From a2ec82d0b0b4c1aa93f9938ee8bd8e5a2ac45aa9 Mon Sep 17 00:00:00 2001 From: Tom Claes Date: Tue, 1 Sep 2026 21:55:59 +0200 Subject: [PATCH 1/2] Document Azure portal policy deployment --- .../README.md | 18 +++++++++++++++-- .../sql-mi-license-type-compliance/README.md | 20 +++++++++++++++++-- .../README.md | 20 +++++++++++++++++-- .../README.md | 20 +++++++++++++++++-- 4 files changed, 70 insertions(+), 8 deletions(-) diff --git a/samples/manage/azure-data-factory-ssis/sql-ssis-license-type-compliance/README.md b/samples/manage/azure-data-factory-ssis/sql-ssis-license-type-compliance/README.md index f205dc6e9a..1705f66fad 100644 --- a/samples/manage/azure-data-factory-ssis/sql-ssis-license-type-compliance/README.md +++ b/samples/manage/azure-data-factory-ssis/sql-ssis-license-type-compliance/README.md @@ -40,13 +40,27 @@ The deployment script will prompt for confirmation when targeting `BasePrice`. U ## Prerequisites -- PowerShell with Az modules installed (`Az.Resources` for deployment; `Az.DataFactory` for remediation). -- Logged in to Azure (`Connect-AzAccount`). +- Access to the Azure portal or PowerShell with the `Az.Resources` module installed for deployment. +- PowerShell with the `Az.DataFactory` module and an authenticated Azure context (`Connect-AzAccount`) for remediation. - Permissions to create policy definitions/assignments at target scope. - For remediation: Contributor on each Data Factory whose Integration Runtimes will be updated. ## Deploy Policy +### Option 1: Azure portal + +1. In the [Azure portal](https://portal.azure.com), search for **Policy**. +2. Under **Authoring**, select **Definitions**, and then select **+ Policy definition**. +3. Select the definition location, and enter a name such as `Audit Azure Data Factory SSIS Integration Runtime license type` and a category. +4. Open [`policy/azurepolicy.json`](policy/azurepolicy.json), copy the complete JSON document, paste it into the **Policy rule** editor, replacing the example content, and select **Save**. +5. Open the new definition and select **Assign**. On the **Basics** tab, select the assignment scope. +6. On the **Parameters** tab, leave **Effect** set to `AuditIfNotExists`, select the **Target license type**, and select the current license types eligible for replacement under **Current license types to overwrite**. +7. On the **Review + create** tab, review the settings and select **Create**. + +This policy audits license type drift only, so the assignment does not require a managed identity. To update non-compliant SSIS Integration Runtimes, follow [Start Remediation](#start-remediation). Selecting `BasePrice` confirms that you meet the Azure Hybrid Benefit licensing conditions described above. + +### Option 2: PowerShell + Parameter reference: | Parameter | Required | Default | Allowed values | Description | diff --git a/samples/manage/azure-sql-db-managed-instance/sql-mi-license-type-compliance/README.md b/samples/manage/azure-sql-db-managed-instance/sql-mi-license-type-compliance/README.md index 18416c2cdd..c807c93da4 100644 --- a/samples/manage/azure-sql-db-managed-instance/sql-mi-license-type-compliance/README.md +++ b/samples/manage/azure-sql-db-managed-instance/sql-mi-license-type-compliance/README.md @@ -29,12 +29,28 @@ The deployment script will prompt for confirmation when targeting `BasePrice` or ## Prerequisites -- PowerShell with Az modules installed (`Az.Resources`). -- Logged in to Azure (`Connect-AzAccount`). +- Access to the Azure portal or PowerShell with the `Az.Resources` module installed. +- For PowerShell deployment, logged in to Azure (`Connect-AzAccount`). - Permissions to create policy definitions/assignments and remediation tasks at target scope. ## Deploy Policy +### Option 1: Azure portal + +1. In the [Azure portal](https://portal.azure.com), search for **Policy**. +2. Under **Authoring**, select **Definitions**, and then select **+ Policy definition**. +3. Select the definition location, and enter a name such as `Configure SQL Managed Instance license type` and a category. +4. Open [`policy/azurepolicy.json`](policy/azurepolicy.json), copy the complete JSON document, paste it into the **Policy rule** editor, replacing the example content, and select **Save**. +5. Open the new definition and select **Assign**. On the **Basics** tab, select the assignment scope. +6. On the **Parameters** tab, leave **Effect** set to `DeployIfNotExists`, select the **Target license type**, and select the current license types eligible for replacement under **Current license types to overwrite**. +7. On the **Remediation** tab, select **Create a Managed Identity**, choose an identity location, and select **Create a remediation task** if existing non-compliant managed instances should be updated. +8. On the **Review + create** tab, review the settings and select **Create**. +9. Ensure the assignment's managed identity has the roles listed in [Managed Identity And Roles](#managed-identity-and-roles) at the assignment scope. The portal grants roles referenced by the policy definition when the assignment creator has sufficient permissions; assign any missing roles manually. + +Selecting `BasePrice` or `HybridFailoverRights` confirms that you meet the corresponding licensing conditions described above. + +### Option 2: PowerShell + Parameter reference: | Parameter | Required | Default | Allowed values | Description | diff --git a/samples/manage/azure-sql-db/sql-paas-license-type-compliance/README.md b/samples/manage/azure-sql-db/sql-paas-license-type-compliance/README.md index 7f7aaa1f98..76b0aa4c0b 100644 --- a/samples/manage/azure-sql-db/sql-paas-license-type-compliance/README.md +++ b/samples/manage/azure-sql-db/sql-paas-license-type-compliance/README.md @@ -27,12 +27,28 @@ The deployment script will prompt for confirmation when targeting `BasePrice`. U ## Prerequisites -- PowerShell with Az modules installed (`Az.Resources`). -- Logged in to Azure (`Connect-AzAccount`). +- Access to the Azure portal or PowerShell with the `Az.Resources` module installed. +- For PowerShell deployment, logged in to Azure (`Connect-AzAccount`). - Permissions to create policy definitions/assignments and remediation tasks at target scope. ## Deploy Policy +### Option 1: Azure portal + +1. In the [Azure portal](https://portal.azure.com), search for **Policy**. +2. Under **Authoring**, select **Definitions**, and then select **+ Policy definition**. +3. Select the definition location, and enter a name such as `Configure Azure SQL Database license type` and a category. +4. Open [`policy/azurepolicy.json`](policy/azurepolicy.json), copy the complete JSON document, paste it into the **Policy rule** editor, replacing the example content, and select **Save**. +5. Open the new definition and select **Assign**. On the **Basics** tab, select the assignment scope. +6. On the **Parameters** tab, leave **Effect** set to `DeployIfNotExists` and select the **Target license type**: `LicenseIncluded` for Pay-as-you-go or `BasePrice` for Azure Hybrid Benefit. +7. On the **Remediation** tab, select **Create a Managed Identity**, choose an identity location, and select **Create a remediation task** if existing non-compliant databases should be updated. +8. On the **Review + create** tab, review the settings and select **Create**. +9. Ensure the assignment's managed identity has the roles listed in [Managed Identity And Roles](#managed-identity-and-roles) at the assignment scope. The portal grants roles referenced by the policy definition when the assignment creator has sufficient permissions; assign any missing roles manually. + +Selecting `BasePrice` confirms that you meet the Azure Hybrid Benefit licensing conditions described above. + +### Option 2: PowerShell + Parameter reference: | Parameter | Required | Default | Allowed values | Description | diff --git a/samples/manage/sql-vm/sql-iaas-license-type-compliance/README.md b/samples/manage/sql-vm/sql-iaas-license-type-compliance/README.md index 01d4d1eba4..2afd727d15 100644 --- a/samples/manage/sql-vm/sql-iaas-license-type-compliance/README.md +++ b/samples/manage/sql-vm/sql-iaas-license-type-compliance/README.md @@ -27,12 +27,28 @@ The deployment script will prompt for confirmation when targeting `AHUB` or `DR` ## Prerequisites -- PowerShell with Az modules installed (`Az.Resources`). -- Logged in to Azure (`Connect-AzAccount`). +- Access to the Azure portal or PowerShell with the `Az.Resources` module installed. +- For PowerShell deployment, logged in to Azure (`Connect-AzAccount`). - Permissions to create policy definitions/assignments and remediation tasks at target scope. ## Deploy Policy +### Option 1: Azure portal + +1. In the [Azure portal](https://portal.azure.com), search for **Policy**. +2. Under **Authoring**, select **Definitions**, and then select **+ Policy definition**. +3. Select the definition location, and enter a name such as `Configure SQL Server on Azure VM license type` and a category. +4. Open [`policy/azurepolicy.json`](policy/azurepolicy.json), copy the complete JSON document, paste it into the **Policy rule** editor, replacing the example content, and select **Save**. +5. Open the new definition and select **Assign**. On the **Basics** tab, select the assignment scope. +6. On the **Parameters** tab, leave **Effect** set to `DeployIfNotExists`, select the **Target license type**, and select the current license types eligible for replacement under **Current license types to overwrite**. +7. On the **Remediation** tab, select **Create a Managed Identity**, choose an identity location, and select **Create a remediation task** if existing non-compliant SQL virtual machines should be updated. +8. On the **Review + create** tab, review the settings and select **Create**. +9. Ensure the assignment's managed identity has the roles listed in [Managed Identity And Roles](#managed-identity-and-roles) at the assignment scope. The portal grants roles referenced by the policy definition when the assignment creator has sufficient permissions; assign any missing roles manually. + +Selecting `AHUB` or `DR` confirms that you meet the corresponding licensing conditions described above. + +### Option 2: PowerShell + Parameter reference: | Parameter | Required | Default | Allowed values | Description | From a3d3553b6a6f3b21ee5e5d538d0ed9dc429c2404 Mon Sep 17 00:00:00 2001 From: Tom Claes Date: Tue, 1 Sep 2026 21:57:58 +0200 Subject: [PATCH 2/2] Align Arc policy deployment documentation --- .../arc-sql-license-type-compliance/README.md | 33 ++++++++++++------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md index 95b8aebf26..32d2d8bbaf 100644 --- a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md +++ b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md @@ -16,8 +16,8 @@ This repo deploys and remediates a custom Azure Policy that configures and enfor | Path | Use when | Files | |---|---|---| -| **Command line / pipeline** | You want scope, assignment, role grant and remediation handled for you. | `policy/azurepolicy.json` + `scripts/deployment.ps1` + `scripts/start-remediation.ps1` | | **Azure Portal** | You want to create the definition by hand and assign it yourself. | `policy/azurepolicy.portal.json` | +| **Command line / pipeline** | You want scope, assignment, role grant and remediation handled for you. | `policy/azurepolicy.json` + `scripts/deployment.ps1` + `scripts/start-remediation.ps1` | ## Choosing the license type by edition (compliance) @@ -41,12 +41,30 @@ This repo deploys and remediates a custom Azure Policy that configures and enfor ## Prerequisites -- PowerShell with Az modules installed (`Az.Resources`). -- Logged in to Azure (`Connect-AzAccount`). +- Access to the Azure portal or PowerShell with the `Az.Resources` module installed. +- For PowerShell deployment, logged in to Azure (`Connect-AzAccount`). - Permissions to create policy definitions/assignments and remediation tasks at target scope. ## Deploy Policy +### Option 1: Azure portal + +The **Policy rule** editor expects the policy definition's `properties` contents. Use the dedicated portal file because `policy/azurepolicy.json` includes the read-only `policyType` field and a top-level `version` field that the portal rejects. The portal file also supports `LicenseOnly` and uses it as the safe, non-attesting default. + +1. In the [Azure portal](https://portal.azure.com), search for **Policy**. +2. Under **Authoring**, select **Definitions**, and then select **+ Policy definition**. +3. Select the definition location, enter a name such as `Configure Arc-enabled SQL Server license type`, and select `Azure Arc` as the category. +4. Open [`policy/azurepolicy.portal.json`](policy/azurepolicy.portal.json), copy the complete JSON document, paste it into the **Policy rule** editor, replacing the example content, and select **Save**. +5. Open the new definition and select **Assign**. On the **Basics** tab, select the assignment scope. +6. On the **Parameters** tab, leave **Effect** set to `DeployIfNotExists`, select the SQL Server extension platforms, select the **Target license type** according to the edition table above, and select the current license types eligible for replacement. +7. On the **Remediation** tab, select **Create a Managed Identity**, choose an identity location, and select **Create a remediation task** if existing non-compliant extensions should be updated. +8. On the **Review + create** tab, review the settings and select **Create**. +9. Ensure the assignment's managed identity has the roles listed in [Managed Identity And Roles](#managed-identity-and-roles) at the assignment scope. The portal grants roles referenced by the policy definition when the assignment creator has sufficient permissions; assign any missing roles manually. + +Selecting `Paid` attests that you meet the licensing conditions described above. Selecting `PAYG` enables recurring billing consent as described in [Recurring Billing Consent (PAYG)](#recurring-billing-consent-payg). + +### Option 2: PowerShell + Parameter reference: | Parameter | Required | Default | Allowed values | Description | @@ -137,15 +155,6 @@ This will: > **Note:** `deployment.ps1` automatically grants required roles to the policy assignment managed identity at assignment scope, preventing common `PolicyAuthorizationFailed` errors during DeployIfNotExists deployments. -## Deploy via the Azure Portal (copy & paste) - -Prefer the portal? The **Policy definition → Policy rule** box expects the `properties` contents. The repo's `policy/azurepolicy.json` also carries a read-only `policyType` and a top-level `version` that the portal rejects, so `policy/azurepolicy.portal.json` has those removed (nothing else changed, plus `LicenseOnly` added to the allowed license types). - -1. **Policy → Definitions → + Policy definition.** -2. Set **Definition location**, **Name** (e.g. *Configure Arc-enabled SQL Server license type*), and **Category** = `Azure Arc`. -3. Open [`policy/azurepolicy.portal.json`](./policy/azurepolicy.portal.json), copy its entire contents, clear the **Policy rule** box and paste it in. -4. **Save**, then **Assign**. On the *Parameters* tab choose your **Target license type** per the edition table above. Because the effect is `DeployIfNotExists`, the assignment needs a **system-assigned managed identity + location**; the portal grants the required roles. Create a **remediation task** to update existing instances. - ## Start Remediation Parameter reference: