AzPolicyAdvertizer

last sync: 2025-Jul-07 17:23:16 UTC

Deploy SQL Database Vulnerability Assessments

Azure Landing Zones (ALZ) Policy definition

-Source
+                         Repository Azure Landing Zones (ALZ) GitHub 

                         JSON Deploy-Sql-vulnerabilityAssessments_20230706
-Display name
+                        Deploy SQL Database Vulnerability Assessments
-Id
+Deploy-Sql-vulnerabilityAssessments_20230706
-Version
+.0.0
  Details on versioning
-Category
+SQL
-Description
+Deploy SQL Database Vulnerability Assessments when it does not exist in the deployment, and save results to the storage account specified in the parameters.
-Cloud environments
+AzureChinaCloud
AzureCloud
AzureUSGovernment
-Mode
+Indexed
-Type
+Custom Azure Landing Zones (ALZ)
-Preview
+                False
-Deprecated
+                False
-Replaces Policy
+                            This ALZ Policy definition replaces [Deprecated]: Deploy SQL Database vulnerability Assessments (Deploy-Sql-vulnerabilityAssessments)
                            

                             More information on Azure Landing Zones deprecated Policy definitions
-Effect
+                    Default
DeployIfNotExists

                    Allowed
DeployIfNotExists, Disabled
-RBAC role(s)
+                                Role Name
                                Role Id
                            
                                
                                    SQL Security Manager
                                    056cd41c-7e88-42e1-933e-88ba6a50c9c3
                                
                                
                                    Monitoring Contributor
                                    749f88d5-cbae-40b8-bcfc-e573ddc772fa
                                
                                
                                    Storage Account Contributor
                                    17d1049b-9a84-46fb-8f53-869881c3d3ab
-Role Name
+Role Id
-SQL Security Manager
+cd41c-7e88-42e1-933e-88ba6a50c9c3
-Monitoring Contributor
+f88d5-cbae-40b8-bcfc-e573ddc772fa
-Storage Account Contributor
+d1049b-9a84-46fb-8f53-869881c3d3ab
-Rule aliases
+                THEN-ExistenceCondition (2)

                
                    
                        Alias
                        Namespace
                        ResourceType
                        Path
                        PathIsDefault
                        DefaultPath
                        Modifiable
                    
                            
                                Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.emails[*]
                                Microsoft.Sql
                                servers/databases/vulnerabilityAssessments
                                properties.recurringScans.emails[*]
                                True
                                
                                False
                            
                            
                                Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.isEnabled
                                Microsoft.Sql
                                servers/databases/vulnerabilityAssessments
                                properties.recurringScans.isEnabled
                                True
                                
                                False
-Alias
+Modifiable
-Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.emails[*]
+False
-Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.isEnabled
+False
-Rule resource types
+                IF (1)
                    Microsoft.Sql/servers/databases
                THEN-Deployment (1)
                    Microsoft.Sql/servers/databases/vulnerabilityAssessments
-Initiatives usage
+Rows: 1-1 / 1
Records: Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators: 
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more
TableFilter v0.7.3
https://www.tablefilter.com/
©2015-2025 Max GuglielmiClose
?
 Page  of 1
                            
                                

                                    Initiative DisplayName
                                    Initiative Id
                                    Initiative Category
                                    State
                                
                            
                            
                                Deploy SQL Database built-in SQL security configuration
                                Deploy-Sql-Security_20240529
                                SQL
                                GA
                            
                        
No results
-Initiative DisplayName
+State
-Deploy SQL Database built-in SQL security configuration
+GA
-History
+                                Date/Time (UTC ymd) (i)
                                Change type
                                Change detail
                            
                            
                                2023-07-07 17:55:09
                                add
                                Deploy-Sql-vulnerabilityAssessments_20230706 
 Replaces Policy: [Deprecated]: Deploy SQL Database vulnerability Assessments (Deploy-Sql-vulnerabilityAssessments)
-Date/Time (UTC ymd) (i)
+Change detail
--07-07 17:55:09
+Deploy-Sql-vulnerabilityAssessments_20230706 
 Replaces Policy: [Deprecated]: Deploy SQL Database vulnerability Assessments (Deploy-Sql-vulnerabilityAssessments)
-JSON compare
+{
@@ -1,27 +1,26 @@
 {
   "policyType": "Custom",
   "mode": "Indexed",
-  "displayName": "[Deprecated]: Deploy SQL Database vulnerability Assessments",
-  "description": "Deploy SQL Database vulnerability Assessments when it not exist in the deployment. Superseded by https://www.azadvertizer.net/azpolicyadvertizer/Deploy-Sql-vulnerabilityAssessments_20230706.html",
   "metadata": {
-    "version": "1.0.1-deprecated",
     "category": "SQL",
     "source": "https://github.com/Azure/Enterprise-Scale/",
-    "deprecated": true,
-    "supersededBy": "Deploy-Sql-vulnerabilityAssessments_20230706",
     "alzCloudEnvironments": [
       "AzureCloud",
       "AzureChinaCloud",
       "AzureUSGovernment"
     ]
   },
   "parameters": {
     "vulnerabilityAssessmentsEmail": {
-      "type": "String",
       "metadata": {
-        "description": "The email address to send alerts. For multiple emails, format in the following 'email1@contoso.com;email2@contoso.com'",
-        "displayName": "The email address to send alerts. For multiple emails, format in the following 'email1@contoso.com;email2@contoso.com'"
       }
     },
     "vulnerabilityAssessmentsStorageID": {
       "type": "String",
@@ -54,10 +53,16 @@
         "type": "Microsoft.Sql/servers/databases/vulnerabilityAssessments",
         "existenceCondition": {
           "allOf": [
             {
-              "field": "Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.emails",
-              "equals": "[parameters('vulnerabilityAssessmentsEmail')]"
             },
             {
               "field": "Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.isEnabled",
               "equals": true
@@ -80,9 +85,9 @@
                 "sqlServerDataBaseName": {
                   "type": "String"
                 },
                 "vulnerabilityAssessmentsEmail": {
-                  "type": "String"
                 },
                 "vulnerabilityAssessmentsStorageID": {
                   "type": "String"
                 }
@@ -98,11 +103,9 @@
                     "storageAccountAccessKey": "[listkeys(parameters('vulnerabilityAssessmentsStorageID'), providers('Microsoft.Storage', 'storageAccounts').apiVersions[0]).keys[0].value]",
                     "recurringScans": {
                       "isEnabled": true,
                       "emailSubscriptionAdmins": false,
-                      "emails": [
-                        "[parameters('vulnerabilityAssessmentsEmail')]"
-                      ]
                     }
                   }
                 }
               ],
 {
   "policyType": "Custom",
   "mode": "Indexed",
+  "displayName": "Deploy SQL Database Vulnerability Assessments",
+  "description": "Deploy SQL Database Vulnerability Assessments when it does not exist in the deployment, and save results to the storage account specified in the parameters.",
   "metadata": {
+    "version": "1.0.0",
     "category": "SQL",
     "source": "https://github.com/Azure/Enterprise-Scale/",
+    "replacesPolicy": "Deploy-Sql-vulnerabilityAssessments",
     "alzCloudEnvironments": [
       "AzureCloud",
       "AzureChinaCloud",
       "AzureUSGovernment"
     ]
   },
   "parameters": {
     "vulnerabilityAssessmentsEmail": {
+      "type": "Array",
       "metadata": {
+        "description": "The email address(es) to send alerts.",
+        "displayName": "The email address(es) to send alerts."
       }
     },
     "vulnerabilityAssessmentsStorageID": {
       "type": "String",
         "type": "Microsoft.Sql/servers/databases/vulnerabilityAssessments",
         "existenceCondition": {
           "allOf": [
             {
+              "count": {
+                "field": "Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.emails[*]",
+                "where": {
+                  "value": "current(Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.emails[*])",
+                  "notIn": "[parameters('vulnerabilityAssessmentsEmail')]"
+                }
+              },
+              "greater": 0
             },
             {
               "field": "Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.isEnabled",
               "equals": true
                 "sqlServerDataBaseName": {
                   "type": "String"
                 },
                 "vulnerabilityAssessmentsEmail": {
+                  "type": "Array"
                 },
                 "vulnerabilityAssessmentsStorageID": {
                   "type": "String"
                 }
                     "storageAccountAccessKey": "[listkeys(parameters('vulnerabilityAssessmentsStorageID'), providers('Microsoft.Storage', 'storageAccounts').apiVersions[0]).keys[0].value]",
                     "recurringScans": {
                       "isEnabled": true,
                       "emailSubscriptionAdmins": false,
+                      "emails": "[parameters('vulnerabilityAssessmentsEmail')]"
                     }
                   }
                 }
               ],
-JSON
+                                      EPAC
                                    
                                    


                                
                            
                            
                                
                                    {7 itemspolicyType: "Custom",
mode: "Indexed",
displayName: "Deploy SQL Database Vulnerability Assessments",
description: "Deploy SQL Database Vulnerability Assessments when it does not exist in the deployment, and save results to the storage account specified in the parameters.",
metadata: {5 itemsversion: "1.0.0",
category: "SQL",
source: "https://github.com/Azure/Enterprise-Scale/",
replacesPolicy: "Deploy-Sql-vulnerabilityAssessments",
alzCloudEnvironments: [3 items"AzureCloud",
"AzureChinaCloud",
"AzureUSGovernment"
]
},
parameters: {3 itemsvulnerabilityAssessmentsEmail: {2 itemstype: "Array",
metadata: {2 itemsdescription: "The email address(es) to send alerts.",
displayName: "The email address(es) to send alerts."
}
},
vulnerabilityAssessmentsStorageID: {2 itemstype: "String",
metadata: {3 itemsdescription: "The storage account ID to store assessments",
displayName: "The storage account ID to store assessments",
assignPermissions: true
}
},
effect: {4 itemstype: "String",
defaultValue: "DeployIfNotExists",
allowedValues: [2 items"DeployIfNotExists",
"Disabled"
],
metadata: {2 itemsdisplayName: "Effect",
description: "Enable or disable the execution of the policy"
}
}
},
policyRule: {2 itemsif: {2 itemsfield: "type",
equals: "Microsoft.Sql/servers/databases"
},
then: {2 itemseffect: "[parameters('effect')]",
details: {4 itemstype: "Microsoft.Sql/servers/databases/vulnerabilityAssessments",
existenceCondition: {1 itemallOf: [2 items{2 itemscount: {2 itemsfield: "Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.emails[*]",
where: {2 itemsvalue: "current(Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.emails[*])",
notIn: "[parameters('vulnerabilityAssessmentsEmail')]"
}
},
greater: 0
},
{2 itemsfield: "Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.isEnabled",
equals: true
}
]
},
deployment: {1 itemproperties: {3 itemsmode: "Incremental",
template: {6 items$schema: "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
contentVersion: "1.0.0.0",
parameters: {5 itemslocation: {1 itemtype: "String"
},
sqlServerName: {1 itemtype: "String"
},
sqlServerDataBaseName: {1 itemtype: "String"
},
vulnerabilityAssessmentsEmail: {1 itemtype: "Array"
},
vulnerabilityAssessmentsStorageID: {1 itemtype: "String"
}
},
variables: {},
resources: [1 item{4 itemsname: 🔍"[
    concat(
        parameters('sqlServerName'),
       '/',
        parameters('sqlServerDataBaseName'),
       '/default'
    )
]",
type: "Microsoft.Sql/servers/databases/vulnerabilityAssessments",
apiVersion: "2017-03-01-preview",
properties: {3 itemsstorageContainerPath: 🔍"[
    concat(
       'https://',
         last(
             split(
                parameters('vulnerabilityAssessmentsStorageID'),
                 '/'
            ) 
        ),
        '.blob.core.windows.net/vulneraabilitylogs'
    )
]",
storageAccountAccessKey: 🔍"[
    listkeys(
        parameters('vulnerabilityAssessmentsStorageID'),
        providers(
           'Microsoft.Storage',
            'storageAccounts'
        ).apiVersions[
            0
        ]
    ).keys[
        0
    ].value
]",
recurringScans: {3 itemsisEnabled: true,
emailSubscriptionAdmins: false,
emails: "[parameters('vulnerabilityAssessmentsEmail')]"
}
}
}
],
outputs: {}
},
parameters: {5 itemslocation: {1 itemvalue: "[field('location')]"
},
sqlServerName: {1 itemvalue: 🔍"[
    first(
        split(
            field('fullname'),
           '/'
        )
    )
]"
},
sqlServerDataBaseName: {1 itemvalue: "[field('name')]"
},
vulnerabilityAssessmentsEmail: {1 itemvalue: "[parameters('vulnerabilityAssessmentsEmail')]"
},
vulnerabilityAssessmentsStorageID: {1 itemvalue: "[parameters('vulnerabilityAssessmentsStorageID')]"
}
}
}
},
roleDefinitionIds: [3 items"/providers/Microsoft.Authorization/roleDefinitions/056cd41c-7e88-42e1-933e-88ba6a50c9c3" SQL Security Manager ,
"/providers/Microsoft.Authorization/roleDefinitions/749f88d5-cbae-40b8-bcfc-e573ddc772fa" Monitoring Contributor ,
"/providers/Microsoft.Authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab" Storage Account Contributor 
]
}
}
}
}
                                       EPAC
                                     {7 itemspolicyType: "Custom",
mode: "Indexed",
displayName: "Deploy SQL Database Vulnerability Assessments",
description: "Deploy SQL Database Vulnerability Assessments when it does not exist in the deployment, and save results to the storage account specified in the parameters.",
metadata: {5 itemsversion: "1.0.0",
category: "SQL",
source: "https://github.com/Azure/Enterprise-Scale/",
replacesPolicy: "Deploy-Sql-vulnerabilityAssessments",
alzCloudEnvironments: [3 items"AzureCloud",
"AzureChinaCloud",
"AzureUSGovernment"
]
},
parameters: {3 itemsvulnerabilityAssessmentsEmail: {2 itemstype: "Array",
metadata: {2 itemsdescription: "The email address(es) to send alerts.",
displayName: "The email address(es) to send alerts."
}
},
vulnerabilityAssessmentsStorageID: {2 itemstype: "String",
metadata: {3 itemsdescription: "The storage account ID to store assessments",
displayName: "The storage account ID to store assessments",
assignPermissions: true
}
},
effect: {4 itemstype: "String",
defaultValue: "DeployIfNotExists",
allowedValues: [2 items"DeployIfNotExists",
"Disabled"
],
metadata: {2 itemsdisplayName: "Effect",
description: "Enable or disable the execution of the policy"
}
}
},
policyRule: {2 itemsif: {2 itemsfield: "type",
equals: "Microsoft.Sql/servers/databases"
},
then: {2 itemseffect: "[parameters('effect')]",
details: {4 itemstype: "Microsoft.Sql/servers/databases/vulnerabilityAssessments",
existenceCondition: {1 itemallOf: [2 items{2 itemscount: {2 itemsfield: "Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.emails[*]",
where: {2 itemsvalue: "current(Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.emails[*])",
notIn: "[parameters('vulnerabilityAssessmentsEmail')]"
}
},
greater: 0
},
{2 itemsfield: "Microsoft.Sql/servers/databases/vulnerabilityAssessments/recurringScans.isEnabled",
equals: true
}
]
},
deployment: {1 itemproperties: {3 itemsmode: "Incremental",
template: {6 items$schema: "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
contentVersion: "1.0.0.0",
parameters: {5 itemslocation: {1 itemtype: "String"
},
sqlServerName: {1 itemtype: "String"
},
sqlServerDataBaseName: {1 itemtype: "String"
},
vulnerabilityAssessmentsEmail: {1 itemtype: "Array"
},
vulnerabilityAssessmentsStorageID: {1 itemtype: "String"
}
},
variables: {},
resources: [1 item{4 itemsname: 🔍"[
    concat(
        parameters('sqlServerName'),
       '/',
        parameters('sqlServerDataBaseName'),
       '/default'
    )
]",
type: "Microsoft.Sql/servers/databases/vulnerabilityAssessments",
apiVersion: "2017-03-01-preview",
properties: {3 itemsstorageContainerPath: 🔍"[
    concat(
       'https://',
         last(
             split(
                parameters('vulnerabilityAssessmentsStorageID'),
                 '/'
            ) 
        ),
        '.blob.core.windows.net/vulneraabilitylogs'
    )
]",
storageAccountAccessKey: 🔍"[
    listkeys(
        parameters('vulnerabilityAssessmentsStorageID'),
        providers(
           'Microsoft.Storage',
            'storageAccounts'
        ).apiVersions[
            0
        ]
    ).keys[
        0
    ].value
]",
recurringScans: {3 itemsisEnabled: true,
emailSubscriptionAdmins: false,
emails: "[parameters('vulnerabilityAssessmentsEmail')]"
}
}
}
],
outputs: {}
},
parameters: {5 itemslocation: {1 itemvalue: "[field('location')]"
},
sqlServerName: {1 itemvalue: 🔍"[
    first(
        split(
            field('fullname'),
           '/'
        )
    )
]"
},
sqlServerDataBaseName: {1 itemvalue: "[field('name')]"
},
vulnerabilityAssessmentsEmail: {1 itemvalue: "[parameters('vulnerabilityAssessmentsEmail')]"
},
vulnerabilityAssessmentsStorageID: {1 itemvalue: "[parameters('vulnerabilityAssessmentsStorageID')]"
}
}
}
},
roleDefinitionIds: [3 items"/providers/Microsoft.Authorization/roleDefinitions/056cd41c-7e88-42e1-933e-88ba6a50c9c3" SQL Security Manager ,
"/providers/Microsoft.Authorization/roleDefinitions/749f88d5-cbae-40b8-bcfc-e573ddc772fa" Monitoring Contributor ,
"/providers/Microsoft.Authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab" Storage Account Contributor 
]
}
}
}
}