AzPolicyAdvertizer

last sync: 2025-Jun-20 17:23:43 UTC

[Deprecated]: Configure Linux virtual machines to run Azure Monitor Agent with user-assigned managed identity-based authentication

Azure BuiltIn Policy definition

Source Azure Portal
Display name [Deprecated]: Configure Linux virtual machines to run Azure Monitor Agent with user-assigned managed identity-based authentication
Id ae8a10e6-19d6-44a3-a02d-a2bdfc707742
Version 3.10.0-deprecated
Details on versioning
Versioning Versions supported for Versioning: 7
3.10.0 (3.10.0-deprecated)
3.9.0
3.8.0
3.7.0
3.6.0
3.5.0
3.4.0
Built-in Versioning [Preview]
Category Monitoring
Microsoft Learn
Description This policy definition is deprecated because OMS Agent has been deprecation on August 31, 2024. While there is not a specific replacement policy, we have various policies available based on the VM setup that can be found under Azure Monitor Agent/DCRA Linux. Learn more about policy definition deprecation at aka.ms/policydefdeprecation.
Cloud environments AzureCloud = true
AzureUSGovernment = true
AzureChinaCloud = unknown
Available in AzUSGov The Policy is available in AzureUSGovernment cloud. Version: '3.*.*'
Mode Indexed
Type BuiltIn
Preview False
Deprecated True
Effect Default
Disabled
Allowed
DeployIfNotExists, Disabled
RBAC role(s)
Role Name Role Id
Virtual Machine Contributor 9980e02c-c2be-4d73-94e8-173b1dc7cf3c
Rule aliases IF (5)
Alias Namespace ResourceType Path PathIsDefault DefaultPath Modifiable
Microsoft.Compute/imageId Microsoft.Compute
Microsoft.Compute
Microsoft.Compute		 virtualMachines
virtualMachineScaleSets
disks		 properties.storageProfile.imageReference.id
properties.virtualMachineProfile.storageProfile.imageReference.id
properties.creationData.imageReference.id		 True
True
True

False
False
False
Microsoft.Compute/imageOffer Microsoft.Compute
Microsoft.Compute
Microsoft.Compute		 virtualMachines
virtualMachineScaleSets
disks		 properties.storageProfile.imageReference.offer
properties.virtualMachineProfile.storageProfile.imageReference.offer
properties.creationData.imageReference.id		 True
True
True

False
False
False
Microsoft.Compute/imagePublisher Microsoft.Compute
Microsoft.Compute
Microsoft.Compute		 virtualMachines
virtualMachineScaleSets
disks		 properties.storageProfile.imageReference.publisher
properties.virtualMachineProfile.storageProfile.imageReference.publisher
properties.creationData.imageReference.id		 True
True
True

False
False
False
Microsoft.Compute/imageSku Microsoft.Compute
Microsoft.Compute
Microsoft.Compute		 virtualMachines
virtualMachineScaleSets
disks		 properties.storageProfile.imageReference.sku
properties.virtualMachineProfile.storageProfile.imageReference.sku
properties.creationData.imageReference.id		 True
True
True

False
False
False
Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType Microsoft.Compute virtualMachines properties.storageProfile.osDisk.osType True True
THEN-ExistenceCondition (3)
Alias Namespace ResourceType Path PathIsDefault DefaultPath Modifiable
Microsoft.Compute/virtualMachines/extensions/provisioningState Microsoft.Compute virtualMachines/extensions properties.provisioningState True False
Microsoft.Compute/virtualMachines/extensions/publisher Microsoft.Compute virtualMachines/extensions properties.publisher True False
Microsoft.Compute/virtualMachines/extensions/type Microsoft.Compute virtualMachines/extensions properties.type True False
Rule resource types IF (1)
THEN-Deployment (1)
Compliance Not a Compliance control
Initiatives usage
Rows: 1-5 / 5
Records:
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi
?
Page of 1
Initiative DisplayName Initiative Id Initiative Category State Type polSet in AzUSGov
[Deprecated]: Configure machines to create the default Microsoft Defender for Cloud pipeline using Azure Monitor Agent 362ab02d-c362-417e-a525-45805d58e21d Security Center Deprecated BuiltIn unknown
[Deprecated]: Configure machines to create the user-defined Microsoft Defender for Cloud pipeline using Azure Monitor Agent 500ab3a2-f1bd-4a5a-8e47-3e09d9a294c3 Security Center Deprecated BuiltIn unknown
[Deprecated]: Enable Azure Monitor for VMs with Azure Monitoring Agent(AMA) 9dffaf29-5905-4145-883c-957eb442c226 Monitoring Deprecated BuiltIn unknown
Deploy Linux Azure Monitor Agent with user-assigned managed identity-based auth and associate with Data Collection Rule babf8e94-780b-4b4d-abaa-4830136a8725 Monitoring GA BuiltIn true
Enable Azure Monitor for VMs with Azure Monitoring Agent(AMA) 924bfe3a-762f-40e7-86dd-5c8b95eb09e6 Monitoring GA BuiltIn true
History
Date/Time (UTC ymd) (i) Change type Change detail
2025-06-03 17:23:32 change Minor, new suffix: deprecated (3.9.0 > 3.10.0-deprecated)
2025-04-22 16:46:02 change Minor (3.8.0 > 3.9.0)
2024-07-30 18:18:24 change Minor (3.7.0 > 3.8.0)
2024-05-13 17:44:58 change Minor (3.6.0 > 3.7.0)
2024-04-12 17:45:57 change Minor (3.5.0 > 3.6.0)
2024-02-13 19:27:15 change Minor (3.4.0 > 3.5.0)
2023-08-28 18:00:34 change Minor (3.3.0 > 3.4.0)
2023-08-03 17:56:09 change Minor (3.2.0 > 3.3.0)
2023-07-14 17:56:09 change Minor (3.1.0 > 3.2.0)
2023-04-06 17:42:16 change Minor (3.0.0 > 3.1.0)
2022-09-13 16:35:29 change Major (2.1.0 > 3.0.0)
2022-08-12 16:33:43 change Minor (2.0.0 > 2.1.0)
2022-05-06 16:29:23 change Major (1.0.0 > 2.0.0)
2022-04-01 20:29:14 add ae8a10e6-19d6-44a3-a02d-a2bdfc707742
JSON compare
compare mode: version left: version right:
3.9.0 → 3.10.0-deprecated RENAMED
@@ -1,12 +1,13 @@
1
  {
2
- "displayName": "Configure Linux virtual machines to run Azure Monitor Agent with user-assigned managed identity-based authentication",
3
  "policyType": "BuiltIn",
4
  "mode": "Indexed",
5
- "description": "Automate the deployment of Azure Monitor Agent extension on your Linux virtual machines for collecting telemetry data from the guest OS. This policy will install the extension and configure it to use the specified user-assigned managed identity if the OS and region are supported, and skip install otherwise. Learn more: https://aka.ms/AMAOverview.",
6
  "metadata": {
7
- "version": "3.9.0",
8
- "category": "Monitoring"
 
9
  },
10
  "parameters": {
11
  "effect": {
12
  "type": "String",
@@ -17,9 +18,9 @@
17
  "allowedValues": [
18
  "DeployIfNotExists",
19
  "Disabled"
20
  ],
21
- "defaultValue": "DeployIfNotExists"
22
  },
23
  "bringYourOwnUserAssignedManagedIdentity": {
24
  "type": "Boolean",
25
  "metadata": {
 
1
  {
2
+ "displayName": "[Deprecated]: Configure Linux virtual machines to run Azure Monitor Agent with user-assigned managed identity-based authentication",
3
  "policyType": "BuiltIn",
4
  "mode": "Indexed",
5
+ "description": "This policy definition is deprecated because OMS Agent has been deprecation on August 31, 2024. While there is not a specific replacement policy, we have various policies available based on the VM setup that can be found under Azure Monitor Agent/DCRA Linux. Learn more about policy definition deprecation at aka.ms/policydefdeprecation.",
6
  "metadata": {
7
+ "version": "3.10.0-deprecated",
8
+ "category": "Monitoring",
9
+ "deprecated": true
10
  },
11
  "parameters": {
12
  "effect": {
13
  "type": "String",
 
18
  "allowedValues": [
19
  "DeployIfNotExists",
20
  "Disabled"
21
  ],
22
+ "defaultValue": "Disabled"
23
  },
24
  "bringYourOwnUserAssignedManagedIdentity": {
25
  "type": "Boolean",
26
  "metadata": {
JSON
api-version=2021-06-01
EPAC 
{7 items
  • displayName: "[Deprecated]: Configure Linux virtual machines to run Azure Monitor Agent with user-assigned managed identity-based authentication",
  • policyType: "BuiltIn",
  • mode: "Indexed",
  • description: "This policy definition is deprecated because OMS Agent has been deprecation on August 31, 2024. While there is not a specific replacement policy, we have various policies available based on the VM setup that can be found under Azure Monitor Agent/DCRA Linux. Learn more about policy definition deprecation at aka.ms/policydefdeprecation.",
  • metadata: {3 items
    • version: "3.10.0-deprecated",
    • category: "Monitoring",
    • deprecated: true
    },
  • parameters: {8 items
    • effect: {4 items},
    • bringYourOwnUserAssignedManagedIdentity: {3 items
      • type: "Boolean",
      • metadata: {2 items
        • displayName: "Bring Your Own User-Assigned Managed Identity",
        • description: "If set to true, Azure Monitor Agent will use the user-assigned managed identity specified via the 'User-Assigned Managed Identity ...' parameters for authentication. Otherwise, Azure Monitor Agent will use the user-assigned managed identity /subscriptions/<subscription-id>/resourceGroups/built-in-identity-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/built-in-identity-<location> for authentication."
        },
      • allowedValues: [2 items
        • false,
        • true
        ]
      },
    • restrictBringYourOwnUserAssignedIdentityToSubscription: {4 items
      • type: "Boolean",
      • metadata: {2 items
        • displayName: "Restrict Bring Your Own User-Assigned Identity to Subscription",
        • description: "Enable this to enforce the user assigned identity must exist in the same subscription as the virtual machine. When true, must provide User-Assigned Managed Identity Name and User-Assigned Managed Identity Resource Group Name parameters. When false, the parameter User Assigned Managed Identity Resource Id will be used instead."
        },
      • allowedValues: [2 items
        • true,
        • false
        ],
      • defaultValue: true
      },
    • userAssignedIdentityResourceId: {3 items
      • type: "String",
      • metadata: {2 items
        • displayName: "User-Assigned Managed Identity Resource ID",
        • description: "The resource ID of the pre-created user-assigned managed identity. This parameter is only used when the restrict Bring Your Own User-Assigned Identity To Subscription parameter is false."
        },
      • defaultValue: ""
      },
    • userAssignedManagedIdentityName: {3 items
      • type: "String",
      • metadata: {2 items
        • displayName: "User-Assigned Managed Identity Name",
        • description: "The name of the user-assigned managed identity which Azure Monitor Agent will use for authentication when 'Bring Your Own User-Assigned Managed Identity' is set to true."
        },
      • defaultValue: ""
      },
    • userAssignedManagedIdentityResourceGroup: {3 items
      • type: "String",
      • metadata: {2 items
        • displayName: "User-Assigned Managed Identity Resource Group",
        • description: "The resource group of the user-assigned managed identity which Azure Monitor Agent will use for authentication when 'Bring Your Own User-Assigned Managed Identity' is set to true."
        },
      • defaultValue: ""
      },
    • scopeToSupportedImages: {4 items
      • type: "Boolean",
      • metadata: {2 items
        • displayName: "Scope Policy to Azure Monitor Agent-Supported Operating Systems",
        • description: "If set to true, the policy will apply only to virtual machines with supported operating systems. Otherwise, the policy will apply to all virtual machine resources in the assignment scope. For supported operating systems, see https://aka.ms/AMAOverview."
        },
      • allowedValues: [2 items
        • true,
        • false
        ],
      • defaultValue: true
      },
    • listOfLinuxImageIdToInclude: {3 items
      • type: "Array",
      • metadata: {2 items
        • displayName: "Additional Virtual Machine Images",
        • description: "List of virtual machine images that have supported Linux OS to add to scope. Example values: '/subscriptions/<subscriptionId>/resourceGroups/YourResourceGroup/providers/Microsoft.Compute/images/ContosoStdImage'"
        },
      • defaultValue: []
      }
    },
  • policyRule: {2 items
    • if: {1 item
      • allOf: [3 items
        • {2 items
          • field: "type",
          • equals: "Microsoft.Compute/virtualMachines"
          },
        • {2 items
          • field: "location",
          • in: [68 items
            • "australiacentral",
            • "australiacentral2",
            • "australiaeast",
            • "australiasoutheast",
            • "brazilsouth",
            • "brazilsoutheast",
            • "canadacentral",
            • "canadaeast",
            • "centralindia",
            • "centralus",
            • "centraluseuap",
            • "eastasia",
            • "eastus",
            • "eastus2",
            • "eastus2euap",
            • "francecentral",
            • "francesouth",
            • "germanynorth",
            • "germanywestcentral",
            • "israelcentral",
            • "italynorth",
            • "japaneast",
            • "japanwest",
            • "jioindiacentral",
            • "jioindiawest",
            • "koreacentral",
            • "koreasouth",
            • "malaysiasouth",
            • "mexicocentral",
            • "northcentralus",
            • "northeurope",
            • "norwayeast",
            • "norwaywest",
            • "polandcentral",
            • "qatarcentral",
            • "southafricanorth",
            • "southafricawest",
            • "southcentralus",
            • "southeastasia",
            • "southindia",
            • "spaincentral",
            • "swedencentral",
            • "swedensouth",
            • "switzerlandnorth",
            • "switzerlandwest",
            • "taiwannorth",
            • "taiwannorthwest",
            • "uaecentral",
            • "uaenorth",
            • "uksouth",
            • "ukwest",
            • "westcentralus",
            • "westeurope",
            • "westindia",
            • "westus",
            • "westus2",
            • "westus3",
            • "chinaeast",
            • "chinaeast2",
            • "chinaeast3",
            • "chinanorth",
            • "chinanorth2",
            • "chinanorth3",
            • "usgovarizona",
            • "usgovtexas",
            • "usgovvirginia",
            • "usdodeast",
            • "usdodcentral"
            ]
          },
        • {1 item}
        ]
      },
    • then: {2 items
      • effect: "[parameters('effect')]",
      • details: {4 items
        • type: "Microsoft.Compute/virtualMachines/extensions",
        • roleDefinitionIds: [1 item],
        • existenceCondition: {1 item
          • allOf: [3 items
            • {2 items
              • field: "Microsoft.Compute/virtualMachines/extensions/type",
              • equals: "AzureMonitorLinuxAgent"
              },
            • {2 items
              • field: "Microsoft.Compute/virtualMachines/extensions/publisher",
              • equals: "Microsoft.Azure.Monitor"
              },
            • {2 items
              • field: "Microsoft.Compute/virtualMachines/extensions/provisioningState",
              • equals: "Succeeded"
              }
            ]
          },
        • deployment: {1 item
          • properties: {3 items
            • mode: "incremental",
            • template: {5 items},
            • parameters: {3 items
              • vmName: {1 item
                • value: "[field('name')]"
                },
              • location: {1 item
                • value: "[field('location')]"
                },
              • userAssignedManagedIdentity: {1 item
                • value: 🔍"[
    if(
        parameters('bringYourOwnUserAssignedManagedIdentity'),
        if(
            parameters('restrictBringYourOwnUserAssignedIdentityToSubscription'),
            concat(
               '/subscriptions/',
                 subscription().subscriptionId,
                '/resourceGroups/',
                 parameters('userAssignedManagedIdentityResourceGroup'),
               '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/',
                 parameters('userAssignedManagedIdentityName')
            ),
            parameters('userAssignedIdentityResourceId')
        ),
        concat(
           '/subscriptions/',
             subscription().subscriptionId,
            '/resourceGroups/built-in-identity-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/built-in-identity-',
             field('location')
        )
    )
]"
                }
              }
            }
          }
        }
      }
    }
}