Skip to content

Commit 95179b9

Browse files
author
Alexander (Sasha) Nosov
committed
Add Payg-SQLArc policy
1 parent 57e5b0a commit 95179b9

10 files changed

Lines changed: 214 additions & 1 deletion

File tree

‎samples/manage/azure-arc-enabled-sql-server/monitor-compliance/README.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Paygo-SQLArc (Windows only)
2+
3+
This Azure Policy ensures that all SQL Arc servers using `LicenseType = Paid` are marked as non-compliant. Servers with `LicenseType = LicenseOnly` are treated as compliant. The remediated task sets `LicenseType = PAYG`.
4+
5+
Use Azure CLI or PowerShell to create the policy definition:
6+
7+
## Artifacts
8+
9+
- **policy.json**: Main policy definition referencing external parameter and rule files.
10+
- **params.json**: Defines policy parameters.
11+
- **rules.json**: Contains the policy rule logic.
12+
13+
## Create policy
14+
Use the following command to create policy
15+
16+
```bash
17+
18+
#!/bin/bash
19+
20+
az policy definition create \
21+
--name "Paygo-SQLArc" \
22+
--display-name "Paygo-SQLArc" \
23+
--description "This Azure Policy ensures that all SQL Arc servers using LicenseType = Paid are marked as non-compliant. Servers with LicenseType = LicenseOnly are treated as compliant. The remediated task sets LicenseType = PAYG." \
24+
--rules @rules.json \
25+
--params @params.json \
26+
--mode Indexed \
27+
--subscription "<your-subscription-id>"\
28+
```
29+
30+
## Assign policy
31+
32+
Use the following command to assign policy
33+
34+
```bash
35+
#!/bin/bash
36+
37+
# Set variables
38+
SUB_ID="<your-subscription-id>"
39+
RG_NAME="<your-resoure-group>" # optional
40+
SCOPE="/subscriptions/$SUB_ID/resourceGroups/$RG_NAME"
41+
LOCATION="<your-azure-region>"
42+
43+
# Create policy assignment
44+
az policy assignment create \
45+
--name "Paygo-SQLArc-Assign" \
46+
--policy "Paygo-SQLArc" \
47+
--scope "$SCOPE" \
48+
--params '{ "effect": { "value": "DeployIfNotExists" } }' \
49+
--mi-system-assigned \
50+
--role "Contributor" \
51+
--identity-scope "$SCOPE" \
52+
--location "$LOCATION"
53+
```
54+
55+
## Create remediation task
56+
57+
Us the following command to create a remediation task
58+
59+
```bash
60+
#!/bin/bash
61+
62+
RG_NAME="<your-resoure-group>"
63+
64+
az policy remediation create \
65+
--name "Remediate-Paygo-SQLArc" \
66+
--policy-assignment "Paygo-SQLArc-Assign" \
67+
--resource-group "$RG_NAME" \
68+
--resource-discovery-mode ReEvaluateCompliance
69+
```

‎samples/manage/azure-arc-enabled-sql-server/monitor-compliance/arc-sql-payg-compliance/params.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"effect": {
3+
"type": "String",
4+
"metadata": {
5+
"displayName": "Effect",
6+
"description": "Enable or disable the execution of the policy."
7+
},
8+
"allowedValues": [
9+
"DeployIfNotExists",
10+
"Disabled"
11+
],
12+
"defaultValue": "DeployIfNotExists"
13+
}
14+
}

‎samples/manage/azure-arc-enabled-sql-server/monitor-compliance/arc-sql-payg-compliance/policy.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"properties": {
3+
"displayName": "Paygo-SQLArc (Windows only)",
4+
"policyType": "Custom",
5+
"mode": "Indexed",
6+
"description": "Policy to replace all SQL Arc server that use License type = 'Paid' with License type = 'PAYG'. Treat License type = 'LicenseOnly' as compliant",
7+
"metadata": {
8+
"category": "SQLArc",
9+
"version": "1.0.0"
10+
},
11+
"parameters": "./params.json",
12+
"policyRule": "./rules.json"
13+
}
14+
}

‎samples/manage/azure-arc-enabled-sql-server/monitor-compliance/arc-sql-payg-compliance/rules.json‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
{
2+
"if": {
3+
"allOf": [
4+
{
5+
"equals": "Microsoft.HybridCompute/machines/extensions",
6+
"field": "type"
7+
},
8+
{
9+
"equals": "Microsoft.AzureData",
10+
"field": "Microsoft.HybridCompute/machines/extensions/publisher"
11+
},
12+
{
13+
"equals": "WindowsAgent.SqlServer",
14+
"field": "Microsoft.HybridCompute/machines/extensions/type"
15+
}
16+
]
17+
},
18+
"then": {
19+
"effect": "[parameters('effect')]",
20+
"details": {
21+
"type": "Microsoft.HybridCompute/machines/extensions",
22+
"roleDefinitionIds": [
23+
"/providers/Microsoft.Authorization/roleDefinitions/7392c568-9289-4bde-aaaa-b7131215889d",
24+
"/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7"
25+
],
26+
"name": "[field('fullName')]",
27+
"existenceCondition": {
28+
"anyOf": [
29+
{
30+
"equals": "[string(createObject('LicenseType','PAYG'))]",
31+
"value": "[string(intersection(if(empty(field('Microsoft.HybridCompute/machines/extensions/settings')), createObject(), field('Microsoft.HybridCompute/machines/extensions/settings')), createObject('LicenseType','PAYG')))]"
32+
},
33+
{
34+
"equals": "[string(createObject('LicenseType','LicenseOnly'))]",
35+
"value": "[string(intersection(if(empty(field('Microsoft.HybridCompute/machines/extensions/settings')), createObject(), field('Microsoft.HybridCompute/machines/extensions/settings')), createObject('LicenseType','LicenseOnly')))]"
36+
}
37+
]
38+
},
39+
"evaluationDelay": "AfterProvisioningSuccess",
40+
"deployment": {
41+
"properties": {
42+
"mode": "incremental",
43+
"template": {
44+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
45+
"contentVersion": "1.0.0.0",
46+
"parameters": {
47+
"extensionName": {
48+
"type": "string"
49+
},
50+
"vmLocation": {
51+
"type": "string"
52+
},
53+
"agentName": {
54+
"type": "string"
55+
},
56+
"existingSettings": {
57+
"type": "object"
58+
}
59+
},
60+
"variables": {
61+
"vmExtensionPublisher": "Microsoft.AzureData",
62+
"updatedSettings": {
63+
"LicenseType": "PAYG"
64+
}
65+
},
66+
"resources": [
67+
{
68+
"name": "[parameters('extensionName')]",
69+
"type": "Microsoft.HybridCompute/machines/extensions",
70+
"location": "[parameters('vmLocation')]",
71+
"apiVersion": "2022-11-10",
72+
"properties": {
73+
"publisher": "[variables('vmExtensionPublisher')]",
74+
"type": "[parameters('agentName')]",
75+
"settings": "[union(parameters('existingSettings'), variables('updatedSettings'))]"
76+
}
77+
}
78+
]
79+
},
80+
"parameters": {
81+
"extensionName": {
82+
"value": "[field('fullName')]"
83+
},
84+
"vmLocation": {
85+
"value": "[field('location')]"
86+
},
87+
"agentName": {
88+
"value": "[field('name')]"
89+
},
90+
"existingSettings": {
91+
"value": "[field('Microsoft.HybridCompute/machines/extensions/settings')]"
92+
}
93+
}
94+
}
95+
}
96+
}
97+
}
98+
}

‎samples/manage/azure-hybrid-benefit/modify-license-type/ModifiedResources_20251013_203148.csv‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
"TenantID","SubID","ResourceName","ResourceType","Status","OriginalLicenseType","ResourceGroup","Location"
2+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","SQL2012EEArc","Microsoft.SqlVirtualMachine/sqlVirtualMachines","VM running","AHUB","ajayj","westus2"
3+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","SQL2022EE","Microsoft.SqlVirtualMachine/sqlVirtualMachines","VM running","AHUB","ajayj","westus2"
4+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","sql2025devstd","Microsoft.SqlVirtualMachine/sqlVirtualMachines","VM running","AHUB","ajayj","westus2"
5+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","ajayjsqlmi","Microsoft.Sql/managedInstances","Ready","BasePrice","ajayj","westus2"
6+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","AdventureworksLT","Microsoft.Sql/servers/databases","Online","BasePrice","ajayj","westus2"

‎samples/manage/azure-hybrid-benefit/modify-license-type/ModifiedResources_20251013_210723.csv‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
"TenantID","SubID","ResourceName","ResourceType","Status","OriginalLicenseType","ResourceGroup","Location"
2+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","SQL2019Arc","Microsoft.SqlVirtualMachine/sqlVirtualMachines","VM running","PAYG","ajayj","westus2"
3+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","sql2022rtmdev","Microsoft.SqlVirtualMachine/sqlVirtualMachines","VM running","PAYG","ajayj","westus2"
4+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","sqldbmi2","Microsoft.Sql/managedInstances","Ready","LicenseIncluded","ajayj","westus"
5+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","sqldbmi1","Microsoft.Sql/managedInstances","Ready","LicenseIncluded","ajayj","westus"
6+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","AlwaysEncrypted","Microsoft.Sql/servers/databases","Online","LicenseIncluded","ajayj","westcentralus"
7+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","dbmirroringspn","Microsoft.Sql/servers/databases","Online","LicenseIncluded","ajayj","westus2"
8+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","dbmirrortest","Microsoft.Sql/servers/databases","Online","LicenseIncluded","ajayj","westus2"

‎samples/manage/azure-hybrid-benefit/modify-license-type/ModifiedResources_20251013_211053.csv‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
"TenantID","SubID","ResourceName","ResourceType","Status","OriginalLicenseType","ResourceGroup","Location"
2+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","SQL2019Arc","Microsoft.SqlVirtualMachine/sqlVirtualMachines","VM running","PAYG","ajayj","westus2"

‎samples/manage/azure-hybrid-benefit/modify-license-type/ModifiedResources_20251013_213825.csv‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
"TenantID","SubID","ResourceName","ResourceType","Status","OriginalLicenseType","ResourceGroup","Location"
2+
"72f988bf-86f1-41af-91ab-2d7cd011db47","fa58cf66-caaf-4ba9-875d-f310d3694845","SQL2019Arc","Microsoft.SqlVirtualMachine/sqlVirtualMachines","VM running","PAYG","ajayj","westus2"

‎samples/manage/azure-hybrid-benefit/modify-license-type/Paygo-SQLArc.json‎

10.7 KB
Binary file not shown.

‎samples/manage/azure-hybrid-benefit/modify-license-type/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ The script produces a report listing the affected resources by creating a `Modif
111111
- Location
112112

113113
> [!NOTE]
114-
> - If `-ReportOnly` is specified, the report shows the resources that would be affected without the actuall change being applied.
114+
> - If `-ReportOnly` is specified, the report shows the resources that would be affected without the actual change being applied.
115115
116116

117117
# Script execution examples

0 commit comments

Comments
 (0)