ASC_Azure_Defender_Servers_EnableP1_ResourceLevel_DINE.json

{
  "properties": {
    "displayName": "Configure Azure Defender for Servers to be enabled (with 'P1' subplan) for all resources (resource level)",
    "policyType": "BuiltIn",
    "mode": "All",
    "description": "Azure Defender for Servers provides real-time threat protection for server workloads and generates hardening recommendations as well as alerts about suspicious activities. This policy will enable the Defender for Servers plan (with 'P1' subplan) for all resources (VMs and ARC Machines) in the selected scope (subscription or resource group).",
    "metadata": {
      "version": "1.0.0",
      "category": "Security Center - Granular Pricing"
    },
    "version": "1.0.0",
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "DeployIfNotExists",
          "Disabled"
        ],
        "defaultValue": "DeployIfNotExists"
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "in": [
          "Microsoft.Compute/virtualMachines",
          "Microsoft.HybridCompute/machines"
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Security/pricings",
          "name": "VirtualMachines",
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/fb1c8493-542b-48eb-b624-b4c8fea62acd"
          ],
          "existenceCondition": {
            "field": "Microsoft.Security/pricings/pricingTier",
            "equals": "Standard"
          },
          "deployment": {
            "properties": {
              "mode": "incremental",
              "parameters": {
                "fullResourceName": {
                  "value": "[field('id')]"
                }
              },
              "template": {
                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "fullResourceName": {
                    "type": "string"
                  }
                },
                "variables": {},
                "resources": [
                  {
                    "type": "Microsoft.Security/pricings",
                    "apiVersion": "2024-01-01",
                    "scope": "[parameters('fullResourceName')]",
                    "name": "VirtualMachines",
                    "properties": {
                      "subplan": "P1",
                      "pricingTier": "Standard"
                    }
                  }
                ],
                "outputs": {}
              }
            }
          }
        }
      }
    },
    "versions": [
      "1.0.0"
    ]
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/1b8c0040-b224-4ea1-be6a-47254dd5a207",
  "name": "1b8c0040-b224-4ea1-be6a-47254dd5a207"
}