AzInitiativeAdvertizer

last sync: 2025-Jun-26 17:23:22 UTC

Configure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace

Azure BuiltIn Policy Initiative (PolicySet)

Source Azure Portal
Display nameConfigure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace
Idde01d381-bae9-4670-8870-786f89f49e26
Version1.2.0
Details on versioning
Versioning Versions supported for Versioning: 3
1.2.0
1.1.1
1.1.0-preview
Built-in Versioning [Preview]
CategorySecurity Center
Microsoft Learn
DescriptionMicrosoft Defender for SQL collects events from the agents and uses them to provide security alerts and tailored hardening tasks (recommendations). Creates a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace.
Cloud environmentsAzureCloud = true
AzureChinaCloud = unknown
AzureUSGovernment = true
Available in AzUSGovThe PolicySet is available in AzureUSGovernment cloud. Version: '1.2.0'
Repository: Azure-Policy de01d381-bae9-4670-8870-786f89f49e26
TypeBuiltIn
DeprecatedFalse
PreviewFalse
Policy-used summary
Policy types Policy states Policy categories
Total Policies: 8
Builtin Policies: 8
Static Policies: 0
GA: 8
1 categories:
Security Center: 8
Policy-used
Rows: 1-8 / 8
Records:
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi
?
Page of 1
Policy DisplayName Policy Id Category Version Versioning Effect Roles# Roles State policy in AzUSGov
Configure Arc-enabled SQL Servers to automatically install Azure Monitor Agent 3592ff98-9787-443a-af59-4505d0fe0786 Security Center 1.3.0 3x
1.3.0, 1.2.2, 1.2.1-preview		 Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled		 1 Azure Connected Machine Resource Administrator GA true
Configure Arc-enabled SQL Servers to automatically install Microsoft Defender for SQL 65503269-6a54-4553-8a28-0065a8e6d929 Security Center 1.2.0 3x
1.2.0, 1.1.2, 1.1.1-preview		 Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled		 1 Log Analytics Contributor GA true
Configure Arc-enabled SQL Servers to automatically install Microsoft Defender for SQL and DCR with a user-defined LA workspace 63d03cbd-47fd-4ee1-8a1c-9ddf07303de0 Security Center 1.8.0 7x
1.8.0, 1.7.0, 1.6.0, 1.5.0, 1.4.0, 1.3.1, 1.3.0-preview		 Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled		 1 Contributor GA true
Configure Arc-enabled SQL Servers with Data Collection Rule Association to Microsoft Defender for SQL user-defined DCR 2227e1f1-23dd-4c3a-85a9-7024a401d8b2 Security Center 1.3.0 4x
1.3.0, 1.2.0, 1.1.1, 1.1.0-preview		 Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled		 2 Log Analytics Contributor, Monitoring Contributor GA true
Configure SQL Virtual Machines to automatically install Azure Monitor Agent f91991d1-5383-4c95-8ee5-5ac423dd8bb1 Security Center 1.6.0 6x
1.6.0, 1.5.0, 1.4.0, 1.3.0, 1.2.2, 1.2.1-preview		 Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled		 1 Virtual Machine Contributor GA true
Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL ddca0ddc-4e9d-4bbb-92a1-f7c4dd7ef7ce Security Center 1.6.0 6x
1.6.0, 1.5.0, 1.4.0, 1.3.0, 1.2.1, 1.2.0-preview		 Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled		 2 Log Analytics Contributor, Monitoring Contributor GA true
Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL and DCR with a user-defined LA workspace 04754ef9-9ae3-4477-bf17-86ef50026304 Security Center 1.10.0 9x
1.10.0, 1.9.0, 1.8.0, 1.7.0, 1.6.0, 1.5.0, 1.4.0, 1.3.1, 1.3.0-preview		 Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled		 1 Contributor GA true
Create and assign a built-in user-assigned managed identity 09963c90-6ee7-4215-8d26-1cc660a1682f Security Center 1.8.0 7x
1.8.0, 1.7.0, 1.6.0, 1.5.0, 1.4.0, 1.3.1, 1.3.0-preview		 Default
DeployIfNotExists
Allowed
AuditIfNotExists, DeployIfNotExists, Disabled		 1 Contributor GA true
Roles used Total Roles usage: 10
Total Roles unique usage: 5
Role Role Id #Policies Policies
Monitoring Contributor 749f88d5-cbae-40b8-bcfc-e573ddc772fa 2 Configure Arc-enabled SQL Servers with Data Collection Rule Association to Microsoft Defender for SQL user-defined DCR, Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL
Contributor b24988ac-6180-42a0-ab88-20f7382dd24c 3 Configure Arc-enabled SQL Servers to automatically install Microsoft Defender for SQL and DCR with a user-defined LA workspace, Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL and DCR with a user-defined LA workspace, Create and assign a built-in user-assigned managed identity
Log Analytics Contributor 92aaf0da-9dab-42b6-94a3-d43ce8d16293 3 Configure Arc-enabled SQL Servers to automatically install Microsoft Defender for SQL, Configure Arc-enabled SQL Servers with Data Collection Rule Association to Microsoft Defender for SQL user-defined DCR, Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL
Virtual Machine Contributor 9980e02c-c2be-4d73-94e8-173b1dc7cf3c 1 Configure SQL Virtual Machines to automatically install Azure Monitor Agent
Azure Connected Machine Resource Administrator cd570a14-e51a-42ad-bac8-bafd67325302 1 Configure Arc-enabled SQL Servers to automatically install Azure Monitor Agent
History
Date/Time (UTC ymd) (i) Changes
2024-05-15 17:48:20 Version change: '1.1.1' to '1.2.0'
2023-11-22 19:18:10 Version change: '1.1.0-preview' to '1.1.1'
Name change: '[Preview]: Configure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace' to 'Configure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace'
2023-09-18 18:02:04 Name change: '[Preview]: Configure machines to create the user-defined Microsoft Defender for SQL pipeline using Azure Monitor Agent' to '[Preview]: Configure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace'
Description change: 'Configure machines to automatically install the Azure Monitor and Azure Security agents. Microsoft Defender for SQL collects events from the agents and uses them to provide security alerts and tailored hardening tasks (recommendations). Use the user-provided Log Analytics workspace to store audit records. Creates a resource group and a Data Collection Rule in the same region as the user-provided Log Analytics workspace.' to 'Microsoft Defender for SQL collects events from the agents and uses them to provide security alerts and tailored hardening tasks (recommendations). Creates a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace.'
2023-09-14 17:58:18 Version change: '1.0.0-preview' to '1.1.0-preview'
2023-08-25 17:58:14 add Initiative de01d381-bae9-4670-8870-786f89f49e26
JSON compare
compare mode: version left: version right:
1.1.1 → 1.2.0 RENAMED
@@ -2,10 +2,11 @@
2
  "displayName": "Configure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace",
3
  "description": "Microsoft Defender for SQL collects events from the agents and uses them to provide security alerts and tailored hardening tasks (recommendations). Creates a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace.",
4
  "metadata": {
5
  "category": "Security Center",
6
- "version": "1.1.1"
7
  },
 
8
  "parameters": {
9
  "userWorkspaceResourceId": {
10
  "type": "String",
11
  "metadata": {
@@ -49,39 +50,103 @@
49
  "displayName": "User-Assigned Managed Identity Resource Group Location",
50
  "description": "The location of the resource group 'Built-In-Identity-RG' created by the policy."
51
  },
52
  "defaultValue": "eastus"
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
53
  }
54
  },
55
  "policyDefinitions": [
56
  {
57
  "policyDefinitionReferenceId": "MDC_DfSQL_AddUserAssignedIdentity_VM",
58
  "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/09963c90-6ee7-4215-8d26-1cc660a1682f",
 
59
  "parameters": {
60
  "builtInIdentityResourceGroupLocation": {
61
  "value": "[parameters('builtInIdentityResourceGroupLocation')]"
 
 
 
 
 
 
62
  }
63
  }
64
  },
65
  {
66
  "policyDefinitionReferenceId": "MDC_DfSQL_DeployWindowsAMA_VM",
67
- "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f91991d1-5383-4c95-8ee5-5ac423dd8bb1"
 
 
 
 
 
 
 
 
 
68
  },
69
  {
70
  "policyDefinitionReferenceId": "MDC_DfSQL_DeployMicrosoftDefenderForSQLWindowsAgent_VM",
71
  "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ddca0ddc-4e9d-4bbb-92a1-f7c4dd7ef7ce",
 
72
  "parameters": {
73
  "workspaceRegion": {
74
  "value": "[parameters('workspaceRegion')]"
75
  },
76
  "userWorkspaceId": {
77
  "value": "[parameters('userWorkspaceId')]"
 
 
 
 
 
 
78
  }
79
  }
80
  },
81
  {
82
  "policyDefinitionReferenceId": "MDC_DfSQL_AMA_UserWorkspacePipeline_VM",
83
  "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/04754ef9-9ae3-4477-bf17-86ef50026304",
 
84
  "parameters": {
85
  "userWorkspaceResourceId": {
86
  "value": "[parameters('userWorkspaceResourceId')]"
87
  },
@@ -92,22 +157,28 @@
92
  "value": "[parameters('userWorkspaceId')]"
93
  },
94
  "enableCollectionOfSqlQueriesForSecurityResearch": {
95
  "value": "[parameters('enableCollectionOfSqlQueriesForSecurityResearch')]"
 
 
 
96
  }
97
  }
98
  },
99
  {
100
  "policyDefinitionReferenceId": "MDC_DfSQL_DeployWindowsAMA_Arc",
101
- "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3592ff98-9787-443a-af59-4505d0fe0786"
 
102
  },
103
  {
104
  "policyDefinitionReferenceId": "MDC_DfSQL_DeployMicrosoftDefenderForSQLWindowsAgent_Arc",
105
- "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/65503269-6a54-4553-8a28-0065a8e6d929"
 
106
  },
107
  {
108
  "policyDefinitionReferenceId": "MDC_DfSQL_AMA_UserWorkspacePipeline_Arc",
109
  "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/63d03cbd-47fd-4ee1-8a1c-9ddf07303de0",
 
110
  "parameters": {
111
  "userWorkspaceResourceId": {
112
  "value": "[parameters('userWorkspaceResourceId')]"
113
  },
@@ -118,21 +189,36 @@
118
  "value": "[parameters('userWorkspaceId')]"
119
  },
120
  "enableCollectionOfSqlQueriesForSecurityResearch": {
121
  "value": "[parameters('enableCollectionOfSqlQueriesForSecurityResearch')]"
 
 
 
122
  }
123
  }
124
  },
125
  {
126
  "policyDefinitionReferenceId": "MDC_DfSQL_AMA_UserWorkspacePipeline_DCRA_Arc",
127
  "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2227e1f1-23dd-4c3a-85a9-7024a401d8b2",
 
128
  "parameters": {
129
  "workspaceRegion": {
130
  "value": "[parameters('workspaceRegion')]"
131
  },
132
  "userWorkspaceId": {
133
  "value": "[parameters('userWorkspaceId')]"
 
 
 
 
 
 
134
  }
135
  }
136
  }
 
 
 
 
 
137
  ]
138
  }
 
2
  "displayName": "Configure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace",
3
  "description": "Microsoft Defender for SQL collects events from the agents and uses them to provide security alerts and tailored hardening tasks (recommendations). Creates a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace.",
4
  "metadata": {
5
  "category": "Security Center",
6
+ "version": "1.2.0"
7
  },
8
+ "version": "1.2.0",
9
  "parameters": {
10
  "userWorkspaceResourceId": {
11
  "type": "String",
12
  "metadata": {
 
50
  "displayName": "User-Assigned Managed Identity Resource Group Location",
51
  "description": "The location of the resource group 'Built-In-Identity-RG' created by the policy."
52
  },
53
  "defaultValue": "eastus"
54
+ },
55
+ "bringYourOwnUserAssignedManagedIdentity": {
56
+ "type": "Boolean",
57
+ "metadata": {
58
+ "displayName": "Bring your own User-Assigned Managed Identity",
59
+ "description": "Enable this to use your own user-assigned managed identity. The pre-created identity MUST exist otherwise the policy deployment will fail. If enabled, ensure that the user-assigned managed identity resource ID parameter matches the pre-created user-assigned managed identity resource ID. If not enabled, the policy will create a new user-assigned managed identitiy per subscription, in a new resource group named 'Built-In-Identity-RG'."
60
+ },
61
+ "allowedValues": [
62
+ true,
63
+ false
64
+ ],
65
+ "defaultValue": false
66
+ },
67
+ "userAssignedIdentityResourceId": {
68
+ "type": "String",
69
+ "metadata": {
70
+ "displayName": "User-Assigned Managed Identity Resource ID",
71
+ "description": "The resource ID of the pre-created user-assigned managed identity. This parameter is only used when bringYourOwnUserAssignedManagedIdentity is set to true."
72
+ },
73
+ "defaultValue": ""
74
+ },
75
+ "bringYourOwnDcr": {
76
+ "type": "Boolean",
77
+ "metadata": {
78
+ "displayName": "Bring your own DCR",
79
+ "description": "Enable this to use your own Data Collection Rule. The pre-created Data Collection Rule MUST exist otherwise the policy deployment will fail. If enabled, ensure that the Data Collection Rule Resource ID parameter matches the pre-created Data Collection Rule Resource ID. If not enabled, the policy will create a new Data Collection Rule per subscription."
80
+ },
81
+ "allowedValues": [
82
+ true,
83
+ false
84
+ ],
85
+ "defaultValue": false
86
+ },
87
+ "dcrResourceId": {
88
+ "type": "String",
89
+ "metadata": {
90
+ "displayName": "Data Collection Rule Resource ID",
91
+ "description": "The resource ID of the user-defined Data Collection Rule. This parameter is only used when bringYourOwnDcr is set to true."
92
+ },
93
+ "defaultValue": ""
94
  }
95
  },
96
  "policyDefinitions": [
97
  {
98
  "policyDefinitionReferenceId": "MDC_DfSQL_AddUserAssignedIdentity_VM",
99
  "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/09963c90-6ee7-4215-8d26-1cc660a1682f",
100
+ "definitionVersion": "1.*.*",
101
  "parameters": {
102
  "builtInIdentityResourceGroupLocation": {
103
  "value": "[parameters('builtInIdentityResourceGroupLocation')]"
104
+ },
105
+ "bringYourOwnUserAssignedManagedIdentity": {
106
+ "value": "[parameters('bringYourOwnUserAssignedManagedIdentity')]"
107
+ },
108
+ "userAssignedIdentityResourceId": {
109
+ "value": "[parameters('userAssignedIdentityResourceId')]"
110
  }
111
  }
112
  },
113
  {
114
  "policyDefinitionReferenceId": "MDC_DfSQL_DeployWindowsAMA_VM",
115
+ "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f91991d1-5383-4c95-8ee5-5ac423dd8bb1",
116
+ "definitionVersion": "1.*.*",
117
+ "parameters": {
118
+ "bringYourOwnUserAssignedManagedIdentity": {
119
+ "value": "[parameters('bringYourOwnUserAssignedManagedIdentity')]"
120
+ },
121
+ "userAssignedIdentityResourceId": {
122
+ "value": "[parameters('userAssignedIdentityResourceId')]"
123
+ }
124
+ }
125
  },
126
  {
127
  "policyDefinitionReferenceId": "MDC_DfSQL_DeployMicrosoftDefenderForSQLWindowsAgent_VM",
128
  "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ddca0ddc-4e9d-4bbb-92a1-f7c4dd7ef7ce",
129
+ "definitionVersion": "1.*.*",
130
  "parameters": {
131
  "workspaceRegion": {
132
  "value": "[parameters('workspaceRegion')]"
133
  },
134
  "userWorkspaceId": {
135
  "value": "[parameters('userWorkspaceId')]"
136
+ },
137
+ "bringYourOwnDcr": {
138
+ "value": "[parameters('bringYourOwnDcr')]"
139
+ },
140
+ "dcrResourceId": {
141
+ "value": "[parameters('dcrResourceId')]"
142
  }
143
  }
144
  },
145
  {
146
  "policyDefinitionReferenceId": "MDC_DfSQL_AMA_UserWorkspacePipeline_VM",
147
  "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/04754ef9-9ae3-4477-bf17-86ef50026304",
148
+ "definitionVersion": "1.*.*",
149
  "parameters": {
150
  "userWorkspaceResourceId": {
151
  "value": "[parameters('userWorkspaceResourceId')]"
152
  },
 
157
  "value": "[parameters('userWorkspaceId')]"
158
  },
159
  "enableCollectionOfSqlQueriesForSecurityResearch": {
160
  "value": "[parameters('enableCollectionOfSqlQueriesForSecurityResearch')]"
161
+ },
162
+ "bringYourOwnDcr": {
163
+ "value": "[parameters('bringYourOwnDcr')]"
164
  }
165
  }
166
  },
167
  {
168
  "policyDefinitionReferenceId": "MDC_DfSQL_DeployWindowsAMA_Arc",
169
+ "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3592ff98-9787-443a-af59-4505d0fe0786",
170
+ "definitionVersion": "1.*.*"
171
  },
172
  {
173
  "policyDefinitionReferenceId": "MDC_DfSQL_DeployMicrosoftDefenderForSQLWindowsAgent_Arc",
174
+ "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/65503269-6a54-4553-8a28-0065a8e6d929",
175
+ "definitionVersion": "1.*.*"
176
  },
177
  {
178
  "policyDefinitionReferenceId": "MDC_DfSQL_AMA_UserWorkspacePipeline_Arc",
179
  "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/63d03cbd-47fd-4ee1-8a1c-9ddf07303de0",
180
+ "definitionVersion": "1.*.*",
181
  "parameters": {
182
  "userWorkspaceResourceId": {
183
  "value": "[parameters('userWorkspaceResourceId')]"
184
  },
 
189
  "value": "[parameters('userWorkspaceId')]"
190
  },
191
  "enableCollectionOfSqlQueriesForSecurityResearch": {
192
  "value": "[parameters('enableCollectionOfSqlQueriesForSecurityResearch')]"
193
+ },
194
+ "bringYourOwnDcr": {
195
+ "value": "[parameters('bringYourOwnDcr')]"
196
  }
197
  }
198
  },
199
  {
200
  "policyDefinitionReferenceId": "MDC_DfSQL_AMA_UserWorkspacePipeline_DCRA_Arc",
201
  "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2227e1f1-23dd-4c3a-85a9-7024a401d8b2",
202
+ "definitionVersion": "1.*.*",
203
  "parameters": {
204
  "workspaceRegion": {
205
  "value": "[parameters('workspaceRegion')]"
206
  },
207
  "userWorkspaceId": {
208
  "value": "[parameters('userWorkspaceId')]"
209
+ },
210
+ "bringYourOwnDcr": {
211
+ "value": "[parameters('bringYourOwnDcr')]"
212
+ },
213
+ "dcrResourceId": {
214
+ "value": "[parameters('dcrResourceId')]"
215
  }
216
  }
217
  }
218
+ ],
219
+ "versions": [
220
+ "1.2.0",
221
+ "1.1.1",
222
+ "1.1.0-preview"
223
  ]
224
  }
JSON
api-version=2023-04-01
EPAC 
{8 items}