": "Configure Arc-enabled SQL Servers to automatically install Microsoft Defender for SQL and DCR with a Log Analytics workspace",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). Create a resource group, a Data Collection Rule and Log Analytics workspace in the same region as the machine.",
"version": "1.1.1-preview",
"version": "1.1.2",
"metadata": {
"category": "Security Center",
"version": "1.1.1-preview",
"preview": true
"version": "1.1.2"
},
"parameters": {
"effect": {
Expand Down
9 changes: 4 additions & 5 deletions .../policyDefinitions/Azure Government/Security Center/MDC_DfSQL_AMA_DefaultPipeline_VM.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,13 @@
{
"properties": {
"displayName": "[Preview]: Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL and DCR with a Log Analytics workspace",
"displayName": "Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL and DCR with a Log Analytics workspace",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). Create a resource group, a Data Collection Rule and Log Analytics workspace in the same region as the machine.",
"version": "1.2.0-preview",
"version": "1.2.1",
"metadata": {
"version": "1.2.0-preview",
"category": "Security Center",
"preview": true
"version": "1.2.1",
"category": "Security Center"
},
"parameters": {
"effect": {
Expand Down
7 changes: 3 additions & 4 deletions ...Definitions/Azure Government/Security Center/MDC_DfSQL_AMA_UserWorkspacePipeline_Arc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,13 @@
{
"properties": {
"displayName": "[Preview]: Configure Arc-enabled SQL Servers to automatically install Microsoft Defender for SQL and DCR with a user-defined LA workspace",
"displayName": "Configure Arc-enabled SQL Servers to automatically install Microsoft Defender for SQL and DCR with a user-defined LA workspace",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). Create a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace.",
"version": "1.2.0-preview",
"version": "1.2.1",
"metadata": {
"category": "Security Center",
"version": "1.2.0-preview",
"preview": true
"version": "1.2.1"
},
"parameters": {
"effect": {
Expand Down
Loading