Alias Request for Microsoft.Sql/servers/aadsql/administrators/activeDirectory about azure-policy

[joshidp]

Can we have a deny policy for SQL Servers without aad admin user set?

Thanks

[pilor]

Sorry, this request isn't clear. What resource property are you requesting to be exposed as a policy alias?

[joshidp]

Hi Chris,

This request is for below set of properties under AzureSQL Server.

"type": "Microsoft.Sql/servers/administrators",
"properties": {
"administratorType": "ActiveDirectory",
"login": "[email protected]",
"sid": "xxxx--xxxx--xxxx",
"tenantId": "xxxx--xxxx--xxxx"
}

Thanks & Regards,
Deepak

[pilor]

I will work with the SQL team to get these published

[joshidp]

Thanks

[pilor]

The following aliases are now available:

Microsoft.Sql/servers/administrators/administratorType
Microsoft.Sql/servers/administrators/login
icrosoft.Sql/servers/administrators/sid
Microsoft.Sql/servers/administrators/tenantId

[hrboyceiii]

Is there a working example of this? I have a policy defined as such:

{
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Sql/servers/administrators"
      },
      {
        "not": {
          "field": "Microsoft.Sql/servers/administrators/administratorType",
          "equals": "ActiveDirectory"
        }
      },
      {
        "not": {
          "field": "Microsoft.Sql/servers/administrators/login",
          "exists": true
        }
      },
      {
        "not": {
          "field": "Microsoft.Sql/servers/administrators/sid",
          "equals": "[parameters('administratorSid')]"
        }
      },
      {
        "not": {
          "field": "Microsoft.Sql/servers/administrators/tenantId",
          "equals": "[subscription().tenantId]"
        }
      }
    ]
  },
  "then": {
    "effect": "[parameters('effect')]"
  }
}

Hard coding values for Tenant and Sid do nothing; meaning, if I set effect to Deny and I run an ARM Template, call Set-AzureRMSQLServerAzureActiveDirectoryAdministrator or manipulate the AAD Settings via the Portal, nothing happens with the policy. I don't see anything in the Activity Log on the resource group either.

Am I missing something?

[hrboyceiii]

Update: taking from the AAD Admin sample which uses an AuditIfNotExists effect, I was able to get this to trigger non-compliance state.

Desired effect would be to enable a deny to prevent the resource from entering non-compliance. Is this possible?

Here's the AuditIfNotExists policy rule for reference:

{
  "if": {
    "field": "type",
    "equals": "Microsoft.Sql/servers"
  },
  "then": {
    "effect": "auditIfNotExists",
    "details": {
      "type": "Microsoft.Sql/servers/administrators",
      "existenceCondition": {
        "allOf": [
          {
            "not": {
              "field": "Microsoft.Sql/servers/administrators/administratorType",
              "equals": "ActiveDirectory"
            }
          },
          {
            "not": {
              "field": "Microsoft.Sql/servers/administrators/login",
              "exists": true
            }
          },
          {
            "not": {
              "field": "Microsoft.Sql/servers/administrators/sid",
              "equals": "[parameters('administratorSid')]"
            }
          },
          {
            "not": {
              "field": "Microsoft.Sql/servers/administrators/tenantId",
              "equals": "[subscription().tenantId]"
            }
          }
        ]
      }
    }
  }
}

[surenderssm]

@hrboyceiii I ended up visiting this item as I too wasted good number of hours in fixing one of the similar issue.

So there are two similar aliases Microsoft.Sql/servers/administrators/sid and Microsoft.Sql/servers/administrators/activeDirectory.sid.

Given your scenario, you should consider using Microsoft.Sql/servers/administrators/activeDirectory.sid instead of Microsoft.Sql/servers/administrators/sid

Following policy rule worked for me (yes it rejects the requests where admin is not from a predefined list).

{
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Sql/servers/administrators"
      },
      {
        "not": {
          "field": "Microsoft.Sql/servers/administrators/activeDirectory.sid",
          "in": "[parameters('approvedIdentityObjectIds')]"
        }
      }
    ]
  },
  "then": {
    "effect": "deny"
  }
}