Policies and policy initiatives provide a simple method to enable logging at-scale via diagnostics settings for Azure Monitor. Using a policy initiative, you can turn on audit logging for all supported resources in your Azure environment.
Enable resource logs to track activities and events that take place on your resources and give you visibility and insights into any changes that occur.
Assign policies to enable resource logs and to send them to destinations according to your needs. Send logs to event hubs for third-party SIEM systems, enabling continuous security operations. Send logs to storage accounts for longer term storage or the fulfillment of regulatory compliance.
A set of built-in policies and initiatives exists to direct resource logs to Log Analytics Workspaces, Event Hubs, and Storage Accounts. The policies enable audit logging, sending logs belonging to the audit log category group to an event hub, Log Analytics workspace or Storage Account. The policies' effect is DeployIfNotExists, which deploys the policy as a default if there aren't other settings defined.
Deploy policies.
Deploy the policies and initiatives using the Portal, CLI, PowerShell, or Azure Resource Management templates
To apply a policy using the PowerShell, use the following commands:
Set up your environment.
Select your subscription and set your resource group
Select-AzSubscription <subscriptionID>
$rg = Get-AzResourceGroup -Name <resource groups name>
Get the policy definition and configure the parameters for the policy. In the example below we assign the policy to send keyVault logs to a Log Analytics workspace
The policy is visible in the resources' diagnostic settings after approximately 30 minutes.
Remediation tasks
Policies are applied to new resources when they're created. To apply a policy to existing resources, create a remediation task. Remediation tasks bring resources into compliance with a policy.
Remediation tasks act for specific policies. For initiatives that contain multiple policies, create a remediation task for each policy in the initiative where you have resources that you want to bring into compliance.
Define remediation tasks when you first assign the policy, or at any stage after assignment.
To create a remediation task for policies during the policy assignment, select the Remediation tab on Assign policy page and select the Create remediation task checkbox.
To create a remediation task after the policy has been assigned, select your assigned policy from the list on the Policy Assignments page.
Select Remediate.
Track the status of your remediation task in the Remediation tasks tab of the Policy Remediation page.
From the policy Definitions page, select your scope.
Select Initiative in the Definition type dropdown.
Select Monitoring in the Category dropdown.
Enter audit in the Search field.
Select thee Enable audit category group resource logging for supported resources to Log Analytics initiative.
On the following page, select Assign
On the Basics tab of the Assign initiative page, select a Scope that you want the initiative to apply to.
Enter a name in the Assignment name field.
Select the Parameters tab.
The Parameters contains the parameters defined in the policy. In this case, we need to select the Log Analytics workspace that we want to send the logs to. For more information in the individual parameters for each policy, see Policy-specific parameters.
Select the Log Analytics workspace to send your audit logs to.
Select Review + create then Create
To verify that your policy or initiative assignment is working, create a resource in the subscription or resource group scope that you defined in your policy assignment.
After 10 minutes, select the Diagnostics settings page for your resource.
Your diagnostic setting appears in the list with the default name setByPolicy-LogAnalytics and the workspace name that you configured in the policy.
Change the default name in the Parameters tab of the Assign initiative or policy page by unselecting the Only show parameters that need input or review checkbox.
Set up your environment variables
# Set up your environment variables.
$subscriptionId = <your subscription ID>;
$rg = Get-AzResourceGroup -Name <your resource group name>;
Select-AzSubscription $subscriptionId;
$logAnlayticsWorskspaceId=</subscriptions/$subscriptionId/resourcegroups/$rg.ResourceGroupName/providers/microsoft.operationalinsights/workspaces/<your log analytics workspace>;
Get the initiative definition. In this example, we'll use Initiative Enable audit category group resource logging for supported resources to `
Log Analytics, ResourceID "/providers/Microsoft.Authorization/policySetDefinitions/f5b29bc4-feca-4cc6-a58a-772dd5e290a5"
Create remediation tasks for the policies in the initiative.
Remediation tasks are created per-policy. Each task is for a specific definition-reference-id, specified in the initiative as policyDefinitionReferenceId. To find the definition-reference-id parameter, use the following command:
az policy set-definition show --name f5b29bc4-feca-4cc6-a58a-772dd5e290a5 |grep policyDefinitionReferenceId
To create a remediation task for all of the policies in the initiative, use the following example:
for policyDefinitionReferenceId in $(az policy set-definition show --name f5b29bc4-feca-4cc6-a58a-772dd5e290a5 |grep policyDefinitionReferenceId |cut -d":" -f2|sed s/\"//g)
do
az policy remediation create --resource-group "cli-example-01" --policy-assignment assign-cli-example-01 --name remediate-$policyDefinitionReferenceId --definition-reference-id $policyDefinitionReferenceId;
done
Common parameters
The following table describes the common parameters for each set of policies.
Parameter
Description
Valid Values
Default
effect
Enable or disable the execution of the policy
DeployIfNotExists, AuditIfNotExists, Disabled
DeployIfNotExists
diagnosticSettingName
Diagnostic Setting Name
setByPolicy-LogAnalytics
categoryGroup
Diagnostic category group
none, audit, allLogs
audit
Policy-specific parameters
Log Analytics policy parameters
This policy deploys a diagnostic setting using a category group to route logs to a Log Analytics workspace.
Parameter
Description
Valid Values
Default
resourceLocationList
Resource Location List to send logs to nearby Log Analytics. "*" selects all locations
Supported locations
*
logAnalytics
Log Analytics Workspace
Event Hubs policy parameters
This policy deploys a diagnostic setting using a category group to route logs to an event hub.
Parameter
Description
Valid Values
Default
resourceLocation
Resource Location must be the same location as the event hub Namespace
Supported locations
eventHubAuthorizationRuleId
Event hub Authorization Rule ID. The authorization rule is at event hub namespace level. For example, /subscriptions/{subscription ID}/resourceGroups/{resource group}/providers/Microsoft.EventHub/namespaces/{Event Hub namespace}/authorizationrules/{authorization rule}
eventHubName
Event hub name
Monitoring
Storage Accounts policy parameters
This policy deploys a diagnostic setting using a category group to route logs to a Storage Account.
Parameter
Description
Valid Values
Default
resourceLocation
Resource Location must be in the same location as the Storage Account
Supported locations
storageAccount
Storage Account resourceId
Supported Resources
Built-in Audit logs policies for Log Analytics workspaces, Event Hubs, and Storage Accounts exist for the following resources:
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
