last sync: 2021-Oct-25 16:02:14 UTC

Azure Policy definition

[Preview]: Configure system-assigned managed identity to enable Azure Monitor assignments on VMs

Name [Preview]: Configure system-assigned managed identity to enable Azure Monitor assignments on VMs
Azure Portal
Id 17b3de92-f710-4cf4-aa55-0e7859f1ed7b
Version 4.0.0-preview
details on versioning
Category Monitoring
Microsoft docs
Description Configure system-assigned managed identity to virtual machines hosted in Azure that are supported by Azure Monitor and do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Azure Monitor assignments and must be added to machines before using any Azure Monitor extension. Target virtual machines must be in a supported location.
Mode Indexed
Type BuiltIn
Preview True
Deprecated FALSE
Effect Default: Modify
Allowed: (Modify, Disabled)
Used RBAC Role
Role Name Role Id
Virtual Machine Contributor 9980e02c-c2be-4d73-94e8-173b1dc7cf3c
Managed Identity Contributor e40ec5ca-96e0-45a2-b4ff-59039f2c2b59
Managed Identity Operator f1a07417-d97a-45cb-824c-7a7467783830
History
Date/Time (UTC ymd) (i) Change type Change detail
2021-10-19 19:10:32 change Major, suffix remains equal (3.0.0-preview > 4.0.0-preview)
2021-06-02 22:44:52 change Major, suffix remains equal (2.0.0-preview > 3.0.0-preview)
2021-05-04 14:34:06 change Major, suffix remains equal (1.2.0-preview > 2.0.0-preview)
2021-03-02 15:11:40 change Minor, suffix remains equal (1.1.0-preview > 1.2.0-preview)
2021-02-23 16:24:42 change Minor, suffix remains equal (1.0.0-preview > 1.1.0-preview)
2021-01-22 09:14:53 add 17b3de92-f710-4cf4-aa55-0e7859f1ed7b
Used in Initiatives
Initiative DisplayName Initiative Id Initiative Category State
[Preview]: Configure machines to automatically install the Azure Monitor and Azure Security agents on virtual machines a15f3269-2e10-458c-87a4-d5989e678a73 Monitoring Preview
[Preview]: Configure prerequisites to enable Guest Attestation on Trusted Launch enabled VMs 281d9e47-d14d-4f05-b8eb-18f2c4a034ff Trusted Launch Preview
JSON Changes

JSON
{
  "displayName": "[Preview]: Configure system-assigned managed identity to enable Azure Monitor assignments on VMs",
  "policyType": "BuiltIn",
  "mode": "Indexed",
  "description": "Configure system-assigned managed identity to virtual machines hosted in Azure that are supported by Azure Monitor and do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Azure Monitor assignments and must be added to machines before using any Azure Monitor extension. Target virtual machines must be in a supported location.",
  "metadata": {
    "category": "Monitoring",
    "version": "4.0.0-preview",
    "preview": true
  },
  "parameters": {
    "effect": {
      "type": "String",
      "metadata": {
        "displayName": "Effect",
        "description": "Enable or disable the execution of the policy"
      },
      "allowedValues": [
        "Modify",
        "Disabled"
      ],
      "defaultValue": "Modify"
    }
  },
  "policyRule": {
    "if": {
      "allOf": [
        {
          "anyOf": [
            {
              "field": "type",
              "equals": "Microsoft.Compute/virtualMachines"
            },
            {
              "field": "type",
              "equals": "Microsoft.Compute/virtualMachineScaleSets"
            }
          ]
        },
        {
          "field": "location",
          "in": [
            "australiacentral",
            "australiaeast",
            "australiasoutheast",
            "brazilsouth",
            "canadacentral",
            "canadaeast",
            "centralindia",
            "centralus",
            "eastasia",
            "eastus2euap",
            "eastus",
            "eastus2",
            "francecentral",
            "germanywestcentral",
            "japaneast",
            "japanwest",
            "jioindiawest",
            "koreacentral",
            "koreasouth",
            "northcentralus",
            "northeurope",
            "norwayeast",
            "southafricanorth",
            "southcentralus",
            "southeastasia",
            "southindia",
            "switzerlandnorth",
            "uaenorth",
            "uksouth",
            "ukwest",
            "westcentralus",
            "westeurope",
            "westindia",
            "westus",
            "westus2"
          ]
        },
        {
          "anyOf": [
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "RedHat"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "in": [
                    "RHEL",
                    "RHEL-SAP-HANA"
                  ]
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "6*"
                    },
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "7*"
                    },
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "8*"
                    }
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "SUSE"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "in": [
                    "SLES",
                    "SLES-HPC",
                    "SLES-HPC-Priority",
                    "SLES-SAP",
                    "SLES-SAP-BYOS",
                    "SLES-Priority",
                    "SLES-BYOS",
                    "SLES-SAPCAL",
                    "SLES-Standard"
                  ]
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "12*"
                    },
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "15*"
                    }
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "Canonical"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "UbuntuServer"
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "14.04*LTS"
                    },
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "16.04*LTS"
                    },
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "18.04*LTS"
                    }
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "Canonical"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "0001-com-ubuntu-server-focal"
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "20_04-lts*"
                    }
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "Oracle"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "Oracle-Linux"
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "6*"
                    },
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "7*"
                    },
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "8*"
                    }
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "OpenLogic"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "in": [
                    "CentOS",
                    "Centos-LVM",
                    "CentOS-SRIOV"
                  ]
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "6*"
                    },
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "7*"
                    },
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "8*"
                    }
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "cloudera"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "cloudera-centos-os"
                },
                {
                  "field": "Microsoft.Compute/imageSku",
                  "like": "7*"
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "credativ"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "in": [
                    "debian"
                  ]
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "8"
                    },
                    {
                      "field": "Microsoft.Compute/imageSku",
                      "like": "9"
                    }
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "Debian"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "in": [
                    "debian-10"
                  ]
                },
                {
                  "field": "Microsoft.Compute/imageSku",
                  "like": "10"
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "MicrosoftWindowsServer"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "WindowsServer"
                },
                {
                  "field": "Microsoft.Compute/imageSku",
                  "in": [
                    "2008-R2-SP1",
                    "2008-R2-SP1-smalldisk",
                    "2012-Datacenter",
                    "2012-Datacenter-smalldisk",
                    "2012-R2-Datacenter",
                    "2012-R2-Datacenter-smalldisk",
                    "2016-Datacenter",
                    "2016-Datacenter-Server-Core",
                    "2016-Datacenter-Server-Core-smalldisk",
                    "2016-Datacenter-smalldisk",
                    "2016-Datacenter-with-Containers",
                    "2016-Datacenter-with-RDSH",
                    "2019-Datacenter",
                    "2019-Datacenter-Core",
                    "2019-Datacenter-Core-smalldisk",
                    "2019-Datacenter-Core-with-Containers",
                    "2019-Datacenter-Core-with-Containers-smalldisk",
                    "2019-Datacenter-smalldisk",
                    "2019-Datacenter-with-Containers",
                    "2019-Datacenter-with-Containers-smalldisk",
                    "2019-Datacenter-zhcn"
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "MicrosoftWindowsServer"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "WindowsServerSemiAnnual"
                },
                {
                  "field": "Microsoft.Compute/imageSku",
                  "in": [
                    "Datacenter-Core-1709-smalldisk",
                    "Datacenter-Core-1709-with-Containers-smalldisk",
                    "Datacenter-Core-1803-with-Containers-smalldisk"
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "MicrosoftWindowsServerHPCPack"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "WindowsServerHPCPack"
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "MicrosoftSQLServer"
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "*-WS2019"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "*-WS2019-BYOL"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "*-WS2016"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "*-WS2016-BYOL"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "*-WS2012R2"
                    },
                    {
                      "field": "Microsoft.Compute/imageOffer",
                      "like": "*-WS2012R2-BYOL"
                    }
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "MicrosoftRServer"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "MLServer-WS2016"
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "MicrosoftVisualStudio"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "in": [
                    "VisualStudio",
                    "Windows"
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "MicrosoftDynamicsAX"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "Dynamics"
                },
                {
                  "field": "Microsoft.Compute/imageSku",
                  "equals": "Pre-Req-AX7-Onebox-U8"
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "microsoft-ads"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "windows-data-science-vm"
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "MicrosoftWindowsDesktop"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "equals": "Windows-10"
                }
              ]
            },
            {
              "field": "Microsoft.Compute/virtualMachines/securityProfile.uefiSettings",
              "exists": "true"
            }
          ]
        },
        {
          "value": "[requestContext().apiVersion]",
          "greaterOrEquals": "2018-10-01"
        },
        {
          "field": "identity.type",
          "notContains": "SystemAssigned"
        }
      ]
    },
    "then": {
      "effect": "[parameters('effect')]",
      "details": {
        "roleDefinitionIds": [
          "/providers/microsoft.authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c",
          "/providers/microsoft.authorization/roleDefinitions/e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
          "/providers/microsoft.authorization/roleDefinitions/f1a07417-d97a-45cb-824c-7a7467783830"
        ],
        "operations": [
          {
            "operation": "addOrReplace",
            "field": "identity.type",
            "value": "[if(contains(field('identity.type'), 'UserAssigned'), concat(field('identity.type'), ',SystemAssigned'), 'SystemAssigned')]"
          }
        ]
      }
    }
  }
}