Configure Azure Monitor Private Link Scope to use private DNS zones

Azure BuiltIn Policy definition

Alias

Namespace

ResourceType

Path

PathIsDefault

DefaultPath

Modifiable

Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*]

Microsoft.Network

privateEndpoints

properties.privateLinkServiceConnections[*]

True

False

Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]

Microsoft.Network

privateEndpoints

properties.privateLinkServiceConnections[*].properties.groupIds[*]

True

False

Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].privateLinkServiceId

Microsoft.Network

privateEndpoints

properties.privateLinkServiceConnections[*].properties.privateLinkServiceId

True

False

Rows: 1-1 / 1

Records:

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Page of 1

Initiative DisplayName

Initiative Id

Initiative Category

State

Type

polSet in AzUSGov

Configure Azure PaaS services to use private DNS zones

Deploy-Private-DNS-Zones

Network

ALZ

Date/Time (UTC ymd) (i)

Change type

Change detail

2021-07-07 15:26:31

add

437914ee-c176-4fff-8986-7e05eb971365

{

displayName: "Configure Azure Monitor Private Link Scope to use private DNS zones",
policyType: "BuiltIn",
mode: "Indexed",
description: "Use private DNS zones to override the DNS resolution for a private endpoint. A private DNS zone links to your virtual network to resolve to Azure Monitor private link scope. Learn more at: https://docs.microsoft.com/azure/azure-monitor/logs/private-link-security#connect-to-a-private-endpoint.",
metadata: {2 items
- version: "1.0.0",
- category: "Monitoring"
},
parameters: {6 items
- privateDnsZoneId1: {2 items
  - type: "String",
  - metadata: {4 items
    - displayName: "Private DNS Zone for global endpoints used by Azure Monitor",
    - description: "One of the five private DNS zone IDs required for Microsoft.Insights/privateLinkScopes to resolve a private DNS Zone to your Azure Monitor Private Link scope.",
    - strongType: "Microsoft.Network/privateDnsZones",
    - assignPermissions: true
    }
  },
- privateDnsZoneId2: {2 items
  - type: "String",
  - metadata: {4 items
    - displayName: "Private DNS Zone for workspace-specific mapping to OMS agents endpoints",
    - description: "One of the five private DNS zone IDs required for Microsoft.Insights/privateLinkScopes to resolve a private DNS Zone to your Azure Monitor Private Link scope.",
    - strongType: "Microsoft.Network/privateDnsZones",
    - assignPermissions: true
    }
  },
- privateDnsZoneId3: {2 items
  - type: "String",
  - metadata: {4 items
    - displayName: "Private DNS Zone for workspace-specific mapping to ingestion endpoints",
    - description: "One of the five private DNS zone IDs required for Microsoft.Insights/privateLinkScopes to resolve a private DNS Zone to your Azure Monitor Private Link scope.",
    - strongType: "Microsoft.Network/privateDnsZones",
    - assignPermissions: true
    }
  },
- privateDnsZoneId4: {2 items
  - type: "String",
  - metadata: {4 items
    - displayName: "Private DNS Zone for workspace-specific mapping to the agent service automation endpoints",
    - description: "One of the five private DNS zone IDs required for Microsoft.Insights/privateLinkScopes to resolve a private DNS Zone.",
    - strongType: "Microsoft.Network/privateDnsZones",
    - assignPermissions: true
    }
  },
- privateDnsZoneId5: {2 items
  - type: "String",
  - metadata: {4 items
    - displayName: "Private DNS Zone for connectivity to the global agent's solution packs storage account",
    - description: "One of the five private DNS zone IDs required for Microsoft.Insights/privateLinkScopes to resolve a private DNS Zone.",
    - strongType: "Microsoft.Network/privateDnsZones",
    - assignPermissions: true
    }
  },
- effect: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect",
    - description: "Enable or disable the execution of the policy"
    },
  - allowedValues: [2 items
    - "DeployIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "DeployIfNotExists"
  }
},
policyRule: {2 items
- if: {1 item
  - allOf: [2 items
    - {2 items
      - field: "type",
      - equals: "Microsoft.Network/privateEndpoints"
      },
    - {2 items
      - count: {2 items
        field: "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*]",
        where: {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].privateLinkServiceId",
        contains: "Microsoft.Insights/privateLinkScopes"
        },
        {2 items
        field: "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
        equals: "azuremonitor"
        }
        ]
        }
        },
      - greaterOrEquals: 1
      }
    ]
  },
- then: {2 items
  - effect: "[parameters('effect')]",
  - details: {3 items
    - type: "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
    - roleDefinitionIds: [1 item
      - "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7" Network Contributor
      ],
    - deployment: {1 item
      - properties: {3 items
        mode: "incremental",
        template: {4 items
        $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        contentVersion: "1.0.0.0",
        parameters: {7 items
        privateDnsZoneId1: {1 item
        type: "string"
        },
        privateDnsZoneId2: {1 item
        type: "string"
        },
        privateDnsZoneId3: {1 item
        type: "string"
        },
        privateDnsZoneId4: {1 item
        type: "string"
        },
        privateDnsZoneId5: {1 item
        type: "string"
        },
        privateEndpointName: {1 item
        type: "string"
        },
        location: {1 item
        type: "string"
        }
        },
        resources: [1 item
        {5 items
        name: 🔍"[ concat( parameters('privateEndpointName'), '/deployedByPolicy' ) ]",
        type: "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
        apiVersion: "2020-03-01",
        location: "[parameters('location')]",
        properties: {1 item
        privateDnsZoneConfigs: [5 items
        {2 items
        name: "privateDnsZone1",
        properties: {1 item
        privateDnsZoneId: "[parameters('privateDnsZoneId1')]"
        }
        },
        {2 items
        name: "privateDnsZone2",
        properties: {1 item
        privateDnsZoneId: "[parameters('privateDnsZoneId2')]"
        }
        },
        {2 items
        name: "privateDnsZone3",
        properties: {1 item
        privateDnsZoneId: "[parameters('privateDnsZoneId3')]"
        }
        },
        {2 items
        name: "privateDnsZone4",
        properties: {1 item
        privateDnsZoneId: "[parameters('privateDnsZoneId4')]"
        }
        },
        {2 items
        name: "privateDnsZone5",
        properties: {1 item
        privateDnsZoneId: "[parameters('privateDnsZoneId5')]"
        }
        }
        ]
        }
        }
        ]
        },
        parameters: {7 items
        privateDnsZoneId1: {1 item
        value: "[parameters('privateDnsZoneId1')]"
        },
        privateDnsZoneId2: {1 item
        value: "[parameters('privateDnsZoneId2')]"
        },
        privateDnsZoneId3: {1 item
        value: "[parameters('privateDnsZoneId3')]"
        },
        privateDnsZoneId4: {1 item
        value: "[parameters('privateDnsZoneId4')]"
        },
        privateDnsZoneId5: {1 item
        value: "[parameters('privateDnsZoneId5')]"
        },
        privateEndpointName: {1 item
        value: "[field('name')]"
        },
        location: {1 item
        value: "[field('location')]"
        }
        }
        }
      }
    }
  }
}

}