Deploy SQL database auditing settings

Azure Landing Zones (ALZ) Policy definition

Alias

Namespace

ResourceType

Path

PathIsDefault

DefaultPath

Modifiable

Microsoft.Sql/servers/databases/auditingSettings/isAzureMonitorTargetEnabled

Microsoft.Sql

servers/databases/auditingSettings

properties.isAzureMonitorTargetEnabled

True

False

Microsoft.Sql/servers/databases/auditingSettings/state

Microsoft.Sql

servers/databases/auditingSettings

properties.state

True

Rows: 1-2 / 2

Records:

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Page of 1

Initiative DisplayName

Initiative Id

Initiative Category

State

[Deprecated]: Deploy SQL Database built-in SQL security configuration

Deploy-Sql-Security

SQL

Deprecated

Deploy SQL Database built-in SQL security configuration

Deploy-Sql-Security_20240529

SQL

{

policyType: "Custom",
mode: "Indexed",
displayName: "Deploy SQL database auditing settings",
description: "Deploy auditing settings to SQL Database when it not exist in the deployment",
metadata: {4 items
- version: "1.0.0",
- category: "SQL",
- source: "https://github.com/Azure/Enterprise-Scale/",
- alzCloudEnvironments: [3 items
  - "AzureCloud",
  - "AzureChinaCloud",
  - "AzureUSGovernment"
  ]
},
parameters: {1 item
- effect: {4 items
  - type: "String",
  - defaultValue: "DeployIfNotExists",
  - allowedValues: [2 items
    - "DeployIfNotExists",
    - "Disabled"
    ],
  - metadata: {2 items
    - displayName: "Effect",
    - description: "Enable or disable the execution of the policy"
    }
  }
},
policyRule: {2 items
- if: {2 items
  - field: "type",
  - equals: "Microsoft.Sql/servers/databases"
  },
- then: {2 items
  - effect: "[parameters('effect')]",
  - details: {5 items
    - type: "Microsoft.Sql/servers/databases/auditingSettings",
    - name: "default",
    - existenceCondition: {1 item
      - allOf: [2 items
        {2 items
        field: "Microsoft.Sql/servers/databases/auditingSettings/state",
        equals: "enabled"
        },
        {2 items
        field: "Microsoft.Sql/servers/databases/auditingSettings/isAzureMonitorTargetEnabled",
        equals: "true"
        }
        ]
      },
    - deployment: {1 item
      - properties: {3 items
        mode: "Incremental",
        template: {6 items
        $schema: "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
        contentVersion: "1.0.0.0",
        parameters: {3 items
        location: {1 item
        type: "String"
        },
        sqlServerName: {1 item
        type: "String"
        },
        sqlServerDataBaseName: {1 item
        type: "String"
        }
        },
        variables: {},
        resources: [1 item
        {4 items
        name: 🔍"[ concat( parameters('sqlServerName'), '/', parameters('sqlServerDataBaseName'), '/default' ) ]",
        type: "Microsoft.Sql/servers/databases/auditingSettings",
        apiVersion: "2017-03-01-preview",
        properties: {3 items
        state: "enabled",
        auditActionsAndGroups: [15 items
        "BATCH_COMPLETED_GROUP",
        "DATABASE_OBJECT_CHANGE_GROUP",
        "SCHEMA_OBJECT_CHANGE_GROUP",
        "BACKUP_RESTORE_GROUP",
        "APPLICATION_ROLE_CHANGE_PASSWORD_GROUP",
        "DATABASE_PRINCIPAL_CHANGE_GROUP",
        "DATABASE_PRINCIPAL_IMPERSONATION_GROUP",
        "DATABASE_ROLE_MEMBER_CHANGE_GROUP",
        "USER_CHANGE_PASSWORD_GROUP",
        "DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP",
        "DATABASE_OBJECT_PERMISSION_CHANGE_GROUP",
        "DATABASE_PERMISSION_CHANGE_GROUP",
        "SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP",
        "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
        "FAILED_DATABASE_AUTHENTICATION_GROUP"
        ],
        isAzureMonitorTargetEnabled: true
        }
        }
        ],
        outputs: {}
        },
        parameters: {3 items
        location: {1 item
        value: "[field('location')]"
        },
        sqlServerName: {1 item
        value: 🔍"[ first( split( field('fullname'), '/' ) ) ]"
        },
        sqlServerDataBaseName: {1 item
        value: "[field('name')]"
        }
        }
        }
      },
    - roleDefinitionIds: [1 item
      - "/providers/Microsoft.Authorization/roleDefinitions/056cd41c-7e88-42e1-933e-88ba6a50c9c3" SQL Security Manager
      ]
    }
  }
}

}