DiagnosticSettingsForTypes_Audit.json

{
  "properties": {
    "displayName": "Audit diagnostic setting for selected resource types",
    "policyType": "BuiltIn",
    "mode": "All",
    "description": "Audit diagnostic setting for selected resource types. Be sure to select only resource types which support diagnostics settings.",
    "metadata": {
      "version": "2.0.1",
      "category": "Monitoring"
    },
    "version": "2.0.1",
    "parameters": {
      "listOfResourceTypes": {
        "type": "Array",
        "metadata": {
          "displayName": "Resource Types",
          "strongType": "resourceTypes"
        }
      },
      "logsEnabled": {
        "type": "Boolean",
        "metadata": {
          "displayName": "Logs Enabled"
        },
        "allowedValues": [
          true,
          false
        ],
        "defaultValue": true
      },
      "metricsEnabled": {
        "type": "Boolean",
        "metadata": {
          "displayName": "Metrics Enabled"
        },
        "allowedValues": [
          true,
          false
        ],
        "defaultValue": true
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "notIn": [
              "microsoft.security/assessmentmetadata",
              "microsoft.network/networksecuritygroups/securityrules",
              "microsoft.storage/storageaccounts/queueservices/queues",
              "microsoft.operationalinsights/workspaces/tables",
              "microsoft.machinelearningservices/workspaces/jobs",
              "microsoft.authorization/rolemanagementpolicies",
              "microsoft.apimanagement/service/apis/operations",
              "microsoft.apimanagement/service/apis/operations/tags",
              "microsoft.compute/disks",
              "microsoft.compute/virtualmachines/extensions",
              "microsoft.authorization/roleassignments",
              "microsoft.storage/storageaccounts/tableservices/tables",
              "microsoft.insights/components/proactivedetectionconfigs",
              "microsoft.network/routetables/routes",
              "microsoft.machinelearningservices/workspaces/environments/versions",
              "microsoft.sql/servers/databases/advisors",
              "microsoft.security/policies",
              "microsoft.resources/subscriptions/resourcegroups",
              "microsoft.authorization/roledefinitions",
              "microsoft.apimanagement/service/apis/operations/policies",
              "microsoft.compute/snapshots",
              "microsoft.datafactory/factories/pipelines",
              "microsoft.datafactory/factories/datasets",
              "microsoft.network/virtualnetworks/subnets",
              "microsoft.security/pricings"
            ]
          },
          {
            "field": "type",
            "in": "[parameters('listOfResourceTypes')]"
          }
        ]
      },
      "then": {
        "effect": "AuditIfNotExists",
        "details": {
          "type": "Microsoft.Insights/diagnosticSettings",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
                "equals": "[parameters('logsEnabled')]"
              },
              {
                "field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
                "equals": "[parameters('metricsEnabled')]"
              }
            ]
          }
        }
      }
    },
    "versions": [
      "2.0.1"
    ]
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/7f89b1eb-583c-429a-8828-af049802c1d9",
  "name": "7f89b1eb-583c-429a-8828-af049802c1d9"
}