Azure Policy for VM Applications (extensions + Applications)

Question

Hello All,

I am planning to use Azure policy for installing 3rd party tools in VMs. (VM Applications).

can some one suggest the Azure policy to use VM applications. thanks

Answer 1

Hello, @Naresh Babu !

What Azure Policy should I use with VM Applications for installing a particular application on my VM?

You can use the Azure Policy deployIfNotExists. There's an Azure Dev Blog that goes into this in detail, including policy templates, explanations, and pitfalls:

https://devblogs.microsoft.com/azure-vm-runtime/managing-vm-applications-with-azure-policies/

Summary:

{
  "properties": {
    "displayName": "Ensure Snoopy",
    "policyType": "Custom",
    "mode": "All",
    "parameters": {},
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Compute/virtualMachines"
          },
          {
            "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
            "equals": "Windows"
          }
        ]
      },
      "then": {
        "effect": "deployIfNotExists",
        "details": {
          "type": "Microsoft.Compute/virtualMachines",
          "name": "[field('name')]",
          "existenceCondition": {
            "allOf": [
              {
                "count": {
                  "field": "Microsoft.Compute/virtualMachines/applicationProfile.galleryApplications[*]",
                  "where": {
                    "field": "Microsoft.Compute/virtualMachines/applicationProfile.galleryApplications[*].packageReferenceId",
                    "equals": "/subscriptions/6C87EEF9-845B-4460-A87F-03416E2C466C/resourceGroups/policytest/providers/Microsoft.Compute/galleries/MyFirstGallery/applications/Snoopy/versions/1.0.0"
                  }
                },
                "greater": 0
              }
            ]
          },
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635"
          ],
          "deployment": {
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "vmName": {
                    "type": "string"
                  },
                  "location": {
                    "type": "string"
                  }
                },
                "resources": [
                  {
                    "apiVersion": "2021-07-01",
                    "type": "Microsoft.Compute/virtualMachines/VMapplications",
                    "name": "[concat(parameters('vmName'),'/Snoopy')]",
                    "location": "[parameters('location')]",
                    "properties": {
                      "packageReferenceId": "/subscriptions/6C87EEF9-845B-4460-A87F-03416E2C466C/resourceGroups/policytest/providers/Microsoft.Compute/galleries/MyFirstGallery/applications/Snoopy/versions/1.0.0"
                    }
                  }
                ]
              },
              "parameters": {
                "vmName": {
                  "value": "[field('name')]"
                },
                "location": {
                  "value": "[field('location')]"
                }
              }
            }
          }
        }
      }
    }
  }
}

• New application ("Snoopy, v 1.0.0)
• Run on Windows VMs
• Provide the resourceId of the VM Application you want to install
• roleDefinitionId provided for full access

---

I hope this has been helpful! Your feedback is important so please take a moment to accept answers.

If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!