ISO/IEC 27017 2015

Azure BuiltIn Policy Initiative (PolicySet)

Policy types

Policy states

Policy categories

Total Policies: 99
Builtin Policies: 99
Static Policies: 0

GA: 95
Preview: 4

29 categories:

API for FHIR: 1
API Management: 1
App Configuration: 2
App Service: 3
Automation: 1
Azure Data Explorer: 2
Batch: 1
Cache: 2
Compute: 5
Container Instance: 1
Cosmos DB: 2
Data Lake: 2
Event Hub: 3
General: 1
Guest Configuration: 12
Internet of Things: 2
Key Vault: 6
Kubernetes: 4
Logic Apps: 1
Machine Learning: 2
Monitoring: 11
Network: 4
Regulatory Compliance: 2
Security Center: 5
Service Bus: 2
SignalR: 1
SQL: 13
Storage: 5
Stream Analytics: 2

Rows: 1-10 / 99

Records:

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Page of 10

Policy DisplayName

Policy Id

Category

Version

Versioning

Effect

Roles#

Roles

State

policy in AzUSGov

[Preview]: Azure Arc enabled Kubernetes clusters should have Microsoft Defender for Cloud extension installed

8dfab9c4-fe7b-49ad-85e4-1e9be085358f

Kubernetes

6.0.0-preview

1x
6.0.0-preview

Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled

Preview

true

[Preview]: Guest Attestation extension should be installed on supported Windows virtual machines scale sets

f655e522-adff-494d-95c2-52d4f6d56a42

Security Center

3.1.0-preview

1x
3.1.0-preview

Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled

Preview

true

[Preview]: IoT Hub device provisioning service data should be encrypted using customer-managed keys (CMK)

47031206-ce96-41f8-861b-6a915f3de284

Internet of Things

1.0.0-preview

1x
1.0.0-preview

Default
Audit
Allowed
Audit, Deny, Disabled

Preview

true

[Preview]: vTPM should be enabled on supported virtual machines

1c30f9cd-b84c-49cc-aa2c-9288447cc3b3

Security Center

2.0.0-preview

1x
2.0.0-preview

Default
Audit
Allowed
Audit, Disabled

Preview

true

A Microsoft Entra administrator should be provisioned for PostgreSQL servers

b4dec045-250a-48c2-b5cc-e0c4eec8b5b4

SQL

1.0.1

2x
1.0.1, 1.0.0

Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled

true

All authorization rules except RootManageSharedAccessKey should be removed from Service Bus namespace

a1817ec0-a368-432a-8057-8371e17ac6ee

Service Bus

1.0.1

1x
1.0.1

Default
Audit
Allowed
Audit, Deny, Disabled

unknown

An activity log alert should exist for specific Administrative operations

b954148f-4c11-4c38-8221-be76711e194a

Monitoring

1.0.0

1x
1.0.0

Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled

true

An activity log alert should exist for specific Policy operations

c5447c04-a4d7-4ba8-a263-c9ee321a6858

Monitoring

3.0.0

1x
3.0.0

Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled

true

An activity log alert should exist for specific Security operations

3b980d31-7904-4bb7-8575-5665739a8052

Monitoring

1.0.0

1x
1.0.0

Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled

true

API Management should disable public network access to the service configuration endpoints

df73bd95-24da-4a4f-96b9-4e8b94b402bd

API Management

1.0.1

1x
1.0.1

Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled

unknown

Date/Time (UTC ymd) (i)

Changes

2025-06-09 17:23:47

Version change: '1.2.0' to '1.3.0'
remove Policy [Deprecated]: Log Analytics Extension should be enabled for listed virtual machine images (32133ab0-ee4b-4b44-98d6-042180979d50)

2025-05-09 17:29:42

Version change: '1.1.0' to '1.2.0'
remove Policy [Deprecated]: Virtual machines should have the Log Analytics extension installed (a70ca396-0a34-413a-88e1-b956c1e683be)

2025-04-24 19:52:16

Version change: '1.0.0' to '1.1.0'
remove Policy [Deprecated]: Vulnerabilities in security configuration on your machines should be remediated (e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15)

2025-01-30 19:27:00

add Initiative f48ecfa6-581c-43f9-8141-cd4adc72cf26

{

displayName: "ISO/IEC 27017 2015",
policyType: "BuiltIn",
description: "Cloud-specific extension to ISO 27001, providing security guidelines for cloud service providers and customers.",
metadata: {2 items
- version: "1.3.0",
- category: "Regulatory Compliance"
},
version: "1.3.0",
parameters: {181 items
- effect-81e74cea-30fd-40d5-802f-d72103c2aaaa: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-f655e522-adff-494d-95c2-52d4f6d56a42: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-3b980d31-7904-4bb7-8575-5665739a8052: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- operationName-3b980d31-7904-4bb7-8575-5665739a8052: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Operation Name",
    - description: "Security Operation name for which activity log alert should exist"
    },
  - allowedValues: [3 items
    - "Microsoft.Security/policies/write",
    - "Microsoft.Security/securitySolutions/write",
    - "Microsoft.Security/securitySolutions/delete"
    ]
  },
- effect-47031206-ce96-41f8-861b-6a915f3de284: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-a1817ec0-a368-432a-8057-8371e17ac6ee: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-055aa869-bc98-4af8-bafc-23f1ab6ffe2c: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-3e596b57-105f-48a6-be97-03e9243bad6e: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-3dc5edcd-002d-444c-b216-e123bbfa37c0: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- source-c26596ff-4d70-4e6a-9a30-c2506bd2f80c: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Source",
    - description: "The source k8s object for constraint evaluation. 'Original' means only evaluate against the specific GroupVersionKind specified in the policy definition. 'Generated' means only evaluate against k8s objects generated by Gatekeeper ExpansionTemplates. 'All' means evaluate against both the original object and any generated ones."
    },
  - allowedValues: [3 items
    - "All",
    - "Generated",
    - "Original"
    ],
  - defaultValue: "Original"
  },
- warn-c26596ff-4d70-4e6a-9a30-c2506bd2f80c: {3 items
  - type: "Boolean",
  - metadata: {2 items
    - displayName: "Warn",
    - description: "Whether or not to return warnings back to the user in the kubectl cli"
    },
  - defaultValue: false
  },
- effect-c26596ff-4d70-4e6a-9a30-c2506bd2f80c: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- excludedNamespaces-c26596ff-4d70-4e6a-9a30-c2506bd2f80c: {3 items
  - type: "Array",
  - metadata: {2 items
    - displayName: "Namespace exclusions",
    - description: "List of Kubernetes namespaces to exclude from policy evaluation. System namespaces "kube-system", "gatekeeper-system" and "azure-arc" are always excluded by design. "azure-extensions-usage-system" is optional to remove."
    },
  - defaultValue: [4 items
    - "kube-system",
    - "gatekeeper-system",
    - "azure-arc",
    - "azure-extensions-usage-system"
    ]
  },
- namespaces-c26596ff-4d70-4e6a-9a30-c2506bd2f80c: {3 items
  - type: "Array",
  - metadata: {2 items
    - displayName: "Namespace inclusions",
    - description: "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
    },
  - defaultValue: []
  },
- labelSelector-c26596ff-4d70-4e6a-9a30-c2506bd2f80c: {3 items
  - type: "Object",
  - metadata: {2 items
    - displayName: "Kubernetes label selector",
    - description: "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
    },
  - defaultValue: {}
  },
- allowedCapabilities-c26596ff-4d70-4e6a-9a30-c2506bd2f80c: {3 items
  - type: "Array",
  - metadata: {3 items
    - displayName: "Allowed capabilities",
    - description: "The list of capabilities that are allowed to be added to a container. Provide empty list as input to block everything.",
    - portalReview: true
    },
  - defaultValue: []
  },
- requiredDropCapabilities-c26596ff-4d70-4e6a-9a30-c2506bd2f80c: {3 items
  - type: "Array",
  - metadata: {3 items
    - displayName: "Required drop capabilities",
    - description: "The list of capabilities that must be dropped by a container.",
    - portalReview: true
    },
  - defaultValue: []
  },
- excludedContainers-c26596ff-4d70-4e6a-9a30-c2506bd2f80c: {3 items
  - type: "Array",
  - metadata: {2 items
    - displayName: "Containers exclusions",
    - description: "The list of InitContainers and Containers to exclude from policy evaluation. The identify is the name of container. Use an empty list to apply this policy to all containers in all namespaces."
    },
  - defaultValue: []
  },
- excludedImages-c26596ff-4d70-4e6a-9a30-c2506bd2f80c: {3 items
  - type: "Array",
  - metadata: {3 items
    - displayName: "Image exclusions",
    - description: "The list of InitContainers and Containers to exclude from policy evaluation. The identifier is the image of container. Prefix-matching can be signified with `*`. For example: `myregistry.azurecr.io/istio:*`. It is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name) in order to avoid unexpectedly exempting images from an untrusted repository.",
    - portalReview: true
    },
  - defaultValue: []
  },
- effect-98728c90-32c7-4049-8429-847dc0f4fe37: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-5450f5bd-9c72-4390-a9c4-a7aba4edfdd2: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- IncludeArcMachines-33936777-f2ac-45aa-82ec-07958ec9ade4: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Include Arc connected servers",
    - description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
    - portalReview: "true"
    },
  - allowedValues: [2 items
    - "true",
    - "false"
    ],
  - defaultValue: "false"
  },
- AuditShutDownSystemImmediatelyIfUnableToLogSecurityAudits-33936777-f2ac-45aa-82ec-07958ec9ade4: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Audit: Shut down system immediately if unable to log security audits",
    - description: "Audits if the system will shut down when unable to log Security events."
    },
  - defaultValue: "0"
  },
- effect-33936777-f2ac-45aa-82ec-07958ec9ade4: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-83a214f7-d01a-484b-91a9-ed54470c9a6a: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- requiredRetentionDays-83a214f7-d01a-484b-91a9-ed54470c9a6a: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Required retention (days)",
    - description: "The required resource logs retention in days"
    },
  - defaultValue: "365"
  },
- effect-18adea5e-f416-4d0f-8aa8-d24321e3e274: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-afe0c3be-ba3b-4544-ba52-0c99672a8ad6: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- requiredRetentionDays-afe0c3be-ba3b-4544-ba52-0c99672a8ad6: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Required retention (days)",
    - description: "The required resource logs retention in days if exporting to an Azure Storage account"
    },
  - defaultValue: "365"
  },
- IncludeArcMachines-1221c620-d201-468c-81e7-2817e6107e84: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Include Arc connected servers",
    - description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
    - portalReview: "true"
    },
  - allowedValues: [2 items
    - "true",
    - "false"
    ],
  - defaultValue: "false"
  },
- NetworkSecurityConfigureEncryptionTypesAllowedForKerberos-1221c620-d201-468c-81e7-2817e6107e84: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Network Security: Configure encryption types allowed for Kerberos",
    - description: "Specifies the encryption types that Kerberos is allowed to use."
    },
  - defaultValue: "2147483644"
  },
- NetworkSecurityLANManagerAuthenticationLevel-1221c620-d201-468c-81e7-2817e6107e84: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Network security: LAN Manager authentication level",
    - description: "Specify which challenge-response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers."
    },
  - defaultValue: "5"
  },
- NetworkSecurityLDAPClientSigningRequirements-1221c620-d201-468c-81e7-2817e6107e84: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Network security: LDAP client signing requirements",
    - description: "Specify the level of data signing that is requested on behalf of clients that issue LDAP BIND requests."
    },
  - defaultValue: "1"
  },
- NetworkSecurityMinimumSessionSecurityForNTLMSSPBasedIncludingSecureRPCClients-1221c620-d201-468c-81e7-2817e6107e84: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients",
    - description: "Specifies which behaviors are allowed by clients for applications using the NTLM Security Support Provider (SSP). The SSP Interface (SSPI) is used by applications that need authentication services. See https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers for more information."
    },
  - defaultValue: "537395200"
  },
- NetworkSecurityMinimumSessionSecurityForNTLMSSPBasedIncludingSecureRPCServers-1221c620-d201-468c-81e7-2817e6107e84: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers",
    - description: "Specifies which behaviors are allowed by servers for applications using the NTLM Security Support Provider (SSP). The SSP Interface (SSPI) is used by applications that need authentication services."
    },
  - defaultValue: "537395200"
  },
- effect-1221c620-d201-468c-81e7-2817e6107e84: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-404c3081-a854-4457-ae30-26a93ef643f9: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-efbde977-ba53-4479-b8e9-10b957924fbf: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-1b8ca024-1d5c-4dec-8995-b1a932b41780: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-0da106f2-4ca3-48e8-bc85-c638fe6aea8f: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-f4b53539-8df9-40e4-86c6-6b607703bd4e: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-0aa61e00-0a01-4a3c-9945-e93cffedf0e6: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Disabled",
    - "Deny"
    ],
  - defaultValue: "Audit"
  },
- allowedKeyTypes-75c4f823-d65c-4f29-a733-01d0077fdbcb: {4 items
  - type: "Array",
  - metadata: {2 items
    - displayName: "Allowed key types",
    - description: "The list of allowed key types"
    },
  - allowedValues: [4 items
    - "RSA",
    - "RSA-HSM",
    - "EC",
    - "EC-HSM"
    ],
  - defaultValue: [4 items
    - "RSA",
    - "RSA-HSM",
    - "EC",
    - "EC-HSM"
    ]
  },
- effect-75c4f823-d65c-4f29-a733-01d0077fdbcb: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- IncludeArcMachines-69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Include Arc connected servers",
    - description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
    - portalReview: "true"
    },
  - allowedValues: [2 items
    - "true",
    - "false"
    ],
  - defaultValue: "false"
  },
- MembersToExclude-69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f: {2 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Members to exclude",
    - description: "A semicolon-separated list of members that should be excluded in the Administrators local group. Ex: Administrator; myUser1; myUser2"
    }
  },
- effect-1a4e592a-6a6e-44a5-9814-e36264ca96e7: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- source-423dd1ba-798e-40e4-9c4d-b6902674b423: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Source",
    - description: "The source k8s object for constraint evaluation. 'Original' means only evaluate against the specific GroupVersionKind specified in the policy definition. 'Generated' means only evaluate against k8s objects generated by Gatekeeper ExpansionTemplates. 'All' means evaluate against both the original object and any generated ones."
    },
  - allowedValues: [3 items
    - "All",
    - "Generated",
    - "Original"
    ],
  - defaultValue: "Original"
  },
- warn-423dd1ba-798e-40e4-9c4d-b6902674b423: {3 items
  - type: "Boolean",
  - metadata: {2 items
    - displayName: "Warn",
    - description: "Whether or not to return warnings back to the user in the kubectl cli"
    },
  - defaultValue: false
  },
- effect-423dd1ba-798e-40e4-9c4d-b6902674b423: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- excludedImages-423dd1ba-798e-40e4-9c4d-b6902674b423: {3 items
  - type: "Array",
  - metadata: {3 items
    - displayName: "Image exclusions",
    - description: "The list of InitContainers and Containers to exclude from policy evaluation. The identifier is the image of container. Prefix-matching can be signified with `*`. For example: `myregistry.azurecr.io/istio:*`. It is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name) in order to avoid unexpectedly exempting images from an untrusted repository.",
    - portalReview: true
    },
  - defaultValue: []
  },
- excludedNamespaces-423dd1ba-798e-40e4-9c4d-b6902674b423: {3 items
  - type: "Array",
  - metadata: {2 items
    - displayName: "Namespace exclusions",
    - description: "List of Kubernetes namespaces to exclude from policy evaluation. System namespaces "kube-system", "gatekeeper-system" and "azure-arc" are always excluded by design. "azure-extensions-usage-system" is optional to remove."
    },
  - defaultValue: [4 items
    - "kube-system",
    - "gatekeeper-system",
    - "azure-arc",
    - "azure-extensions-usage-system"
    ]
  },
- namespaces-423dd1ba-798e-40e4-9c4d-b6902674b423: {3 items
  - type: "Array",
  - metadata: {2 items
    - displayName: "Namespace inclusions",
    - description: "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
    },
  - defaultValue: []
  },
- labelSelector-423dd1ba-798e-40e4-9c4d-b6902674b423: {3 items
  - type: "Object",
  - metadata: {2 items
    - displayName: "Kubernetes label selector",
    - description: "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
    },
  - defaultValue: {}
  },
- effect-797b37f7-06b8-444c-b1ad-fc62867f335a: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-22bee202-a82f-4305-9a2a-6d7f44d4dedb: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-56a5ee18-2ae6-4810-86f7-18e39ce5629b: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- IncludeArcMachines-bf16e0bb-31e1-4646-8202-60a235cc7e74: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Include Arc connected servers",
    - description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
    - portalReview: "true"
    },
  - allowedValues: [2 items
    - "true",
    - "false"
    ],
  - defaultValue: "false"
  },
- effect-bf16e0bb-31e1-4646-8202-60a235cc7e74: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-8dfab9c4-fe7b-49ad-85e4-1e9be085358f: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- allowedEncryptionSets-d461a302-a187-421a-89ac-84acdb4edc04: {2 items
  - type: "Array",
  - metadata: {3 items
    - displayName: "Allowed disk encryption set",
    - description: "The list of allowed disk encryption sets for managed disks.",
    - strongType: "Microsoft.Compute/diskEncryptionSets"
    }
  },
- effect-d461a302-a187-421a-89ac-84acdb4edc04: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-ca91455f-eace-4f96-be59-e6e2c35b4816: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-f4826e5f-6a27-407c-ae3e-9582eb39891d: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-7803067c-7d34-46e3-8c79-0ca68fc4036d: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-3d9f5e4c-9947-4579-9539-2a7695fbc187: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-009a0c92-f5b4-4776-9b66-4ed2b4775563: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-87ba29ef-1ab3-4d82-b763-87fcd4f531f7: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-2393d2cf-a342-44cd-a2e2-fe0188fd1234: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "Audit",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-b8564268-eb4a-4337-89be-a19db070c59d: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-967a4b4b-2da9-43c1-b7d0-f98d0d74d0b1: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-4fa4b6c0-31ca-4c0d-b10d-24b96f62a751: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- listOfImageIdToInclude_windows-11ac78e3-31bc-4f0c-8434-37ab963cea07: {3 items
  - type: "Array",
  - metadata: {2 items
    - displayName: "Optional: List of virtual machine images that have supported Windows OS to add to scope",
    - description: "Example value: '/subscriptions/<subscriptionId>/resourceGroups/YourResourceGroup/providers/Microsoft.Compute/images/ContosoStdImage'"
    },
  - defaultValue: []
  },
- listOfImageIdToInclude_linux-11ac78e3-31bc-4f0c-8434-37ab963cea07: {3 items
  - type: "Array",
  - metadata: {2 items
    - displayName: "Optional: List of virtual machine images that have supported Linux OS to add to scope",
    - description: "Example value: '/subscriptions/<subscriptionId>/resourceGroups/YourResourceGroup/providers/Microsoft.Compute/images/ContosoStdImage'"
    },
  - defaultValue: []
  },
- effect-11ac78e3-31bc-4f0c-8434-37ab963cea07: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-a70ca396-0a34-413a-88e1-b956c1e683be: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "[Deprecated]: Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects",
    - deprecated: true
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "Disabled"
  },
- allowedECNames-ff25f3c8-b739-4538-9d07-3d6d25cfb255: {4 items
  - type: "Array",
  - metadata: {2 items
    - displayName: "Allowed elliptic curve names",
    - description: "The list of allowed curve names for elliptic curve cryptography certificates."
    },
  - allowedValues: [4 items
    - "P-256",
    - "P-256K",
    - "P-384",
    - "P-521"
    ],
  - defaultValue: [4 items
    - "P-256",
    - "P-256K",
    - "P-384",
    - "P-521"
    ]
  },
- effect-ff25f3c8-b739-4538-9d07-3d6d25cfb255: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- IncludeArcMachines-e068b215-0026-4354-b347-8fb2766f73a2: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Include Arc connected servers",
    - description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
    - portalReview: "true"
    },
  - allowedValues: [2 items
    - "true",
    - "false"
    ],
  - defaultValue: "false"
  },
- UsersOrGroupsThatMayAccessThisComputerFromTheNetwork-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users or groups that may access this computer from the network",
    - description: "Specifies which remote users on the network are permitted to connect to the computer. This does not include Remote Desktop Connection."
    },
  - defaultValue: "Administrators, Authenticated Users"
  },
- UsersOrGroupsThatMayLogOnLocally-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users or groups that may log on locally",
    - description: "Specifies which users or groups can interactively log on to the computer. Users who attempt to log on via Remote Desktop Connection or IIS also require this user right."
    },
  - defaultValue: "Administrators"
  },
- UsersOrGroupsThatMayLogOnThroughRemoteDesktopServices-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users or groups that may log on through Remote Desktop Services",
    - description: "Specifies which users or groups are permitted to log on as a Terminal Services client, Remote Desktop, or for Remote Assistance."
    },
  - defaultValue: "Administrators, Remote Desktop Users"
  },
- UsersAndGroupsThatAreDeniedAccessToThisComputerFromTheNetwork-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users and groups that are denied access to this computer from the network",
    - description: "Specifies which users or groups are explicitly prohibited from connecting to the computer across the network."
    },
  - defaultValue: "Guests"
  },
- UsersOrGroupsThatMayManageAuditingAndSecurityLog-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users or groups that may manage auditing and security log",
    - description: "Specifies users and groups permitted to change the auditing options for files and directories and clear the Security log."
    },
  - defaultValue: "Administrators"
  },
- UsersOrGroupsThatMayBackUpFilesAndDirectories-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users or groups that may back up files and directories",
    - description: "Specifies users and groups allowed to circumvent file and directory permissions to back up the system."
    },
  - defaultValue: "Administrators, Backup Operators"
  },
- UsersOrGroupsThatMayChangeTheSystemTime-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users or groups that may change the system time",
    - description: "Specifies which users and groups are permitted to change the time and date on the internal clock of the computer."
    },
  - defaultValue: "Administrators, LOCAL SERVICE"
  },
- UsersOrGroupsThatMayChangeTheTimeZone-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users or groups that may change the time zone",
    - description: "Specifies which users and groups are permitted to change the time zone of the computer."
    },
  - defaultValue: "Administrators, LOCAL SERVICE"
  },
- UsersOrGroupsThatMayCreateATokenObject-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users or groups that may create a token object",
    - description: "Specifies which users and groups are permitted to create an access token, which may provide elevated rights to access sensitive data."
    },
  - defaultValue: "No One"
  },
- UsersAndGroupsThatAreDeniedLoggingOnAsABatchJob-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users and groups that are denied logging on as a batch job",
    - description: "Specifies which users and groups are explicitly not permitted to log on to the computer as a batch job (i.e. scheduled task)."
    },
  - defaultValue: "Guests"
  },
- UsersAndGroupsThatAreDeniedLoggingOnAsAService-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users and groups that are denied logging on as a service",
    - description: "Specifies which service accounts are explicitly not permitted to register a process as a service."
    },
  - defaultValue: "Guests"
  },
- UsersAndGroupsThatAreDeniedLocalLogon-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users and groups that are denied local logon",
    - description: "Specifies which users and groups are explicitly not permitted to log on to the computer."
    },
  - defaultValue: "Guests"
  },
- UsersAndGroupsThatAreDeniedLogOnThroughRemoteDesktopServices-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users and groups that are denied log on through Remote Desktop Services",
    - description: "Specifies which users and groups are explicitly not permitted to log on to the computer via Terminal Services/Remote Desktop Client."
    },
  - defaultValue: "Guests"
  },
- UserAndGroupsThatMayForceShutdownFromARemoteSystem-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "User and groups that may force shutdown from a remote system",
    - description: "Specifies which users and groups are permitted to shut down the computer from a remote location on the network."
    },
  - defaultValue: "Administrators"
  },
- UsersAndGroupsThatMayRestoreFilesAndDirectories-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users and groups that may restore files and directories",
    - description: "Specifies which users and groups are permitted to bypass file, directory, registry, and other persistent object permissions when restoring backed up files and directories."
    },
  - defaultValue: "Administrators, Backup Operators"
  },
- UsersAndGroupsThatMayShutDownTheSystem-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users and groups that may shut down the system",
    - description: "Specifies which users and groups who are logged on locally to the computers in your environment are permitted to shut down the operating system with the Shut Down command."
    },
  - defaultValue: "Administrators"
  },
- UsersOrGroupsThatMayTakeOwnershipOfFilesOrOtherObjects-e068b215-0026-4354-b347-8fb2766f73a2: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Users or groups that may take ownership of files or other objects",
    - description: "Specifies which users and groups are permitted to take ownership of files, folders, registry keys, processes, or threads. This user right bypasses any permissions that are in place to protect objects to give ownership to the specified user."
    },
  - defaultValue: "Administrators"
  },
- effect-e068b215-0026-4354-b347-8fb2766f73a2: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-5e1de0e3-42cb-4ebc-a86d-61d0c619ca48: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-d26f7642-7545-4e18-9b75-8c9bbdee3a9a: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-d416745a-506c-48b6-8ab1-83cb814bcaa3: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- virtualNetworkId-d416745a-506c-48b6-8ab1-83cb814bcaa3: {2 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Virtual network Id",
    - description: "Resource Id of the virtual network. Example: /subscriptions/YourSubscriptionId/resourceGroups/YourResourceGroupName/providers/Microsoft.Network/virtualNetworks/Name"
    }
  },
- effect-ae89ebca-1c92-4898-ac2c-9f63decb045c: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- IncludeArcMachines-2a7a701e-dff3-4da9-9ec5-42cb98594c0b: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Include Arc connected servers",
    - description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
    - portalReview: "true"
    },
  - allowedValues: [2 items
    - "true",
    - "false"
    ],
  - defaultValue: "false"
  },
- AuditAuthenticationPolicyChange-2a7a701e-dff3-4da9-9ec5-42cb98594c0b: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Audit Authentication Policy Change",
    - description: "Specifies whether audit events are generated when changes are made to authentication policy. This setting is useful for tracking changes in domain-level and forest-level trust and privileges that are granted to user accounts or groups."
    },
  - allowedValues: [4 items
    - "No Auditing",
    - "Success",
    - "Failure",
    - "Success and Failure"
    ],
  - defaultValue: "Success"
  },
- AuditAuthorizationPolicyChange-2a7a701e-dff3-4da9-9ec5-42cb98594c0b: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Audit Authorization Policy Change",
    - description: "Specifies whether audit events are generated for assignment and removal of user rights in user right policies, changes in security token object permission, resource attributes changes and Central Access Policy changes for file system objects."
    },
  - allowedValues: [4 items
    - "No Auditing",
    - "Success",
    - "Failure",
    - "Success and Failure"
    ],
  - defaultValue: "No Auditing"
  },
- effect-2a7a701e-dff3-4da9-9ec5-42cb98594c0b: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- IncludeArcMachines-ebb67efd-3c46-49b0-adfe-5599eb944998: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Include Arc connected servers",
    - description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
    - portalReview: "true"
    },
  - allowedValues: [2 items
    - "true",
    - "false"
    ],
  - defaultValue: "false"
  },
- installedApplication-ebb67efd-3c46-49b0-adfe-5599eb944998: {2 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Application names (supports wildcards)",
    - description: "A semicolon-separated list of the names of the applications that should be installed. e.g. 'Microsoft SQL Server 2014 (64-bit); Microsoft Visual Studio Code' or 'Microsoft SQL Server 2014*' (to match any application starting with 'Microsoft SQL Server 2014')"
    }
  },
- effect-c9299215-ae47-4f50-9c54-8a392f68a052: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-383856f8-de7f-44a2-81fc-e5135b5c2aa4: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- requiredRetentionDays-383856f8-de7f-44a2-81fc-e5135b5c2aa4: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Required retention (days)",
    - description: "The required resource logs retention in days"
    },
  - defaultValue: "365"
  },
- effect-fc26e2fd-3149-74b4-5988-d64bb90f8ef7: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "Manual",
    - "Disabled"
    ],
  - defaultValue: "Manual"
  },
- effect-c5447c04-a4d7-4ba8-a263-c9ee321a6858: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- operationName-c5447c04-a4d7-4ba8-a263-c9ee321a6858: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Operation Name",
    - description: "Policy Operation name for which activity log alert should exist"
    },
  - allowedValues: [2 items
    - "Microsoft.Authorization/policyAssignments/write",
    - "Microsoft.Authorization/policyAssignments/delete"
    ]
  },
- effect-1c30f9cd-b84c-49cc-aa2c-9288447cc3b3: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "Audit",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- IncludeArcMachines-f2143251-70de-4e81-87a8-36cee5a2f29d: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Include Arc connected servers",
    - description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
    - portalReview: "true"
    },
  - allowedValues: [2 items
    - "true",
    - "false"
    ],
  - defaultValue: "false"
  },
- EnforcePasswordHistory-f2143251-70de-4e81-87a8-36cee5a2f29d: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Enforce password history",
    - description: "Specifies limits on password reuse - how many times a new password must be created for a user account before the password can be repeated."
    },
  - defaultValue: "24"
  },
- MaximumPasswordAge-f2143251-70de-4e81-87a8-36cee5a2f29d: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Maximum password age",
    - description: "Specifies the maximum number of days that may elapse before a user account password must be changed. The format of the value is two integers separated by a comma, denoting an inclusive range."
    },
  - defaultValue: "1,70"
  },
- MinimumPasswordAge-f2143251-70de-4e81-87a8-36cee5a2f29d: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Minimum password age",
    - description: "Specifies the minimum number of days that must elapse before a user account password can be changed."
    },
  - defaultValue: "1"
  },
- MinimumPasswordLength-f2143251-70de-4e81-87a8-36cee5a2f29d: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Minimum password length",
    - description: "Specifies the minimum number of characters that a user account password may contain."
    },
  - defaultValue: "14"
  },
- PasswordMustMeetComplexityRequirements-f2143251-70de-4e81-87a8-36cee5a2f29d: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Password must meet complexity requirements",
    - description: "Specifies whether a user account password must be complex. If required, a complex password must not contain part of user's account name or full name; be at least 6 characters long; contain a mix of uppercase, lowercase, number, and non-alphabetic characters."
    },
  - defaultValue: "1"
  },
- effect-f2143251-70de-4e81-87a8-36cee5a2f29d: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-cf820ca0-f99e-4f3e-84fb-66e913812d21: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- requiredRetentionDays-cf820ca0-f99e-4f3e-84fb-66e913812d21: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Required retention (days)",
    - description: "The required resource logs retention in days"
    },
  - defaultValue: "365"
  },
- effect-32e6bbec-16b6-44c2-be37-c5b672d103cf: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Disabled",
    - "Deny"
    ],
  - defaultValue: "Audit"
  },
- effect-34f95f76-5386-4de7-b824-0d8478470c9d: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- requiredRetentionDays-34f95f76-5386-4de7-b824-0d8478470c9d: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Required retention (days)",
    - description: "The required resource logs retention in days"
    },
  - defaultValue: "365"
  },
- effect-a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- setting-a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9: {4 items
  - type: "String",
  - metadata: {1 item
    - displayName: "Desired Auditing setting"
    },
  - allowedValues: [2 items
    - "enabled",
    - "disabled"
    ],
  - defaultValue: "enabled"
  },
- effect-ac01ad65-10e5-46df-bdd9-6b0cad13e1d2: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-e15effd4-2278-4c65-a0da-4d6f6d1890e2: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Deny",
    - "Audit",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-a8793640-60f7-487c-b5c3-1d37215905c4: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "Audit",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-41388f1c-2db0-4c25-95b2-35d7f5ccbfa9: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- IncludeArcMachines-58383b73-94a9-4414-b382-4146eb02611b: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Include Arc connected servers",
    - description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
    - portalReview: "true"
    },
  - allowedValues: [2 items
    - "true",
    - "false"
    ],
  - defaultValue: "false"
  },
- AuditProcessTermination-58383b73-94a9-4414-b382-4146eb02611b: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Audit Process Termination",
    - description: "Specifies whether audit events are generated when a process has exited. Recommended for monitoring termination of critical processes."
    },
  - allowedValues: [4 items
    - "No Auditing",
    - "Success",
    - "Failure",
    - "Success and Failure"
    ],
  - defaultValue: "No Auditing"
  },
- effect-58383b73-94a9-4414-b382-4146eb02611b: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- listOfImageIdToInclude_windows-32133ab0-ee4b-4b44-98d6-042180979d50: {3 items
  - type: "Array",
  - metadata: {3 items
    - displayName: "[Deprecated]: Optional: List of virtual machine images that have supported Windows OS to add to scope",
    - description: "Example value: '/subscriptions/<subscriptionId>/resourceGroups/YourResourceGroup/providers/Microsoft.Compute/images/ContosoStdImage'",
    - deprecated: true
    },
  - defaultValue: []
  },
- listOfImageIdToInclude_linux-32133ab0-ee4b-4b44-98d6-042180979d50: {3 items
  - type: "Array",
  - metadata: {3 items
    - displayName: "[Deprecated]: Optional: List of virtual machine images that have supported Linux OS to add to scope",
    - description: "Example value: '/subscriptions/<subscriptionId>/resourceGroups/YourResourceGroup/providers/Microsoft.Compute/images/ContosoStdImage'",
    - deprecated: true
    },
  - defaultValue: []
  },
- effect-32133ab0-ee4b-4b44-98d6-042180979d50: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "[Deprecated]: Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects",
    - deprecated: true
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "Disabled"
  },
- effect-0a370ff3-6cab-4e85-8995-295fd854c5b8: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-ca88aadc-6e2b-416c-9de2-5a0f01d1693f: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-9b597639-28e4-48eb-b506-56b05d366257: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-438c38d2-3772-465a-a9cc-7a6666a275ce: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-95bccee9-a7f8-4bec-9ee9-62c3473701fc: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-fdccbe47-f3e3-4213-ad5d-ea459b2fa077: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-057ef27e-665e-4328-8ea3-04b3122bd9fb: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- requiredRetentionDays-057ef27e-665e-4328-8ea3-04b3122bd9fb: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Required retention (days)",
    - description: "The required resource logs retention in days"
    },
  - defaultValue: "365"
  },
- effect-b4dec045-250a-48c2-b5cc-e0c4eec8b5b4: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-b52376f7-9612-48a1-81cd-1ffe4b61032c: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-12430be1-6cc8-4527-a9a8-e3d38f250096: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- modeRequirement-12430be1-6cc8-4527-a9a8-e3d38f250096: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Mode Requirement",
    - description: "Mode required for all WAF policies"
    },
  - allowedValues: [2 items
    - "Prevention",
    - "Detection"
    ],
  - defaultValue: "Detection"
  },
- effect-7bdb79ea-16b8-453e-4ca4-ad5b16012414: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "Manual",
    - "Disabled"
    ],
  - defaultValue: "Manual"
  },
- maximumDaysToRotate-d8cf8476-a2ec-4916-896e-992351803c44: {2 items
  - type: "Integer",
  - metadata: {2 items
    - displayName: "The maximum days to rotate",
    - description: "The maximum number of days after key creation until it must be rotated."
    }
  },
- effect-d8cf8476-a2ec-4916-896e-992351803c44: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "Audit",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-245fc9df-fa96-4414-9a0b-3738c2f7341c: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- requiredRetentionDays-245fc9df-fa96-4414-9a0b-3738c2f7341c: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Required retention (days)",
    - description: "The required resource logs retention (in days)"
    },
  - defaultValue: "365"
  },
- effect-044985bb-afe1-42cd-8a36-9d5d42424537: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "[Deprecated]: Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects",
    - deprecated: true
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "Disabled"
  },
- effect-c95c74d9-38fe-4f0d-af86-0c7d626a315c: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- requiredRetentionDays-c95c74d9-38fe-4f0d-af86-0c7d626a315c: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Required retention (days)",
    - description: "The required resource logs retention in days"
    },
  - defaultValue: "365"
  },
- effect-b954148f-4c11-4c38-8221-be76711e194a: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- operationName-b954148f-4c11-4c38-8221-be76711e194a: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Operation Name",
    - description: "Administrative Operation name for which activity log alert should be configured"
    },
  - allowedValues: [10 items
    - "Microsoft.Sql/servers/firewallRules/write",
    - "Microsoft.Sql/servers/firewallRules/delete",
    - "Microsoft.Network/networkSecurityGroups/write",
    - "Microsoft.Network/networkSecurityGroups/delete",
    - "Microsoft.ClassicNetwork/networkSecurityGroups/write",
    - "Microsoft.ClassicNetwork/networkSecurityGroups/delete",
    - "Microsoft.Network/networkSecurityGroups/securityRules/write",
    - "Microsoft.Network/networkSecurityGroups/securityRules/delete",
    - "Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write",
    - "Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/delete"
    ]
  },
- effect-bfecdea6-31c4-4045-ad42-71b9dc87247d: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-19dd1db6-f442-49cf-a838-b0786b4401ef: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- effect-d9844e8a-1437-4aeb-a32c-0c992f056095: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-df73bd95-24da-4a4f-96b9-4e8b94b402bd: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- endpointType-df73bd95-24da-4a4f-96b9-4e8b94b402bd: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Public Endpoint Type",
    - description: "Public Endpoint Type for which to enforce the access check"
    },
  - allowedValues: [3 items
    - "Management",
    - "Git",
    - "Gateway Configuration"
    ],
  - defaultValue: "Management"
  },
- effect-051cba44-2429-45b9-9649-46cec11c7119: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "Audit",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- IncludeArcMachines-30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "Include Arc connected servers",
    - description: "By selecting this option, you agree to be charged monthly per Arc connected machine.",
    - portalReview: "true"
    },
  - allowedValues: [2 items
    - "true",
    - "false"
    ],
  - defaultValue: "false"
  },
- MembersToInclude-30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7: {2 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Members to include",
    - description: "A semicolon-separated list of members that should be included in the Administrators local group. Ex: Administrator; myUser1; myUser2"
    }
  },
- effect-f9be5368-9bf5-4b84-9e0a-7850da98bb46: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- requiredRetentionDays-f9be5368-9bf5-4b84-9e0a-7850da98bb46: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Required retention (days)",
    - description: "The required resource logs retention in days"
    },
  - defaultValue: "365"
  },
- effect-f8d36e2f-389b-4ee4-898d-21aeb69a0f45: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  },
- requiredRetentionDays-f8d36e2f-389b-4ee4-898d-21aeb69a0f45: {3 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Required retention (days)",
    - description: "The required resource logs retention in days"
    },
  - defaultValue: "365"
  },
- effect-6c53d030-cc64-46f0-906d-2bc061cd1334: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-8405fdab-1faf-48aa-b702-999c9c172094: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [2 items
    - "Audit",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-b5ec538c-daa0-4006-8596-35468b9148e8: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-21a6bc25-125e-4d13-b82d-2e19b7208ab7: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- effect-1bc02227-0cb6-4e11-8f53-eb0b22eab7e8: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect for policy: An activity log alert should exist for specific Administrative operations (Microsoft.ClassicNetwork/networkSecurityGroups/securityRules/write)",
    - description: "For more information about effects, visit https://aka.ms/policyeffects"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  }
},
policyDefinitions: [99 items
- {5 items
  - policyDefinitionReferenceId: "81e74cea-30fd-40d5-802f-d72103c2aaaa",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/81e74cea-30fd-40d5-802f-d72103c2aaaa Azure Data Explorer encryption at rest should use a customer-managed key ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-81e74cea-30fd-40d5-802f-d72103c2aaaa')]"
      }
    },
  - groupNames: [3 items
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "f655e522-adff-494d-95c2-52d4f6d56a42",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/f655e522-adff-494d-95c2-52d4f6d56a42 [Preview]: Guest Attestation extension should be installed on supported Windows virtual machines scale sets ,
  - definitionVersion: 3.*.*-preview3.1.0-preview,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-f655e522-adff-494d-95c2-52d4f6d56a42')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "3b980d31-7904-4bb7-8575-5665739a8052",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/3b980d31-7904-4bb7-8575-5665739a8052 An activity log alert should exist for specific Security operations ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-3b980d31-7904-4bb7-8575-5665739a8052')]"
      },
    - operationName: {1 item
      - value: "[parameters('operationName-3b980d31-7904-4bb7-8575-5665739a8052')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_Annex_A:_CLD.6.3.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "47031206-ce96-41f8-861b-6a915f3de284",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/47031206-ce96-41f8-861b-6a915f3de284 [Preview]: IoT Hub device provisioning service data should be encrypted using customer-managed keys (CMK) ,
  - definitionVersion: 1.*.*-preview1.0.0-preview,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-47031206-ce96-41f8-861b-6a915f3de284')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_10.1.2"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "a1817ec0-a368-432a-8057-8371e17ac6ee",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/a1817ec0-a368-432a-8057-8371e17ac6ee All authorization rules except RootManageSharedAccessKey should be removed from Service Bus namespace ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-a1817ec0-a368-432a-8057-8371e17ac6ee')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "055aa869-bc98-4af8-bafc-23f1ab6ffe2c",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/055aa869-bc98-4af8-bafc-23f1ab6ffe2c Azure Web Application Firewall should be enabled for Azure Front Door entry-points ,
  - definitionVersion: 1.*.*1.0.2,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-055aa869-bc98-4af8-bafc-23f1ab6ffe2c')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_13.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "3e596b57-105f-48a6-be97-03e9243bad6e",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/3e596b57-105f-48a6-be97-03e9243bad6e Azure Monitor solution 'Security and Audit' must be deployed ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-3e596b57-105f-48a6-be97-03e9243bad6e')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "3dc5edcd-002d-444c-b216-e123bbfa37c0",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/3dc5edcd-002d-444c-b216-e123bbfa37c0 Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost. ,
  - definitionVersion: 1.*.*1.1.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-3dc5edcd-002d-444c-b216-e123bbfa37c0')]"
      }
    },
  - groupNames: [3 items
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "c26596ff-4d70-4e6a-9a30-c2506bd2f80c",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/c26596ff-4d70-4e6a-9a30-c2506bd2f80c Kubernetes cluster containers should only use allowed capabilities ,
  - definitionVersion: 6.*.*6.2.0,
  - parameters: {10 items
    - source: {1 item
      - value: "[parameters('source-c26596ff-4d70-4e6a-9a30-c2506bd2f80c')]"
      },
    - warn: {1 item
      - value: "[parameters('warn-c26596ff-4d70-4e6a-9a30-c2506bd2f80c')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-c26596ff-4d70-4e6a-9a30-c2506bd2f80c')]"
      },
    - excludedNamespaces: {1 item
      - value: "[parameters('excludedNamespaces-c26596ff-4d70-4e6a-9a30-c2506bd2f80c')]"
      },
    - namespaces: {1 item
      - value: "[parameters('namespaces-c26596ff-4d70-4e6a-9a30-c2506bd2f80c')]"
      },
    - labelSelector: {1 item
      - value: "[parameters('labelSelector-c26596ff-4d70-4e6a-9a30-c2506bd2f80c')]"
      },
    - allowedCapabilities: {1 item
      - value: "[parameters('allowedCapabilities-c26596ff-4d70-4e6a-9a30-c2506bd2f80c')]"
      },
    - requiredDropCapabilities: {1 item
      - value: "[parameters('requiredDropCapabilities-c26596ff-4d70-4e6a-9a30-c2506bd2f80c')]"
      },
    - excludedContainers: {1 item
      - value: "[parameters('excludedContainers-c26596ff-4d70-4e6a-9a30-c2506bd2f80c')]"
      },
    - excludedImages: {1 item
      - value: "[parameters('excludedImages-c26596ff-4d70-4e6a-9a30-c2506bd2f80c')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "98728c90-32c7-4049-8429-847dc0f4fe37",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/98728c90-32c7-4049-8429-847dc0f4fe37 Key Vault secrets should have an expiration date ,
  - definitionVersion: 1.*.*1.0.2,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-98728c90-32c7-4049-8429-847dc0f4fe37')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_10.1.2"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "5450f5bd-9c72-4390-a9c4-a7aba4edfdd2",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/5450f5bd-9c72-4390-a9c4-a7aba4edfdd2 Cosmos DB database accounts should have local authentication methods disabled ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-5450f5bd-9c72-4390-a9c4-a7aba4edfdd2')]"
      }
    },
  - groupNames: [3 items
    - "ISO_IEC_27017_2015_12.4.1",
    - "ISO_IEC_27017_2015_9.2.4",
    - "ISO_IEC_27017_2015_16.1.2"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "33936777-f2ac-45aa-82ec-07958ec9ade4",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/33936777-f2ac-45aa-82ec-07958ec9ade4 Windows machines should meet requirements for 'Security Options - Audit' ,
  - definitionVersion: 3.*.*3.0.0,
  - parameters: {3 items
    - IncludeArcMachines: {1 item
      - value: "[parameters('IncludeArcMachines-33936777-f2ac-45aa-82ec-07958ec9ade4')]"
      },
    - AuditShutDownSystemImmediatelyIfUnableToLogSecurityAudits: {1 item
      - value: "[parameters('AuditShutDownSystemImmediatelyIfUnableToLogSecurityAudits-33936777-f2ac-45aa-82ec-07958ec9ade4')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-33936777-f2ac-45aa-82ec-07958ec9ade4')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_Annex_A:_CLD.6.3.1",
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "83a214f7-d01a-484b-91a9-ed54470c9a6a",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/83a214f7-d01a-484b-91a9-ed54470c9a6a Resource logs in Event Hub should be enabled ,
  - definitionVersion: 5.*.*5.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-83a214f7-d01a-484b-91a9-ed54470c9a6a')]"
      },
    - requiredRetentionDays: {1 item
      - value: "[parameters('requiredRetentionDays-83a214f7-d01a-484b-91a9-ed54470c9a6a')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "18adea5e-f416-4d0f-8aa8-d24321e3e274",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/18adea5e-f416-4d0f-8aa8-d24321e3e274 PostgreSQL servers should use customer-managed keys to encrypt data at rest ,
  - definitionVersion: 1.*.*1.0.4,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-18adea5e-f416-4d0f-8aa8-d24321e3e274')]"
      }
    },
  - groupNames: [3 items
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0 Key Vault keys should have an expiration date ,
  - definitionVersion: 1.*.*1.0.2,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_10.1.2"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "afe0c3be-ba3b-4544-ba52-0c99672a8ad6",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/afe0c3be-ba3b-4544-ba52-0c99672a8ad6 Resource logs in Azure Machine Learning Workspaces should be enabled ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-afe0c3be-ba3b-4544-ba52-0c99672a8ad6')]"
      },
    - requiredRetentionDays: {1 item
      - value: "[parameters('requiredRetentionDays-afe0c3be-ba3b-4544-ba52-0c99672a8ad6')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "1221c620-d201-468c-81e7-2817e6107e84",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/1221c620-d201-468c-81e7-2817e6107e84 Windows machines should meet requirements for 'Security Options - Network Security' ,
  - definitionVersion: 3.*.*3.0.0,
  - parameters: {7 items
    - IncludeArcMachines: {1 item
      - value: "[parameters('IncludeArcMachines-1221c620-d201-468c-81e7-2817e6107e84')]"
      },
    - NetworkSecurityConfigureEncryptionTypesAllowedForKerberos: {1 item
      - value: "[parameters('NetworkSecurityConfigureEncryptionTypesAllowedForKerberos-1221c620-d201-468c-81e7-2817e6107e84')]"
      },
    - NetworkSecurityLANManagerAuthenticationLevel: {1 item
      - value: "[parameters('NetworkSecurityLANManagerAuthenticationLevel-1221c620-d201-468c-81e7-2817e6107e84')]"
      },
    - NetworkSecurityLDAPClientSigningRequirements: {1 item
      - value: "[parameters('NetworkSecurityLDAPClientSigningRequirements-1221c620-d201-468c-81e7-2817e6107e84')]"
      },
    - NetworkSecurityMinimumSessionSecurityForNTLMSSPBasedIncludingSecureRPCClients: {1 item
      - value: "[parameters('NetworkSecurityMinimumSessionSecurityForNTLMSSPBasedIncludingSecureRPCClients-1221c620-d201-468c-81e7-2817e6107e84')]"
      },
    - NetworkSecurityMinimumSessionSecurityForNTLMSSPBasedIncludingSecureRPCServers: {1 item
      - value: "[parameters('NetworkSecurityMinimumSessionSecurityForNTLMSSPBasedIncludingSecureRPCServers-1221c620-d201-468c-81e7-2817e6107e84')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-1221c620-d201-468c-81e7-2817e6107e84')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "404c3081-a854-4457-ae30-26a93ef643f9",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9 Secure transfer to storage accounts should be enabled ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-404c3081-a854-4457-ae30-26a93ef643f9')]"
      }
    },
  - groupNames: [3 items
    - "ISO_IEC_27017_2015_10.1.2",
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "efbde977-ba53-4479-b8e9-10b957924fbf",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/efbde977-ba53-4479-b8e9-10b957924fbf The Log Analytics extension should be installed on Virtual Machine Scale Sets ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-efbde977-ba53-4479-b8e9-10b957924fbf')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "1b8ca024-1d5c-4dec-8995-b1a932b41780",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/1b8ca024-1d5c-4dec-8995-b1a932b41780 Public network access on Azure SQL Database should be disabled ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-1b8ca024-1d5c-4dec-8995-b1a932b41780')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "0da106f2-4ca3-48e8-bc85-c638fe6aea8f",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/0da106f2-4ca3-48e8-bc85-c638fe6aea8f Function apps should use managed identity ,
  - definitionVersion: 3.*.*3.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-0da106f2-4ca3-48e8-bc85-c638fe6aea8f')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_9.2.4"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "f4b53539-8df9-40e4-86c6-6b607703bd4e",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/f4b53539-8df9-40e4-86c6-6b607703bd4e Disk encryption should be enabled on Azure Data Explorer ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-f4b53539-8df9-40e4-86c6-6b607703bd4e')]"
      }
    },
  - groupNames: [3 items
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "0aa61e00-0a01-4a3c-9945-e93cffedf0e6",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/0aa61e00-0a01-4a3c-9945-e93cffedf0e6 Azure Container Instance container group should use customer-managed key for encryption ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-0aa61e00-0a01-4a3c-9945-e93cffedf0e6')]"
      }
    },
  - groupNames: [4 items
    - "ISO_IEC_27017_2015_10.1.2",
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "75c4f823-d65c-4f29-a733-01d0077fdbcb",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/75c4f823-d65c-4f29-a733-01d0077fdbcb Keys should be the specified cryptographic type RSA or EC ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {2 items
    - allowedKeyTypes: {1 item
      - value: "[parameters('allowedKeyTypes-75c4f823-d65c-4f29-a733-01d0077fdbcb')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-75c4f823-d65c-4f29-a733-01d0077fdbcb')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f Audit Windows machines that have the specified members in the Administrators group ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {2 items
    - IncludeArcMachines: {1 item
      - value: "[parameters('IncludeArcMachines-69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f')]"
      },
    - MembersToExclude: {1 item
      - value: "[parameters('MembersToExclude-69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56 Audit virtual machines without disaster recovery configured ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {},
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.3.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "1a4e592a-6a6e-44a5-9814-e36264ca96e7",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/1a4e592a-6a6e-44a5-9814-e36264ca96e7 Azure Monitor log profile should collect logs for categories 'write,' 'delete,' and 'action' ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-1a4e592a-6a6e-44a5-9814-e36264ca96e7')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_8.1.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "423dd1ba-798e-40e4-9c4d-b6902674b423",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/423dd1ba-798e-40e4-9c4d-b6902674b423 Kubernetes clusters should disable automounting API credentials ,
  - definitionVersion: 4.*.*4.2.0,
  - parameters: {7 items
    - source: {1 item
      - value: "[parameters('source-423dd1ba-798e-40e4-9c4d-b6902674b423')]"
      },
    - warn: {1 item
      - value: "[parameters('warn-423dd1ba-798e-40e4-9c4d-b6902674b423')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-423dd1ba-798e-40e4-9c4d-b6902674b423')]"
      },
    - excludedImages: {1 item
      - value: "[parameters('excludedImages-423dd1ba-798e-40e4-9c4d-b6902674b423')]"
      },
    - excludedNamespaces: {1 item
      - value: "[parameters('excludedNamespaces-423dd1ba-798e-40e4-9c4d-b6902674b423')]"
      },
    - namespaces: {1 item
      - value: "[parameters('namespaces-423dd1ba-798e-40e4-9c4d-b6902674b423')]"
      },
    - labelSelector: {1 item
      - value: "[parameters('labelSelector-423dd1ba-798e-40e4-9c4d-b6902674b423')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "797b37f7-06b8-444c-b1ad-fc62867f335a",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/797b37f7-06b8-444c-b1ad-fc62867f335a Azure Cosmos DB should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-797b37f7-06b8-444c-b1ad-fc62867f335a')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {4 items
  - policyDefinitionReferenceId: "0a914e76-4921-4c19-b460-a2d36003525a",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a Audit resource location matches resource group location ,
  - definitionVersion: 2.*.*2.0.0,
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "22bee202-a82f-4305-9a2a-6d7f44d4dedb",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/22bee202-a82f-4305-9a2a-6d7f44d4dedb Only secure connections to your Azure Cache for Redis should be enabled ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-22bee202-a82f-4305-9a2a-6d7f44d4dedb')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "56a5ee18-2ae6-4810-86f7-18e39ce5629b",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/56a5ee18-2ae6-4810-86f7-18e39ce5629b Azure Automation accounts should use customer-managed keys to encrypt data at rest ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-56a5ee18-2ae6-4810-86f7-18e39ce5629b')]"
      }
    },
  - groupNames: [4 items
    - "ISO_IEC_27017_2015_10.1.2",
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "bf16e0bb-31e1-4646-8202-60a235cc7e74",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/bf16e0bb-31e1-4646-8202-60a235cc7e74 Audit Windows machines that do not have the password complexity setting enabled ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {2 items
    - IncludeArcMachines: {1 item
      - value: "[parameters('IncludeArcMachines-bf16e0bb-31e1-4646-8202-60a235cc7e74')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-bf16e0bb-31e1-4646-8202-60a235cc7e74')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_9.2.4"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "8dfab9c4-fe7b-49ad-85e4-1e9be085358f",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/8dfab9c4-fe7b-49ad-85e4-1e9be085358f [Preview]: Azure Arc enabled Kubernetes clusters should have Microsoft Defender for Cloud extension installed ,
  - definitionVersion: 6.*.*-preview6.0.0-preview,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-8dfab9c4-fe7b-49ad-85e4-1e9be085358f')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "d461a302-a187-421a-89ac-84acdb4edc04",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/d461a302-a187-421a-89ac-84acdb4edc04 Managed disks should use a specific set of disk encryption sets for the customer-managed key encryption ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {2 items
    - allowedEncryptionSets: {1 item
      - value: "[parameters('allowedEncryptionSets-d461a302-a187-421a-89ac-84acdb4edc04')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-d461a302-a187-421a-89ac-84acdb4edc04')]"
      }
    },
  - groupNames: [4 items
    - "ISO_IEC_27017_2015_10.1.2",
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "ca91455f-eace-4f96-be59-e6e2c35b4816",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/ca91455f-eace-4f96-be59-e6e2c35b4816 Managed disks should be double encrypted with both platform-managed and customer-managed keys ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-ca91455f-eace-4f96-be59-e6e2c35b4816')]"
      }
    },
  - groupNames: [4 items
    - "ISO_IEC_27017_2015_10.1.2",
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "f4826e5f-6a27-407c-ae3e-9582eb39891d",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/f4826e5f-6a27-407c-ae3e-9582eb39891d Authorization rules on the Event Hub instance should be defined ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-f4826e5f-6a27-407c-ae3e-9582eb39891d')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_9.4.1",
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "7803067c-7d34-46e3-8c79-0ca68fc4036d",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/7803067c-7d34-46e3-8c79-0ca68fc4036d Azure Cache for Redis should use private link ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-7803067c-7d34-46e3-8c79-0ca68fc4036d')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "3d9f5e4c-9947-4579-9539-2a7695fbc187",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/3d9f5e4c-9947-4579-9539-2a7695fbc187 App Configuration should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-3d9f5e4c-9947-4579-9539-2a7695fbc187')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "009a0c92-f5b4-4776-9b66-4ed2b4775563",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/009a0c92-f5b4-4776-9b66-4ed2b4775563 Private endpoint connections on Batch accounts should be enabled ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-009a0c92-f5b4-4776-9b66-4ed2b4775563')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "87ba29ef-1ab3-4d82-b763-87fcd4f531f7",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/87ba29ef-1ab3-4d82-b763-87fcd4f531f7 Azure Stream Analytics jobs should use customer-managed keys to encrypt data ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-87ba29ef-1ab3-4d82-b763-87fcd4f531f7')]"
      }
    },
  - groupNames: [4 items
    - "ISO_IEC_27017_2015_10.1.2",
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "2393d2cf-a342-44cd-a2e2-fe0188fd1234",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/2393d2cf-a342-44cd-a2e2-fe0188fd1234 Azure SignalR Service should use private link ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-2393d2cf-a342-44cd-a2e2-fe0188fd1234')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "b8564268-eb4a-4337-89be-a19db070c59d",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/b8564268-eb4a-4337-89be-a19db070c59d Event Hub namespaces should use private link ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-b8564268-eb4a-4337-89be-a19db070c59d')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "967a4b4b-2da9-43c1-b7d0-f98d0d74d0b1",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/967a4b4b-2da9-43c1-b7d0-f98d0d74d0b1 App Configuration should use a customer-managed key ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-967a4b4b-2da9-43c1-b7d0-f98d0d74d0b1')]"
      }
    },
  - groupNames: [4 items
    - "ISO_IEC_27017_2015_10.1.2",
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "4fa4b6c0-31ca-4c0d-b10d-24b96f62a751",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/4fa4b6c0-31ca-4c0d-b10d-24b96f62a751 Storage account public access should be disallowed ,
  - definitionVersion: 3.*.*-preview3.1.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-4fa4b6c0-31ca-4c0d-b10d-24b96f62a751')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "11ac78e3-31bc-4f0c-8434-37ab963cea07",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/11ac78e3-31bc-4f0c-8434-37ab963cea07 Dependency agent should be enabled for listed virtual machine images ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {3 items
    - listOfImageIdToInclude_windows: {1 item
      - value: "[parameters('listOfImageIdToInclude_windows-11ac78e3-31bc-4f0c-8434-37ab963cea07')]"
      },
    - listOfImageIdToInclude_linux: {1 item
      - value: "[parameters('listOfImageIdToInclude_linux-11ac78e3-31bc-4f0c-8434-37ab963cea07')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-11ac78e3-31bc-4f0c-8434-37ab963cea07')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_8.1.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "ff25f3c8-b739-4538-9d07-3d6d25cfb255",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/ff25f3c8-b739-4538-9d07-3d6d25cfb255 Keys using elliptic curve cryptography should have the specified curve names ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {2 items
    - allowedECNames: {1 item
      - value: "[parameters('allowedECNames-ff25f3c8-b739-4538-9d07-3d6d25cfb255')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-ff25f3c8-b739-4538-9d07-3d6d25cfb255')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "e068b215-0026-4354-b347-8fb2766f73a2",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/e068b215-0026-4354-b347-8fb2766f73a2 Windows machines should meet requirements for 'User Rights Assignment' ,
  - definitionVersion: 3.*.*3.0.0,
  - parameters: {19 items
    - IncludeArcMachines: {1 item
      - value: "[parameters('IncludeArcMachines-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersOrGroupsThatMayAccessThisComputerFromTheNetwork: {1 item
      - value: "[parameters('UsersOrGroupsThatMayAccessThisComputerFromTheNetwork-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersOrGroupsThatMayLogOnLocally: {1 item
      - value: "[parameters('UsersOrGroupsThatMayLogOnLocally-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersOrGroupsThatMayLogOnThroughRemoteDesktopServices: {1 item
      - value: "[parameters('UsersOrGroupsThatMayLogOnThroughRemoteDesktopServices-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersAndGroupsThatAreDeniedAccessToThisComputerFromTheNetwork: {1 item
      - value: "[parameters('UsersAndGroupsThatAreDeniedAccessToThisComputerFromTheNetwork-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersOrGroupsThatMayManageAuditingAndSecurityLog: {1 item
      - value: "[parameters('UsersOrGroupsThatMayManageAuditingAndSecurityLog-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersOrGroupsThatMayBackUpFilesAndDirectories: {1 item
      - value: "[parameters('UsersOrGroupsThatMayBackUpFilesAndDirectories-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersOrGroupsThatMayChangeTheSystemTime: {1 item
      - value: "[parameters('UsersOrGroupsThatMayChangeTheSystemTime-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersOrGroupsThatMayChangeTheTimeZone: {1 item
      - value: "[parameters('UsersOrGroupsThatMayChangeTheTimeZone-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersOrGroupsThatMayCreateATokenObject: {1 item
      - value: "[parameters('UsersOrGroupsThatMayCreateATokenObject-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersAndGroupsThatAreDeniedLoggingOnAsABatchJob: {1 item
      - value: "[parameters('UsersAndGroupsThatAreDeniedLoggingOnAsABatchJob-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersAndGroupsThatAreDeniedLoggingOnAsAService: {1 item
      - value: "[parameters('UsersAndGroupsThatAreDeniedLoggingOnAsAService-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersAndGroupsThatAreDeniedLocalLogon: {1 item
      - value: "[parameters('UsersAndGroupsThatAreDeniedLocalLogon-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersAndGroupsThatAreDeniedLogOnThroughRemoteDesktopServices: {1 item
      - value: "[parameters('UsersAndGroupsThatAreDeniedLogOnThroughRemoteDesktopServices-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UserAndGroupsThatMayForceShutdownFromARemoteSystem: {1 item
      - value: "[parameters('UserAndGroupsThatMayForceShutdownFromARemoteSystem-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersAndGroupsThatMayRestoreFilesAndDirectories: {1 item
      - value: "[parameters('UsersAndGroupsThatMayRestoreFilesAndDirectories-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersAndGroupsThatMayShutDownTheSystem: {1 item
      - value: "[parameters('UsersAndGroupsThatMayShutDownTheSystem-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - UsersOrGroupsThatMayTakeOwnershipOfFilesOrOtherObjects: {1 item
      - value: "[parameters('UsersOrGroupsThatMayTakeOwnershipOfFilesOrOtherObjects-e068b215-0026-4354-b347-8fb2766f73a2')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-e068b215-0026-4354-b347-8fb2766f73a2')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_Annex_A:_CLD.6.3.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "5e1de0e3-42cb-4ebc-a86d-61d0c619ca48",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/5e1de0e3-42cb-4ebc-a86d-61d0c619ca48 Public network access should be disabled for PostgreSQL flexible servers ,
  - definitionVersion: 3.*.*3.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-5e1de0e3-42cb-4ebc-a86d-61d0c619ca48')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "d26f7642-7545-4e18-9b75-8c9bbdee3a9a",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/d26f7642-7545-4e18-9b75-8c9bbdee3a9a Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-d26f7642-7545-4e18-9b75-8c9bbdee3a9a')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_12.4.3",
    - "ISO_IEC_27017_2015_8.1.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "d416745a-506c-48b6-8ab1-83cb814bcaa3",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/d416745a-506c-48b6-8ab1-83cb814bcaa3 Virtual machines should be connected to an approved virtual network ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-d416745a-506c-48b6-8ab1-83cb814bcaa3')]"
      },
    - virtualNetworkId: {1 item
      - value: "[parameters('virtualNetworkId-d416745a-506c-48b6-8ab1-83cb814bcaa3')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_8.1.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "ae89ebca-1c92-4898-ac2c-9f63decb045c",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/ae89ebca-1c92-4898-ac2c-9f63decb045c Guest Configuration extension should be installed on your machines ,
  - definitionVersion: 1.*.*1.0.3,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-ae89ebca-1c92-4898-ac2c-9f63decb045c')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.1.2"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "2a7a701e-dff3-4da9-9ec5-42cb98594c0b",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/2a7a701e-dff3-4da9-9ec5-42cb98594c0b Windows machines should meet requirements for 'System Audit Policies - Policy Change' ,
  - definitionVersion: 3.*.*3.0.0,
  - parameters: {4 items
    - IncludeArcMachines: {1 item
      - value: "[parameters('IncludeArcMachines-2a7a701e-dff3-4da9-9ec5-42cb98594c0b')]"
      },
    - AuditAuthenticationPolicyChange: {1 item
      - value: "[parameters('AuditAuthenticationPolicyChange-2a7a701e-dff3-4da9-9ec5-42cb98594c0b')]"
      },
    - AuditAuthorizationPolicyChange: {1 item
      - value: "[parameters('AuditAuthorizationPolicyChange-2a7a701e-dff3-4da9-9ec5-42cb98594c0b')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-2a7a701e-dff3-4da9-9ec5-42cb98594c0b')]"
      }
    },
  - groupNames: [3 items
    - "ISO_IEC_27017_2015_12.4.1",
    - "ISO_IEC_27017_2015_12.4.3",
    - "ISO_IEC_27017_2015_Annex_A:_CLD.12.4.5"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "ebb67efd-3c46-49b0-adfe-5599eb944998",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/ebb67efd-3c46-49b0-adfe-5599eb944998 Audit Windows machines that don't have the specified applications installed ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {2 items
    - IncludeArcMachines: {1 item
      - value: "[parameters('IncludeArcMachines-ebb67efd-3c46-49b0-adfe-5599eb944998')]"
      },
    - installedApplication: {1 item
      - value: "[parameters('installedApplication-ebb67efd-3c46-49b0-adfe-5599eb944998')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_8.1.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "c9299215-ae47-4f50-9c54-8a392f68a052",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/c9299215-ae47-4f50-9c54-8a392f68a052 Public network access should be disabled for MySQL flexible servers ,
  - definitionVersion: 2.*.*2.3.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-c9299215-ae47-4f50-9c54-8a392f68a052')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7 Subscriptions should have a contact email address for security issues ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_16.1.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "383856f8-de7f-44a2-81fc-e5135b5c2aa4",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/383856f8-de7f-44a2-81fc-e5135b5c2aa4 Resource logs in IoT Hub should be enabled ,
  - definitionVersion: 3.*.*3.1.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-383856f8-de7f-44a2-81fc-e5135b5c2aa4')]"
      },
    - requiredRetentionDays: {1 item
      - value: "[parameters('requiredRetentionDays-383856f8-de7f-44a2-81fc-e5135b5c2aa4')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "fc26e2fd-3149-74b4-5988-d64bb90f8ef7",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/fc26e2fd-3149-74b4-5988-d64bb90f8ef7 Separately store backup information ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-fc26e2fd-3149-74b4-5988-d64bb90f8ef7')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.3.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "c5447c04-a4d7-4ba8-a263-c9ee321a6858",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/c5447c04-a4d7-4ba8-a263-c9ee321a6858 An activity log alert should exist for specific Policy operations ,
  - definitionVersion: 3.*.*3.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-c5447c04-a4d7-4ba8-a263-c9ee321a6858')]"
      },
    - operationName: {1 item
      - value: "[parameters('operationName-c5447c04-a4d7-4ba8-a263-c9ee321a6858')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_Annex_A:_CLD.6.3.1",
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "1c30f9cd-b84c-49cc-aa2c-9288447cc3b3",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/1c30f9cd-b84c-49cc-aa2c-9288447cc3b3 [Preview]: vTPM should be enabled on supported virtual machines ,
  - definitionVersion: 2.*.*-preview2.0.0-preview,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-1c30f9cd-b84c-49cc-aa2c-9288447cc3b3')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "f2143251-70de-4e81-87a8-36cee5a2f29d",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/f2143251-70de-4e81-87a8-36cee5a2f29d Windows machines should meet requirements for 'Security Settings - Account Policies' ,
  - definitionVersion: 3.*.*3.0.0,
  - parameters: {7 items
    - IncludeArcMachines: {1 item
      - value: "[parameters('IncludeArcMachines-f2143251-70de-4e81-87a8-36cee5a2f29d')]"
      },
    - EnforcePasswordHistory: {1 item
      - value: "[parameters('EnforcePasswordHistory-f2143251-70de-4e81-87a8-36cee5a2f29d')]"
      },
    - MaximumPasswordAge: {1 item
      - value: "[parameters('MaximumPasswordAge-f2143251-70de-4e81-87a8-36cee5a2f29d')]"
      },
    - MinimumPasswordAge: {1 item
      - value: "[parameters('MinimumPasswordAge-f2143251-70de-4e81-87a8-36cee5a2f29d')]"
      },
    - MinimumPasswordLength: {1 item
      - value: "[parameters('MinimumPasswordLength-f2143251-70de-4e81-87a8-36cee5a2f29d')]"
      },
    - PasswordMustMeetComplexityRequirements: {1 item
      - value: "[parameters('PasswordMustMeetComplexityRequirements-f2143251-70de-4e81-87a8-36cee5a2f29d')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-f2143251-70de-4e81-87a8-36cee5a2f29d')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_9.2.4"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "cf820ca0-f99e-4f3e-84fb-66e913812d21",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/cf820ca0-f99e-4f3e-84fb-66e913812d21 Resource logs in Key Vault should be enabled ,
  - definitionVersion: 5.*.*5.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-cf820ca0-f99e-4f3e-84fb-66e913812d21')]"
      },
    - requiredRetentionDays: {1 item
      - value: "[parameters('requiredRetentionDays-cf820ca0-f99e-4f3e-84fb-66e913812d21')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "32e6bbec-16b6-44c2-be37-c5b672d103cf",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/32e6bbec-16b6-44c2-be37-c5b672d103cf Azure SQL Database should be running TLS version 1.2 or newer ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-32e6bbec-16b6-44c2-be37-c5b672d103cf')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "34f95f76-5386-4de7-b824-0d8478470c9d",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/34f95f76-5386-4de7-b824-0d8478470c9d Resource logs in Logic Apps should be enabled ,
  - definitionVersion: 5.*.*5.1.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-34f95f76-5386-4de7-b824-0d8478470c9d')]"
      },
    - requiredRetentionDays: {1 item
      - value: "[parameters('requiredRetentionDays-34f95f76-5386-4de7-b824-0d8478470c9d')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9 Auditing on SQL server should be enabled ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9')]"
      },
    - setting: {1 item
      - value: "[parameters('setting-a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "ac01ad65-10e5-46df-bdd9-6b0cad13e1d2",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/ac01ad65-10e5-46df-bdd9-6b0cad13e1d2 SQL managed instances should use customer-managed keys to encrypt data at rest ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-ac01ad65-10e5-46df-bdd9-6b0cad13e1d2')]"
      }
    },
  - groupNames: [4 items
    - "ISO_IEC_27017_2015_10.1.2",
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "e15effd4-2278-4c65-a0da-4d6f6d1890e2",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/e15effd4-2278-4c65-a0da-4d6f6d1890e2 Log Analytics Workspaces should block non-Azure Active Directory based ingestion. ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-e15effd4-2278-4c65-a0da-4d6f6d1890e2')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "a8793640-60f7-487c-b5c3-1d37215905c4",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/a8793640-60f7-487c-b5c3-1d37215905c4 SQL Managed Instance should have the minimal TLS version of 1.2 ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-a8793640-60f7-487c-b5c3-1d37215905c4')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "41388f1c-2db0-4c25-95b2-35d7f5ccbfa9",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/41388f1c-2db0-4c25-95b2-35d7f5ccbfa9 Azure Monitor should collect activity logs from all regions ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-41388f1c-2db0-4c25-95b2-35d7f5ccbfa9')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "58383b73-94a9-4414-b382-4146eb02611b",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/58383b73-94a9-4414-b382-4146eb02611b Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking' ,
  - definitionVersion: 3.*.*3.0.0,
  - parameters: {3 items
    - IncludeArcMachines: {1 item
      - value: "[parameters('IncludeArcMachines-58383b73-94a9-4414-b382-4146eb02611b')]"
      },
    - AuditProcessTermination: {1 item
      - value: "[parameters('AuditProcessTermination-58383b73-94a9-4414-b382-4146eb02611b')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-58383b73-94a9-4414-b382-4146eb02611b')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "0a370ff3-6cab-4e85-8995-295fd854c5b8",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/0a370ff3-6cab-4e85-8995-295fd854c5b8 SQL servers should use customer-managed keys to encrypt data at rest ,
  - definitionVersion: 2.*.*2.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-0a370ff3-6cab-4e85-8995-295fd854c5b8')]"
      }
    },
  - groupNames: [4 items
    - "ISO_IEC_27017_2015_10.1.2",
    - "ISO_IEC_27017_2015_10.1.1",
    - "ISO_IEC_27017_2015_18.1.5",
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "ca88aadc-6e2b-416c-9de2-5a0f01d1693f",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/ca88aadc-6e2b-416c-9de2-5a0f01d1693f Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost. ,
  - definitionVersion: 1.*.*1.2.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-ca88aadc-6e2b-416c-9de2-5a0f01d1693f')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "9b597639-28e4-48eb-b506-56b05d366257",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/9b597639-28e4-48eb-b506-56b05d366257 Microsoft IaaSAntimalware extension should be deployed on Windows servers ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-9b597639-28e4-48eb-b506-56b05d366257')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_8.1.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "438c38d2-3772-465a-a9cc-7a6666a275ce",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/438c38d2-3772-465a-a9cc-7a6666a275ce Azure Machine Learning Workspaces should disable public network access ,
  - definitionVersion: 2.*.*2.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-438c38d2-3772-465a-a9cc-7a6666a275ce')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "95bccee9-a7f8-4bec-9ee9-62c3473701fc",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/95bccee9-a7f8-4bec-9ee9-62c3473701fc App Service apps should have authentication enabled ,
  - definitionVersion: 2.*.*2.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-95bccee9-a7f8-4bec-9ee9-62c3473701fc')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "fdccbe47-f3e3-4213-ad5d-ea459b2fa077",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/fdccbe47-f3e3-4213-ad5d-ea459b2fa077 Public network access should be disabled for MariaDB servers ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-fdccbe47-f3e3-4213-ad5d-ea459b2fa077')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "057ef27e-665e-4328-8ea3-04b3122bd9fb",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/057ef27e-665e-4328-8ea3-04b3122bd9fb Resource logs in Azure Data Lake Store should be enabled ,
  - definitionVersion: 5.*.*5.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-057ef27e-665e-4328-8ea3-04b3122bd9fb')]"
      },
    - requiredRetentionDays: {1 item
      - value: "[parameters('requiredRetentionDays-057ef27e-665e-4328-8ea3-04b3122bd9fb')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "b4dec045-250a-48c2-b5cc-e0c4eec8b5b4",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/b4dec045-250a-48c2-b5cc-e0c4eec8b5b4 A Microsoft Entra administrator should be provisioned for PostgreSQL servers ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-b4dec045-250a-48c2-b5cc-e0c4eec8b5b4')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_9.2.4"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "b52376f7-9612-48a1-81cd-1ffe4b61032c",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/b52376f7-9612-48a1-81cd-1ffe4b61032c Public network access should be disabled for PostgreSQL servers ,
  - definitionVersion: 2.*.*2.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-b52376f7-9612-48a1-81cd-1ffe4b61032c')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "12430be1-6cc8-4527-a9a8-e3d38f250096",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/12430be1-6cc8-4527-a9a8-e3d38f250096 Web Application Firewall (WAF) should use the specified mode for Application Gateway ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-12430be1-6cc8-4527-a9a8-e3d38f250096')]"
      },
    - modeRequirement: {1 item
      - value: "[parameters('modeRequirement-12430be1-6cc8-4527-a9a8-e3d38f250096')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "7bdb79ea-16b8-453e-4ca4-ad5b16012414",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/7bdb79ea-16b8-453e-4ca4-ad5b16012414 Transfer backup information to an alternate storage site ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-7bdb79ea-16b8-453e-4ca4-ad5b16012414')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.3.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "d8cf8476-a2ec-4916-896e-992351803c44",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/d8cf8476-a2ec-4916-896e-992351803c44 Keys should have a rotation policy ensuring that their rotation is scheduled within the specified number of days after creation. ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {2 items
    - maximumDaysToRotate: {1 item
      - value: "[parameters('maximumDaysToRotate-d8cf8476-a2ec-4916-896e-992351803c44')]"
      },
    - effect: {1 item
      - value: "[parameters('effect-d8cf8476-a2ec-4916-896e-992351803c44')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_10.1.2"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "245fc9df-fa96-4414-9a0b-3738c2f7341c",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/245fc9df-fa96-4414-9a0b-3738c2f7341c Resource logs in Azure Kubernetes Service should be enabled ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-245fc9df-fa96-4414-9a0b-3738c2f7341c')]"
      },
    - requiredRetentionDays: {1 item
      - value: "[parameters('requiredRetentionDays-245fc9df-fa96-4414-9a0b-3738c2f7341c')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "044985bb-afe1-42cd-8a36-9d5d42424537",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/044985bb-afe1-42cd-8a36-9d5d42424537 Storage account keys should not be expired ,
  - definitionVersion: 3.*.*3.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-044985bb-afe1-42cd-8a36-9d5d42424537')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_10.1.2"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "c95c74d9-38fe-4f0d-af86-0c7d626a315c",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/c95c74d9-38fe-4f0d-af86-0c7d626a315c Resource logs in Data Lake Analytics should be enabled ,
  - definitionVersion: 5.*.*5.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-c95c74d9-38fe-4f0d-af86-0c7d626a315c')]"
      },
    - requiredRetentionDays: {1 item
      - value: "[parameters('requiredRetentionDays-c95c74d9-38fe-4f0d-af86-0c7d626a315c')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "b954148f-4c11-4c38-8221-be76711e194a",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/b954148f-4c11-4c38-8221-be76711e194a An activity log alert should exist for specific Administrative operations ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-b954148f-4c11-4c38-8221-be76711e194a')]"
      },
    - operationName: {1 item
      - value: "[parameters('operationName-b954148f-4c11-4c38-8221-be76711e194a')]"
      }
    },
  - groupNames: [2 items
    - "ISO_IEC_27017_2015_Annex_A:_CLD.6.3.1",
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "bfecdea6-31c4-4045-ad42-71b9dc87247d",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/bfecdea6-31c4-4045-ad42-71b9dc87247d Storage account encryption scopes should use double encryption for data at rest ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-bfecdea6-31c4-4045-ad42-71b9dc87247d')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "19dd1db6-f442-49cf-a838-b0786b4401ef",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/19dd1db6-f442-49cf-a838-b0786b4401ef App Service apps should have Client Certificates (Incoming client certificates) enabled ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-19dd1db6-f442-49cf-a838-b0786b4401ef')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_9.2.4"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "d9844e8a-1437-4aeb-a32c-0c992f056095",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/d9844e8a-1437-4aeb-a32c-0c992f056095 Public network access should be disabled for MySQL servers ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-d9844e8a-1437-4aeb-a32c-0c992f056095')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "df73bd95-24da-4a4f-96b9-4e8b94b402bd",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/df73bd95-24da-4a4f-96b9-4e8b94b402bd API Management should disable public network access to the service configuration endpoints ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-df73bd95-24da-4a4f-96b9-4e8b94b402bd')]"
      },
    - endpointType: {1 item
      - value: "[parameters('endpointType-df73bd95-24da-4a4f-96b9-4e8b94b402bd')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "051cba44-2429-45b9-9649-46cec11c7119",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/051cba44-2429-45b9-9649-46cec11c7119 Azure API for FHIR should use a customer-managed key to encrypt data at rest ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-051cba44-2429-45b9-9649-46cec11c7119')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7 Audit Windows machines missing any of specified members in the Administrators group ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {2 items
    - IncludeArcMachines: {1 item
      - value: "[parameters('IncludeArcMachines-30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7')]"
      },
    - MembersToInclude: {1 item
      - value: "[parameters('MembersToInclude-30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "f9be5368-9bf5-4b84-9e0a-7850da98bb46",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/f9be5368-9bf5-4b84-9e0a-7850da98bb46 Resource logs in Azure Stream Analytics should be enabled ,
  - definitionVersion: 5.*.*5.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-f9be5368-9bf5-4b84-9e0a-7850da98bb46')]"
      },
    - requiredRetentionDays: {1 item
      - value: "[parameters('requiredRetentionDays-f9be5368-9bf5-4b84-9e0a-7850da98bb46')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "f8d36e2f-389b-4ee4-898d-21aeb69a0f45",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/f8d36e2f-389b-4ee4-898d-21aeb69a0f45 Resource logs in Service Bus should be enabled ,
  - definitionVersion: 5.*.*5.0.0,
  - parameters: {2 items
    - effect: {1 item
      - value: "[parameters('effect-f8d36e2f-389b-4ee4-898d-21aeb69a0f45')]"
      },
    - requiredRetentionDays: {1 item
      - value: "[parameters('requiredRetentionDays-f8d36e2f-389b-4ee4-898d-21aeb69a0f45')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.1"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "6c53d030-cc64-46f0-906d-2bc061cd1334",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/6c53d030-cc64-46f0-906d-2bc061cd1334 Log Analytics workspaces should block log ingestion and querying from public networks ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-6c53d030-cc64-46f0-906d-2bc061cd1334')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "8405fdab-1faf-48aa-b702-999c9c172094",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/8405fdab-1faf-48aa-b702-999c9c172094 Managed disks should disable public network access ,
  - definitionVersion: 2.*.*2.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-8405fdab-1faf-48aa-b702-999c9c172094')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "b5ec538c-daa0-4006-8596-35468b9148e8",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/b5ec538c-daa0-4006-8596-35468b9148e8 Storage account encryption scopes should use customer-managed keys to encrypt data at rest ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-b5ec538c-daa0-4006-8596-35468b9148e8')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_18.1.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "21a6bc25-125e-4d13-b82d-2e19b7208ab7",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/21a6bc25-125e-4d13-b82d-2e19b7208ab7 VPN gateways should use only Azure Active Directory (Azure AD) authentication for point-to-site users ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-21a6bc25-125e-4d13-b82d-2e19b7208ab7')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_9.2.3"
    ]
  },
- {5 items
  - policyDefinitionReferenceId: "1bc02227-0cb6-4e11-8f53-eb0b22eab7e8",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/1bc02227-0cb6-4e11-8f53-eb0b22eab7e8 Application Insights components should block log ingestion and querying from public networks ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('effect-1bc02227-0cb6-4e11-8f53-eb0b22eab7e8')]"
      }
    },
  - groupNames: [1 item
    - "ISO_IEC_27017_2015_12.4.3"
    ]
  }
],
policyDefinitionGroups: [17 items
- {2 items
  - name: "ISO_IEC_27017_2015_10.1.1",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_10.1.1"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_18.1.5",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_18.1.5"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_18.1.3",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_18.1.3"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_Annex_A:_CLD.6.3.1",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_Annex_A:_CLD.6.3.1"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_10.1.2",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_10.1.2"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_12.4.3",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_12.4.3"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_12.1.2",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_12.1.2"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_13.1.3",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_13.1.3"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_12.4.1",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_12.4.1"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_9.2.4",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_9.2.4"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_16.1.2",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_16.1.2"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_8.1.1",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_8.1.1"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_12.3.1",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_12.3.1"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_9.4.1",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_9.4.1"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_Annex_A:_CLD.12.4.5",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_Annex_A:_CLD.12.4.5"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_16.1.1",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_16.1.1"
  },
- {2 items
  - name: "ISO_IEC_27017_2015_9.2.3",
  - additionalMetadataId: "/providers/Microsoft.PolicyInsights/policyMetadata/ISO_IEC_27017_2015_9.2.3"
  }
],
versions: [4 items
- "1.3.0",
- "1.2.0",
- "1.1.0",
- "1.0.0"
]

}