Set-AzureRmSqlServerAuditingPolicy
Changes the auditing policy of a SQL Database server.
Caution
Because Az PowerShell modules now have all the capabilities of AzureRM PowerShell modules and more, we'll retire AzureRM PowerShell modules on 29 February 2024.
To avoid service interruptions, update your scripts that use AzureRM PowerShell modules to use Az PowerShell modules by 29 February 2024. To automatically update your scripts, follow the quickstart guide.
Syntax
Set-AzureRmSqlServerAuditingPolicy
[-AuditType <AuditType>]
[-AuditActionGroup <AuditActionGroups[]>]
[-PassThru]
[-EventType <String[]>]
[-StorageAccountName <String>]
[-StorageKeyType <String>]
[-RetentionInDays <UInt32>]
[-TableIdentifier <String>]
-ServerName <String>
[-ResourceGroupName] <String>
[-DefaultProfile <IAzureContextContainer>]
[-WhatIf]
[-Confirm]
[<CommonParameters>] Description
The Set-AzureRmSqlServerAuditingPolicy cmdlet changes the auditing policy of an Azure SQL Database server. Specify the ResourceGroupName and ServerName parameters to identify the server, the StorageAccountName parameter to specify the storage account for the audit logs, and the StorageKeyType parameter to define the storage keys to use. You can also define retention for the audit logs table by setting the value of the RetentionInDays and TableIdentifier parameters to define the period and the seed for the audit log table names. Specify the EventType parameter to define which event types to audit. After you run this cmdlet, auditing of the databases that use the policy of this server is enabled. If the cmdlet succeeds and you specify the PassThru parameter, the cmdlet returns an object that describes the current auditing policy, and the server identifiers. Server identifiers include ResourceGroupName and ServerName.
Examples
Example 1: Set the auditing policy of an Azure SQL server use Table auditing
PS C:\>Set-AzureRmSqlServerAuditingPolicy -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -AuditType Table -StorageAccountName "Storage22"This command sets the auditing policy of the server named Server01 to use a storage account named Storage22.
Example 2: Set the storage account key of an existing auditing policy of an Azure SQL server
PS C:\>Set-AzureRmSqlServerAuditingPolicy -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -StorageAccountKey SecondaryThis command sets the auditing policy of the server named Server01 to use the secondary key. The command does not modify the storage account name.
Example 3: Set the auditing policy of an Azure SQL server to use a specific event type
PS C:\>Set-AzureRmSqlServerAuditingPolicy -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -EventType Login_FailureExample 4: Set the auditing policy of a database to use Blob auditing
PS C:\>Set-AzureRmSqlDatabaseAuditingPolicy -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -AuditType Blob -StorageAccountName "Storage31" -AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP" -RetentionInDays 8This command sets the auditing policy of the server named Server01 to use the Login_Failure event type. This command does not modify any other setting.
Parameters
-AuditActionGroup
Specify one or more audit action groups. This parameter is only applicable to Blob auditing.
| Type: | AuditActionGroups[] |
| Accepted values: | BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, AUDIT_CHANGE_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-AuditType
Specify the audit type. Audit logs can be written to Table storage or Blob storage. Blob auditing provides higher performance and supports object-level auditing.
| Type: | AuditType |
| Accepted values: | NotSet, Table, Blob |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-Confirm
Prompts you for confirmation before running the cmdlet.
| Type: | SwitchParameter |
| Aliases: | cf |
| Position: | Named |
| Default value: | False |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DefaultProfile
The credentials, account, tenant, and subscription used for communication with azure
| Type: | IAzureContextContainer |
| Aliases: | AzureRmContext, AzureCredential |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EventType
Specifies the event types to audit. This parameter is only applicable to Table auditing. You can specify several event types. You can specify All to audit all of the event types or None to specify that no events will be audited. If you specify All or None at the same time, the command fails.
| Type: | String[] |
| Accepted values: | PlainSQL_Success, PlainSQL_Failure, ParameterizedSQL_Success, ParameterizedSQL_Failure, StoredProcedure_Success, StoredProcedure_Failure, Login_Success, Login_Failure, TransactionManagement_Success, TransactionManagement_Failure, All, None |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-PassThru
Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ResourceGroupName
Specifies the name of the resource group that contains the database.
| Type: | String |
| Position: | 0 |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-RetentionInDays
Specifies the number of retention days for the audit logs table. A value of zero (0) means that the table is not retained. this is the default. If you specify a value greater than zero, you must also specify a value for the TableIdentifer parameter.
| Type: | Nullable<T>[UInt32] |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-ServerName
Specifies the name of the server that contains the database.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-StorageAccountName
Specifies the name of the storage account for auditing the database. Wildcard characters are not permitted. If you do not specify this parameter, the cmdlet uses the storage account that was defined previously as part of the auditing policy of the database. If this is the first time a database auditing policy is defined and you do not specify this parameter, the command fails.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-StorageKeyType
Specifies which of the storage access keys to use. The acceptable values for this parameter are:
- Primary
- Secondary The default value is Primary.
| Type: | String |
| Accepted values: | Primary, Secondary |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-TableIdentifier
Specifies the name of the audit logs table. Specify this value if you specify a value greater than zero for the RetentionInDays parameter.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | True |
| Accept wildcard characters: | False |
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
| Type: | SwitchParameter |
| Aliases: | wi |
| Position: | Named |
| Default value: | False |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Inputs
String[]
Nullable<T>[[System.UInt32, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]