Enable logging by category group for Virtual network gateways (microsoft.network/virtualnetworkgateways) to Storage

Azure BuiltIn Policy definition

Alias

Namespace

ResourceType

Path

PathIsDefault

DefaultPath

Modifiable

Microsoft.Insights/diagnosticSettings/logs[*]

microsoft.insights

diagnosticSettings

properties.logs[*]

True

False

microsoft.insights/diagnosticSettings/logs[*].categoryGroup

microsoft.insights

diagnosticSettings

properties.logs[*].categoryGroup

True

False

Microsoft.Insights/diagnosticSettings/logs[*].enabled

microsoft.insights

diagnosticSettings

properties.logs[*].enabled

True

False

Microsoft.Insights/diagnosticSettings/storageAccountId

microsoft.insights

diagnosticSettings

properties.storageAccountId

True

False

Rows: 1-2 / 2

Records:

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Page of 1

Initiative DisplayName

Initiative Id

Initiative Category

State

Type

polSet in AzUSGov

Enable allLogs category group resource logging for supported resources to storage

b6b86da9-e527-49de-ac59-6af0a9db10b8

Monitoring

BuiltIn

unknown

Enable audit category group resource logging for supported resources to storage

8d723fb6-6680-45be-9d37-b1a4adb52207

Monitoring

BuiltIn

unknown

Date/Time (UTC ymd) (i)

Change type

Change detail

2024-04-29 17:47:10

change

Minor (1.0.0 > 1.1.0)

2023-02-10 18:41:56

add

b4a9c220-1d62-4163-a17b-30db7d5b7278

{

displayName: "Enable logging by category group for Virtual network gateways (microsoft.network/virtualnetworkgateways) to Storage",
policyType: "BuiltIn",
mode: "Indexed",
description: "Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to a Storage Account for Virtual network gateways (microsoft.network/virtualnetworkgateways).",
metadata: {2 items
- category: "Monitoring",
- version: "1.1.0"
},
parameters: {5 items
- effect: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect",
    - description: "Enable or disable the execution of the policy"
    },
  - allowedValues: [3 items
    - "DeployIfNotExists",
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "DeployIfNotExists"
  },
- diagnosticSettingName: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Diagnostic Setting Name",
    - description: "Diagnostic Setting Name"
    },
  - defaultValue: "setByPolicy-Storage"
  },
- categoryGroup: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Category Group",
    - description: "Diagnostic category group - none, audit, or allLogs."
    },
  - allowedValues: [2 items
    - "audit",
    - "allLogs"
    ],
  - defaultValue: "audit"
  },
- resourceLocation: {2 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Resource Location",
    - description: "Resource Location must be in the same location as the Storage Account.",
    - strongType: "location"
    }
  },
- storageAccount: {2 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Storage Account",
    - description: "Full path (resourceId) to the storage account.",
    - assignPermissions: true
    }
  }
},
policyRule: {2 items
- if: {1 item
  - allOf: [2 items
    - {2 items
      - field: "type",
      - equals: "microsoft.network/virtualnetworkgateways"
      },
    - {2 items
      - field: "location",
      - equals: "[parameters('resourceLocation')]"
      }
    ]
  },
- then: {2 items
  - effect: "[parameters('effect')]",
  - details: {5 items
    - type: "Microsoft.Insights/diagnosticSettings",
    - evaluationDelay: "AfterProvisioning",
    - existenceCondition: {1 item
      - allOf: [3 items
        {2 items
        count: {2 items
        field: "Microsoft.Insights/diagnosticSettings/logs[*]",
        where: {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
        equals: 🔍"[ equals( parameters('categoryGroup'), 'audit' ) ]"
        },
        {2 items
        field: "microsoft.insights/diagnosticSettings/logs[*].categoryGroup",
        equals: "audit"
        }
        ]
        }
        },
        equals: 1
        },
        {2 items
        count: {2 items
        field: "Microsoft.Insights/diagnosticSettings/logs[*]",
        where: {1 item
        allOf: [2 items
        {2 items
        field: "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
        equals: 🔍"[ equals( parameters('categoryGroup'), 'allLogs' ) ]"
        },
        {2 items
        field: "microsoft.insights/diagnosticSettings/logs[*].categoryGroup",
        equals: "allLogs"
        }
        ]
        }
        },
        equals: 1
        },
        {2 items
        field: "Microsoft.Insights/diagnosticSettings/storageAccountId",
        equals: "[parameters('storageAccount')]"
        }
        ]
      },
    - roleDefinitionIds: [1 item
      - "/providers/Microsoft.Authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293" Log Analytics Contributor
      ],
    - deployment: {1 item
      - properties: {3 items
        mode: "incremental",
        template: {6 items
        $schema: "http://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
        contentVersion: "1.0.0.0",
        parameters: {5 items
        diagnosticSettingName: {1 item
        type: "string"
        },
        categoryGroup: {1 item
        type: "String"
        },
        storageAccount: {1 item
        type: "string"
        },
        resourceLocation: {1 item
        type: "string"
        },
        resourceName: {1 item
        type: "string"
        }
        },
        variables: {},
        resources: [1 item
        {5 items
        type: "microsoft.network/virtualnetworkgateways/providers/diagnosticSettings",
        apiVersion: "2021-05-01-preview",
        name: 🔍"[ concat( parameters('resourceName'), '/', 'Microsoft.Insights/', parameters('diagnosticSettingName') ) ]",
        location: "[parameters('resourceLocation')]",
        properties: {3 items
        storageAccountId: "[parameters('storageAccount')]",
        logs: [2 items
        {2 items
        categoryGroup: "audit",
        enabled: 🔍"[ equals( parameters('categoryGroup'), 'audit' ) ]"
        },
        {2 items
        categoryGroup: "allLogs",
        enabled: 🔍"[ equals( parameters('categoryGroup'), 'allLogs' ) ]"
        }
        ],
        metrics: []
        }
        }
        ],
        outputs: {1 item
        policy: {2 items
        type: "string",
        value: 🔍"[ concat( 'Diagnostic setting', parameters('diagnosticSettingName'), 'for type Virtual network gateways ( microsoft.network/virtualnetworkgateways ), resourceName', parameters('resourceName'), 'to Storage Account', parameters('storageAccount'), 'configured' ) ]"
        }
        }
        },
        parameters: {5 items
        diagnosticSettingName: {1 item
        value: "[parameters('diagnosticSettingName')]"
        },
        categoryGroup: {1 item
        value: "[parameters('categoryGroup')]"
        },
        storageAccount: {1 item
        value: "[parameters('storageAccount')]"
        },
        resourceLocation: {1 item
        value: "[field('location')]"
        },
        resourceName: {1 item
        value: "[field('name')]"
        }
        }
        }
      }
    }
  }
}

}