Built-in Policy Release 8feb5a11

built-in-policies/policyDefinitions/Azure Ai Services/CognitiveServices_DisableLocalAuth_Audit.json

@@ -0,0 +1,63 @@
+{
+  "properties": {
+    "displayName": "Azure AI Services resources should have key access disabled (disable local authentication)",
+    "policyType": "BuiltIn",
+    "mode": "Indexed",
+    "description": "Key access (local authentication) is recommended to be disabled for security. Azure OpenAI Studio, typically used in development/testing, requires key access and will not function if key access is disabled. After disabling, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. Learn more at: https://aka.ms/AI/auth",
+    "metadata": {
+      "version": "1.1.0",
+      "category": "Azure Ai Services"
+    },
+    "version": "1.1.0",
+    "parameters": {
+      "effect": {
+        "type": "String",
+        "defaultValue": "Audit",
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        }
+      }
+    },
+    "policyRule": {
+      "if": {
+        "anyOf": [
+          {
+            "allOf": [
+              {
+                "field": "type",
+                "equals": "Microsoft.CognitiveServices/accounts"
+              },
+              {
+                "field": "Microsoft.CognitiveServices/accounts/disableLocalAuth",
+                "notEquals": true
+              }
+            ]
+          },
+          {
+            "allOf": [
+              {
+                "field": "type",
+                "equals": "Microsoft.Search/searchServices"
+              },
+              {
+                "field": "Microsoft.Search/searchServices/disableLocalAuth",
+                "notEquals": true
+              }
+            ]
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  },
+  "id": "/providers/Microsoft.Authorization/policyDefinitions/71ef260a-8f18-47b7-abcb-62d0673d94dc",
+  "name": "71ef260a-8f18-47b7-abcb-62d0673d94dc"
+}

built-in-policies/policyDefinitions/Azure Ai Services/CognitiveServices_NetworkAcls_Audit.json

@@ -0,0 +1,67 @@
+{
+  "properties": {
+    "displayName": "Azure AI Services resources should restrict network access",
+    "policyType": "BuiltIn",
+    "mode": "Indexed",
+    "description": "By restricting network access, you can ensure that only allowed networks can access the service. This can be achieved by configuring network rules so that only applications from allowed networks can access the Azure AI service.",
+    "metadata": {
+      "version": "3.1.0",
+      "category": "Azure Ai Services"
+    },
+    "version": "3.1.0",
+    "parameters": {
+      "effect": {
+        "type": "string",
+        "defaultValue": "Audit",
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "metadata": {
+          "displayName": "Effect",
+          "description": "The effect determines what happens when the policy rule is evaluated to match"
+        }
+      }
+    },
+    "policyRule": {
+      "if": {
+        "anyOf": [
+          {
+            "allOf": [
+              {
+                "field": "type",
+                "equals": "Microsoft.CognitiveServices/accounts"
+              },
+              {
+                "field": "Microsoft.CognitiveServices/accounts/publicNetworkAccess",
+                "notEquals": "Disabled"
+              },
+              {
+                "field": "Microsoft.CognitiveServices/accounts/networkAcls.defaultAction",
+                "notEquals": "Deny"
+              }
+            ]
+          },
+          {
+            "allOf": [
+              {
+                "field": "type",
+                "equals": "Microsoft.Search/searchServices"
+              },
+              {
+                "field": "Microsoft.Search/searchServices/networkRuleSet.ipRules[*]",
+                "exists": "false"
+              }
+            ]
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  },
+  "id": "/providers/Microsoft.Authorization/policyDefinitions/037eea7a-bd0a-46c5-9a66-03aea78705d3",
+  "name": "037eea7a-bd0a-46c5-9a66-03aea78705d3"
+}

built-in-policies/policyDefinitions/Azure Update Manager/AzUpdateMgmtCenter_CRP_AutoAssessmentMode_Modify.json

@@ -5,10 +5,10 @@
     "mode": "Indexed",
     "description": "Configure auto-assessment (every 24 hours) for OS updates on native Azure virtual machines. You can control the scope of assignment according to machine subscription, resource group, location or tag. Learn more about this for Windows: https://aka.ms/computevm-windowspatchassessmentmode, for Linux: https://aka.ms/computevm-linuxpatchassessmentmode.",
     "metadata": {
-      "version": "4.6.0",
+      "version": "4.7.0",
       "category": "Azure Update Manager"
     },
-    "version": "4.6.0",
+    "version": "4.7.0",
     "parameters": {
       "assessmentMode": {
         "type": "String",
@@ -942,7 +942,7 @@
         "effect": "modify",
         "details": {
           "roleDefinitionIds": [
-            "/providers/Microsoft.Authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c"
+            "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
           ],
           "conflictEffect": "audit",
           "operations": [

built-in-policies/policyDefinitions/Backup/VirtualMachineApplicationCentricBackup_DINE_WithOutTag.json

@@ -5,10 +5,10 @@
     "mode": "Indexed",
     "description": "Enforce backup for all virtual machines by deploying a recovery services vault in the same location and resource group as the virtual machine. Doing this is useful when different application teams in your organization are allocated separate resource groups and need to manage their own backups and restores. You can optionally exclude virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMAppCentricBackupExcludeTag.",
     "metadata": {
-      "version": "9.1.0",
+      "version": "9.2.0",
       "category": "Backup"
     },
-    "version": "9.1.0",
+    "version": "9.2.0",
     "parameters": {
       "exclusionTagName": {
         "type": "String",
@@ -357,6 +357,10 @@
                       {
                         "field": "Microsoft.Compute/imageSKU",
                         "like": "20_04-lts*"
+                      },
+                      {
+                        "field": "Microsoft.Compute/imageSKU",
+                        "like": "22_04-lts-gen2"
                       }
                     ]
                   }

built-in-policies/policyDefinitions/Backup/VirtualMachineApplicationCentricBackup_DINE_WithTag.json

@@ -5,10 +5,10 @@
     "mode": "Indexed",
     "description": "Enforce backup for all virtual machines by deploying a recovery services vault in the same location and resource group as the virtual machine. Doing this is useful when different application teams in your organization are allocated separate resource groups and need to manage their own backups and restores. You can optionally include virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMAppCentricBackupIncludeTag.",
     "metadata": {
-      "version": "9.1.0",
+      "version": "9.2.0",
       "category": "Backup"
     },
-    "version": "9.1.0",
+    "version": "9.2.0",
     "parameters": {
       "inclusionTagName": {
         "type": "String",
@@ -367,6 +367,10 @@
                       {
                         "field": "Microsoft.Compute/imageSKU",
                         "like": "20_04-lts*"
+                      },
+                      {
+                        "field": "Microsoft.Compute/imageSKU",
+                        "like": "22_04-lts-gen2"
                       }
                     ]
                   }

built-in-policies/policyDefinitions/Backup/VirtualMachineBackup_Backup_DeployIfNotExists.json

@@ -5,10 +5,10 @@
     "mode": "Indexed",
     "description": "Enforce backup for all virtual machines by backing them up to an existing central recovery services vault in the same location and subscription as the virtual machine. Doing this is useful when there is a central team in your organization managing backups for all resources in a subscription. You can optionally exclude virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMCentralBackupExcludeTag.",
     "metadata": {
-      "version": "9.1.0",
+      "version": "9.2.0",
       "category": "Backup"
     },
-    "version": "9.1.0",
+    "version": "9.2.0",
     "parameters": {
       "vaultLocation": {
         "type": "String",
@@ -389,6 +389,10 @@
                       {
                         "field": "Microsoft.Compute/imageSKU",
                         "like": "20_04-lts*"
+                      },
+                      {
+                        "field": "Microsoft.Compute/imageSKU",
+                        "like": "22_04-lts-gen2"
                       }
                     ]
                   }

built-in-policies/policyDefinitions/Backup/VirtualMachineWithTag_Backup_Deploy.json

@@ -5,10 +5,10 @@
     "mode": "Indexed",
     "description": "Enforce backup for all virtual machines by backing them up to an existing central recovery services vault in the same location and subscription as the virtual machine. Doing this is useful when there is a central team in your organization managing backups for all resources in a subscription. You can optionally include virtual machines containing a specified tag to control the scope of assignment. See https://aka.ms/AzureVMCentralBackupIncludeTag.",
     "metadata": {
-      "version": "9.1.0",
+      "version": "9.2.0",
       "category": "Backup"
     },
-    "version": "9.1.0",
+    "version": "9.2.0",
     "parameters": {
       "vaultLocation": {
         "type": "String",
@@ -374,6 +374,10 @@
                       {
                         "field": "Microsoft.Compute/imageSKU",
                         "like": "20_04-lts*"
+                      },
+                      {
+                        "field": "Microsoft.Compute/imageSKU",
+                        "like": "22_04-lts-gen2"
                       }
                     ]
                   }

built-in-policies/policyDefinitions/Kubernetes/CannotEditIndividualNodes.json

@@ -5,12 +5,24 @@
     "mode": "Microsoft.Kubernetes.Data",
     "description": "Cannot Edit Individual Nodes. Users should not edit individual nodes. Please edit node pools.",
     "metadata": {
-      "version": "1.0.3-preview",
+      "version": "1.1.0-preview",
       "category": "Kubernetes",
       "preview": true
     },
-    "version": "1.0.3-preview",
+    "version": "1.1.0-preview",
     "parameters": {
+      "warn": {
+        "type": "Boolean",
+        "metadata": {
+          "displayName": "Warn",
+          "description": "Whether or not to return warnings back to the user in the kubectl cli"
+        },
+        "allowedValues": [
+          true,
+          false
+        ],
+        "defaultValue": false
+      },
       "effect": {
         "type": "String",
         "metadata": {
@@ -126,6 +138,7 @@
       "then": {
         "effect": "[parameters('effect')]",
         "details": {
+          "warn": "[parameters('warn')]",
           "templateInfo": {
             "sourceType": "PublicURL",
             "url": "https://store.policy.core.windows.net/kubernetes/restricted-node-edits/v1/template.yaml"