AzPolicyAdvertizer

last sync: 2025-Jul-03 17:22:55 UTC

Configure backup on virtual machines without a given tag to a new recovery services vault with a default policy

Azure BuiltIn Policy definition

Source Azure Portal
Display name Configure backup on virtual machines without a given tag to a new recovery services vault with a default policy
Id 98d0b9f8-fd90-49c9-88e2-d3baf3b0dd86
Version 9.4.0
Details on versioning
Versioning Versions supported for Versioning: 4
9.4.0
9.3.0
9.2.0
9.1.0
Built-in Versioning [Preview]
Category Backup
Microsoft Learn
Description Enforce backup for all virtual machines by deploying a recovery services vault in the same location and resource group as the virtual machine. Doing this is useful when different application teams in your organization are allocated separate resource groups and need to manage their own backups and restores. You can optionally exclude virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMAppCentricBackupExcludeTag.
Cloud environments AzureCloud = true
AzureUSGovernment = unknown
AzureChinaCloud = unknown
Available in AzUSGov Unknown, no evidence if Policy definition is/not available in AzureUSGovernment
Mode Indexed
Type BuiltIn
Preview False
Deprecated False
Effect Default
DeployIfNotExists
Allowed
auditIfNotExists, AuditIfNotExists, deployIfNotExists, DeployIfNotExists, disabled, Disabled
RBAC role(s)
Role Name Role Id
Virtual Machine Contributor 9980e02c-c2be-4d73-94e8-173b1dc7cf3c
Backup Contributor 5e467623-bb1f-42f4-a55d-6e525e11384b
Rule aliases IF (3)
Alias Namespace ResourceType Path PathIsDefault DefaultPath Modifiable
Microsoft.Compute/imageOffer Microsoft.Compute
Microsoft.Compute
Microsoft.Compute		 virtualMachines
virtualMachineScaleSets
disks		 properties.storageProfile.imageReference.offer
properties.virtualMachineProfile.storageProfile.imageReference.offer
properties.creationData.imageReference.id		 True
True
True

False
False
False
Microsoft.Compute/imagePublisher Microsoft.Compute
Microsoft.Compute
Microsoft.Compute		 virtualMachines
virtualMachineScaleSets
disks		 properties.storageProfile.imageReference.publisher
properties.virtualMachineProfile.storageProfile.imageReference.publisher
properties.creationData.imageReference.id		 True
True
True

False
False
False
Microsoft.Compute/imageSKU Microsoft.Compute
Microsoft.Compute
Microsoft.Compute		 virtualMachines
virtualMachineScaleSets
disks		 properties.storageProfile.imageReference.sku
properties.virtualMachineProfile.storageProfile.imageReference.sku
properties.creationData.imageReference.id		 True
True
True

False
False
False
Rule resource types IF (1)
THEN-Deployment (4)
Compliance
The following 2 compliance controls are associated with this Policy definition 'Configure backup on virtual machines without a given tag to a new recovery services vault with a default policy' (98d0b9f8-fd90-49c9-88e2-d3baf3b0dd86)
Rows: 1-2 / 2

Columns:

Close

Columns▼Records:
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi
?
Page of 1
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
op.cont.3 Periodic tests op.cont.3 Periodic tests 404 not found n/a n/a 91
op.cont.4 Alternative means op.cont.4 Alternative means 404 not found n/a n/a 95
Initiatives usage
Rows: 1-1 / 1
Records:
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi
?
Page of 1
Initiative DisplayName Initiative Id Initiative Category State Type polSet in AzUSGov
Spain ENS 175daf90-21e1-4fec-b745-7b4c909aa94c Regulatory Compliance GA BuiltIn unknown
History
Date/Time (UTC ymd) (i) Change type Change detail
2024-10-25 17:51:35 change Minor (9.3.0 > 9.4.0)
2024-05-13 17:44:58 change Minor (9.2.0 > 9.3.0)
2024-02-20 22:44:08 change Minor (9.1.0 > 9.2.0)
2023-01-13 18:06:06 change Minor (9.0.0 > 9.1.0)
2022-06-24 19:15:47 change Major (8.0.0 > 9.0.0)
2022-04-29 18:06:01 change Major (7.1.0 > 8.0.0)
2022-04-08 16:22:13 change Major (6.1.0 > 7.1.0)
2022-04-01 20:29:14 change Minor (6.0.0 > 6.1.0)
2022-02-11 18:30:22 change Major (5.0.0 > 6.0.0)
2021-12-06 22:17:57 change Major (4.0.0 > 5.0.0)
2021-11-12 16:23:07 change Major (3.0.0 > 4.0.0)
2021-06-15 14:05:41 change Version remains equal, old suffix: preview (3.0.0-preview > 3.0.0)
2021-04-27 15:38:15 change Major, suffix remains equal (2.0.0-preview > 3.0.0-preview)
2021-04-07 13:27:17 change Major, suffix remains equal (1.0.0-preview > 2.0.0-preview)
2020-11-10 16:00:42 add 98d0b9f8-fd90-49c9-88e2-d3baf3b0dd86
JSON compare
compare mode: version left: version right:
9.3.0 → 9.4.0 RENAMED
@@ -3,9 +3,9 @@
3
  "policyType": "BuiltIn",
4
  "mode": "Indexed",
5
  "description": "Enforce backup for all virtual machines by deploying a recovery services vault in the same location and resource group as the virtual machine. Doing this is useful when different application teams in your organization are allocated separate resource groups and need to manage their own backups and restores. You can optionally exclude virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMAppCentricBackupExcludeTag.",
6
  "metadata": {
7
- "version": "9.3.0",
8
  "category": "Backup"
9
  },
10
  "parameters": {
11
  "exclusionTagName": {
@@ -114,9 +114,10 @@
114
  "2022-datacenter-smalldisk",
115
  "2022-datacenter-core-g2",
116
  "2022-datacenter-core",
117
  "2022-datacenter-core-smalldisk-g2",
118
- "2022-datacenter-core-smalldisk"
 
119
  ]
120
  }
121
  ]
122
  },
@@ -177,8 +178,20 @@
177
  }
178
  ]
179
  },
180
  {
 
 
 
 
 
 
 
 
 
 
 
 
181
  "anyOf": [
182
  {
183
  "field": "Microsoft.Compute/imageOffer",
184
  "like": "*-WS2019"
 
3
  "policyType": "BuiltIn",
4
  "mode": "Indexed",
5
  "description": "Enforce backup for all virtual machines by deploying a recovery services vault in the same location and resource group as the virtual machine. Doing this is useful when different application teams in your organization are allocated separate resource groups and need to manage their own backups and restores. You can optionally exclude virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMAppCentricBackupExcludeTag.",
6
  "metadata": {
7
+ "version": "9.4.0",
8
  "category": "Backup"
9
  },
10
  "parameters": {
11
  "exclusionTagName": {
 
114
  "2022-datacenter-smalldisk",
115
  "2022-datacenter-core-g2",
116
  "2022-datacenter-core",
117
  "2022-datacenter-core-smalldisk-g2",
118
+ "2022-datacenter-core-smalldisk",
119
+ "2022-datacenter-azure-edition-hotpatch"
120
  ]
121
  }
122
  ]
123
  },
 
178
  }
179
  ]
180
  },
181
  {
182
+ "allOf": [
183
+ {
184
+ "field": "Microsoft.Compute/imageOffer",
185
+ "equals": "sql2022-ws2022"
186
+ },
187
+ {
188
+ "field": "Microsoft.Compute/imageSKU",
189
+ "equals": "web-gen2"
190
+ }
191
+ ]
192
+ },
193
+ {
194
  "anyOf": [
195
  {
196
  "field": "Microsoft.Compute/imageOffer",
197
  "like": "*-WS2019"
JSON
api-version=2021-06-01
EPAC 
{7 items
  • displayName: "Configure backup on virtual machines without a given tag to a new recovery services vault with a default policy",
  • policyType: "BuiltIn",
  • mode: "Indexed",
  • description: "Enforce backup for all virtual machines by deploying a recovery services vault in the same location and resource group as the virtual machine. Doing this is useful when different application teams in your organization are allocated separate resource groups and need to manage their own backups and restores. You can optionally exclude virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMAppCentricBackupExcludeTag.",
  • metadata: {2 items
    • version: "9.4.0",
    • category: "Backup"
    },
  • parameters: {3 items
    • exclusionTagName: {3 items
      • type: "String",
      • metadata: {2 items
        • displayName: "Exclusion Tag Name",
        • description: "Name of the tag to use for excluding VMs from the scope of this policy. This should be used along with the Exclusion Tag Value parameter. Learn more at https://aka.ms/AppCentricVMBackupPolicy."
        },
      • defaultValue: ""
      },
    • exclusionTagValue: {3 items
      • type: "Array",
      • metadata: {2 items
        • displayName: "Exclusion Tag Values",
        • description: "Value of the tag to use for excluding VMs from the scope of this policy (in case of multiple values, use a comma-separated list). This should be used along with the Exclusion Tag Name parameter. Learn more at https://aka.ms/AppCentricVMBackupPolicy."
        },
      • defaultValue: []
      },
    • effect: {4 items
      • type: "String",
      • metadata: {2 items
        • displayName: "Effect",
        • description: "Enable or disable the execution of the policy"
        },
      • allowedValues: [6 items
        • "auditIfNotExists",
        • "AuditIfNotExists",
        • "deployIfNotExists",
        • "DeployIfNotExists",
        • "disabled",
        • "Disabled"
        ],
      • defaultValue: "DeployIfNotExists"
      }
    },
  • policyRule: {2 items
    • if: {1 item
      • allOf: [6 items
        • {2 items
          • field: "type",
          • equals: "Microsoft.Compute/virtualMachines"
          },
        • {1 item
          • not: {2 items
            • field: 🔍"[
    concat(
       'tags[
           ',
             parameters('exclusionTagName'),
           '
        ]'
    )
]",
            • in: "[parameters('exclusionTagValue')]"
            }
          },
        • {2 items
          • field: "id",
          • notContains: "/resourceGroups/databricks-rg-"
          },
        • {2 items
          • field: "Microsoft.Compute/imagePublisher",
          • notEquals: "azureopenshift"
          },
        • {2 items
          • field: "Microsoft.Compute/imagePublisher",
          • notEquals: "AzureDatabricks"
          },
        • {1 item
          • anyOf: [16 items
            • {1 item
              • allOf: [3 items
                • {2 items
                  • field: "Microsoft.Compute/imagePublisher",
                  • equals: "MicrosoftWindowsServer"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageOffer",
                  • equals: "WindowsServer"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageSKU",
                  • in: [36 items
                    • "2008-R2-SP1",
                    • "2008-R2-SP1-smalldisk",
                    • "2012-Datacenter",
                    • "2012-Datacenter-smalldisk",
                    • "2012-R2-Datacenter",
                    • "2012-R2-Datacenter-smalldisk",
                    • "2016-Datacenter",
                    • "2016-datacenter-gensecond",
                    • "2016-Datacenter-Server-Core",
                    • "2016-Datacenter-Server-Core-smalldisk",
                    • "2016-Datacenter-smalldisk",
                    • "2016-Datacenter-with-Containers",
                    • "2016-Datacenter-with-RDSH",
                    • "2019-Datacenter",
                    • "2019-Datacenter-Core",
                    • "2019-Datacenter-Core-smalldisk",
                    • "2019-Datacenter-Core-with-Containers",
                    • "2019-Datacenter-Core-with-Containers-smalldisk",
                    • "2019-Datacenter-smalldisk",
                    • "2019-Datacenter-with-Containers",
                    • "2019-Datacenter-with-Containers-smalldisk",
                    • "2019-Datacenter-zhcn",
                    • "2019-datacenter-gensecond",
                    • "2022-datacenter-g2",
                    • "2022-datacenter",
                    • "2022-datacenter-azure-edition",
                    • "2022-datacenter-azure-edition-smalldisk",
                    • "2022-datacenter-azure-edition-core",
                    • "2022-datacenter-azure-edition-core-smalldisk",
                    • "2022-datacenter-smalldisk-g2",
                    • "2022-datacenter-smalldisk",
                    • "2022-datacenter-core-g2",
                    • "2022-datacenter-core",
                    • "2022-datacenter-core-smalldisk-g2",
                    • "2022-datacenter-core-smalldisk",
                    • "2022-datacenter-azure-edition-hotpatch"
                    ]
                  }
                ]
              },
            • {1 item
              • allOf: [3 items
                • {2 items
                  • field: "Microsoft.Compute/imagePublisher",
                  • equals: "MicrosoftWindowsServer"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageOffer",
                  • equals: "WindowsServerSemiAnnual"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageSKU",
                  • in: [3 items
                    • "Datacenter-Core-1709-smalldisk",
                    • "Datacenter-Core-1709-with-Containers-smalldisk",
                    • "Datacenter-Core-1803-with-Containers-smalldisk"
                    ]
                  }
                ]
              },
            • {1 item
              • allOf: [2 items
                • {2 items
                  • field: "Microsoft.Compute/imagePublisher",
                  • equals: "MicrosoftWindowsServerHPCPack"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageOffer",
                  • equals: "WindowsServerHPCPack"
                  }
                ]
              },
            • {1 item},
            • {1 item
              • allOf: [2 items
                • {2 items
                  • field: "Microsoft.Compute/imagePublisher",
                  • equals: "MicrosoftRServer"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageOffer",
                  • equals: "MLServer-WS2016"
                  }
                ]
              },
            • {1 item},
            • {1 item
              • allOf: [3 items
                • {2 items
                  • field: "Microsoft.Compute/imagePublisher",
                  • equals: "MicrosoftDynamicsAX"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageOffer",
                  • equals: "Dynamics"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageSKU",
                  • equals: "Pre-Req-AX7-Onebox-U8"
                  }
                ]
              },
            • {1 item
              • allOf: [2 items
                • {2 items
                  • field: "Microsoft.Compute/imagePublisher",
                  • equals: "microsoft-ads"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageOffer",
                  • equals: "windows-data-science-vm"
                  }
                ]
              },
            • {1 item
              • allOf: [2 items
                • {2 items
                  • field: "Microsoft.Compute/imagePublisher",
                  • equals: "MicrosoftWindowsDesktop"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageOffer",
                  • equals: "Windows-10"
                  }
                ]
              },
            • {1 item
              • allOf: [2 items
                • {2 items
                  • field: "Microsoft.Compute/imagePublisher",
                  • equals: "MicrosoftWindowsDesktop"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageOffer",
                  • equals: "Windows-11"
                  }
                ]
              },
            • {1 item},
            • {1 item},
            • {1 item
              • allOf: [3 items
                • {2 items
                  • field: "Microsoft.Compute/imagePublisher",
                  • equals: "Canonical"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageOffer",
                  • contains: "ubuntu"
                  },
                • {1 item
                  • anyOf: [6 items
                    • {2 items
                      • field: "Microsoft.Compute/imageSKU",
                      • like: "14.04*LTS"
                      },
                    • {2 items
                      • field: "Microsoft.Compute/imageSKU",
                      • like: "16.04*LTS"
                      },
                    • {2 items
                      • field: "Microsoft.Compute/imageSKU",
                      • like: "18.04*LTS"
                      },
                    • {2 items
                      • field: "Microsoft.Compute/imageSKU",
                      • like: "*20_04-lts"
                      },
                    • {2 items
                      • field: "Microsoft.Compute/imageSKU",
                      • like: "20_04-lts*"
                      },
                    • {2 items
                      • field: "Microsoft.Compute/imageSKU",
                      • like: "22_04-lts-gen2"
                      }
                    ]
                  }
                ]
              },
            • {1 item},
            • {1 item},
            • {1 item
              • allOf: [3 items
                • {2 items
                  • field: "Microsoft.Compute/imagePublisher",
                  • equals: "cloudera"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageOffer",
                  • equals: "cloudera-centos-os"
                  },
                • {2 items
                  • field: "Microsoft.Compute/imageSKU",
                  • like: "7*"
                  }
                ]
              }
            ]
          }
        ]
      },
    • then: {2 items
      • effect: "[parameters('effect')]",
      • details: {3 items
        • type: "Microsoft.RecoveryServices/backupprotecteditems",
        • roleDefinitionIds: [2 items],
        • deployment: {1 item
          • properties: {3 items
            • mode: "incremental",
            • template: {6 items
              • $schema: "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
              • contentVersion: "1.0.0.0",
              • parameters: {3 items},
              • variables: {6 items
                • backupFabric: "Azure",
                • backupPolicy: "DefaultPolicy",
                • v2VmType: "Microsoft.Compute/virtualMachines",
                • v2VmContainer: "iaasvmcontainer;iaasvmcontainerv2;",
                • v2Vm: "vm;iaasvmcontainerv2;",
                • vaultName: 🔍"[
    take(
        concat(
           'RSVault-',
             parameters('location'),
           '-',
             guid(
                resourceGroup().id
            )
        ),
        50
    )
]"
                },
              • resources: [2 items
                • {6 items
                  • name: "[variables('vaultName')]",
                  • type: "Microsoft.RecoveryServices/vaults",
                  • apiVersion: "2016-06-01",
                  • location: "[parameters('location')]",
                  • properties: {},
                  • sku: {1 item
                    • name: "Standard"
                    }
                  },
                • {6 items
                  • name: 🔍"[
    concat(
        variables(
           'vaultName'
        ),
       '/',
         variables(
           'backupFabric'
        ),
       '/',
         variables(
           'v2VmContainer'
        ),
        concat(
            parameters('vmRgName'),
           ';',
            parameters('vmName')
        ),
       '/',
         variables(
           'v2Vm'
        ),
        concat(
            parameters('vmRgName'),
           ';',
            parameters('vmName')
        )
    )
]",
                  • apiVersion: "2016-12-01",
                  • location: "[parameters('location')]",
                  • type: "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
                  • dependsOn: [1 item
                    • 🔍"[
    resourceId(
       'Microsoft.RecoveryServices/vaults/',
         variables(
           'vaultName'
        )
    )
]"
                    ],
                  • properties: {3 items
                    • protectedItemType: "[variables('v2VmType')]",
                    • policyId: 🔍"[
    resourceId(
       'Microsoft.RecoveryServices/vaults/backupPolicies',
         variables(
           'vaultName'
        ),
        variables(
           'backupPolicy'
        )
    )
]",
                    • sourceResourceId: 🔍"[
    concat(
       '/subscriptions/',
         subscription().subscriptionId,
        '/resourceGroups/',
         parameters('vmRgName'),
       '/providers/Microsoft.Compute/virtualMachines/',
         parameters('vmName')
    )
]"
                    }
                  }
                ],
              • outputs: {1 item
                • status: {2 items
                  • type: "string",
                  • value: 🔍"[
    concat(
       'Backup enabled successfully for VM:',
        '',
         parameters('vmName'),
       'Backup Vault:',
         variables(
           'vaultName'
        )
    )
]"
                  }
                }
              },
            • parameters: {3 items}
            }
          }
        }
      }
    }
}