last sync: 2021-Aug-04 14:59:26 UTC

Azure Policy definition

Configure Azure Log Analytics workspaces to disable public network access for log ingestion and querying

Name Configure Azure Log Analytics workspaces to disable public network access for log ingestion and querying
Azure Portal
Id d3ba9c42-9dd5-441a-957c-274031c750c0
Version 1.1.0
details on versioning
Category Monitoring
Microsoft docs
Description Improve workspace security by blocking log ingestion and querying from public networks. Only private-link connected networks will be able to ingest and query logs on this workspace. Learn more at https://aka.ms/AzMonPrivateLink#configure-log-analytics.
Mode Indexed
Type BuiltIn
Preview FALSE
Deprecated FALSE
Effect Default: Modify
Allowed: (Modify, Disabled)
Used RBAC Role
Role Name Role Id
Log Analytics Contributor 92aaf0da-9dab-42b6-94a3-d43ce8d16293
History
Date/Time (UTC ymd) (i) Change type Change detail
2021-07-30 15:17:20 change Minor (1.0.0 > 1.1.0)
2021-07-07 15:26:31 add d3ba9c42-9dd5-441a-957c-274031c750c0
Used in Initiatives none
JSON Changes

JSON
{
  "properties": {
    "displayName": "Configure Azure Log Analytics workspaces to disable public network access for log ingestion and querying",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "description": "Improve workspace security by blocking log ingestion and querying from public networks. Only private-link connected networks will be able to ingest and query logs on this workspace. Learn more at https://aka.ms/AzMonPrivateLink#configure-log-analytics.",
    "metadata": {
      "version": "1.1.0",
      "category": "Monitoring"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "The effect determines what happens when the policy rule is evaluated to match"
        },
        "allowedValues": [
          "Modify",
          "Disabled"
        ],
        "defaultValue": "Modify"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.OperationalInsights/workspaces"
          },
          {
            "anyOf": [
              {
                "field": "Microsoft.OperationalInsights/workspaces/publicNetworkAccessForIngestion",
                "notEquals": "Disabled"
              },
              {
                "field": "Microsoft.OperationalInsights/workspaces/publicNetworkAccessForQuery",
                "notEquals": "Disabled"
              }
            ]
          }
        ]
      },
      "then": {
      "effect": "[parameters('effect')]",
        "details": {
          "roleDefinitionIds": [
            "/providers/microsoft.authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293"
          ],
          "conflictEffect": "Audit",
          "operations": [
            {
              "operation": "addOrReplace",
              "field": "Microsoft.OperationalInsights/workspaces/publicNetworkAccessForIngestion",
              "value": "Disabled"
            },
            {
              "operation": "addOrReplace",
              "field": "Microsoft.OperationalInsights/workspaces/publicNetworkAccessForQuery",
              "value": "Disabled"
            }
          ]
        }
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/d3ba9c42-9dd5-441a-957c-274031c750c0",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "d3ba9c42-9dd5-441a-957c-274031c750c0"
}