Policy to deny VM & VMSS creation with installing the Entra ID (formerly AAD) extension on them

Virender Rathore 0

Can we have a custom policy to deny VM & VMSS creation with installing the Entra ID (formerly AAD) extension on them, Also I there a way to auto remediate and install VM extention for Entra ID (formerly AAD) extension on linux and windows VMs

Virender Rathore 0 Reputation points

2024-10-28T10:10:18.0433333+00:00

Thanks, Stanislav Zhelyazkov, my goal is to develop a custom policy for Auto Prevention if the Entra ID (formerly AAD) extension is not deployed to the Linux/Windows VM.

That means it will restrict the creation of VMs.

Second, the Auto Remediation policy, if the policy finds the VM without Entra ID extensions installed It will install and remediate those.

How can we achieve this with the policies? Would be great if you suggest both policies to me.

1 answer

Stanislav Zhelyazkov 25,326 MVP

Hi,

You can deny the installation of specific VM extension as the Entra ID extension via policy: Windows and Linux. Note that when you apply the policy you also will not be able to create those extensions. This is due to Azure Policy sits on the ARM layer and policies apply to anyone doing changes no matter if it is from Portal, CLI, PowerShell, etc. or whatever account it has. In order to remediate them manually you will have to first create exclusions, install the extension and at the end either leave the exclusions or remove them. Overall it is unclear what you want to achieve exactly. It is unusual to want something to be blocked so it can be applied later.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Virender Rathore 0 Reputation points

2024-10-25T07:07:28.1233333+00:00

Thanks, Stanislav Zhelyazkov, my goal is to develop a custom policy for Auto Prevention if the Entra ID (formerly AAD) extension is not deployed to the Linux/Windows VM.

That means it will restrict the creation of VMs.

Second, the Auto Remediation policy, if the policy finds the VM without Entra ID extensions installed It will install and remediate those.

How can we achieve this with the policies? Would be great if you suggest both policies to me.
Ashok Gandhi Kotnana 1,585 Reputation points Microsoft Vendor

2024-11-13T10:42:25.7+00:00

Hi @Virender Rathore ,

I am exploring possible solutions for this requirement and am currently replicating these scenarios in my environment. I’ll keep you updated on the results

Stanislav Zhelyazkov 25,326 MVP

It is not possible to create policy that will prevent VM creation if the extension is not installed. This is due to extensions are separate resource that is not part of the VMs resource so you can audit the extensions only post creation. For scale sets it is a little bit different and I think it should be possible via policy like this:

{
    "displayName": "",
    "mode": "All",
    "parameters": {
        "effect": {
            "type": "String",
            "metadata": {
                "displayName": "Effect",
                "description": "Enable or disable the execution of the policy"
            },
            "allowedValues": [
                "Deny",
                "Audit",
                "Disabled"
            ],
            "defaultValue": "Audit"
        }
    },
    "policyRule": {
        "if": {
            "anyOf": [
                {
                    "allOf": [
                        {
                            "field": "type",
                            "equals": "Microsoft.Compute/virtualMachineScaleSets/extensions"
                        },
                        {
                            "field": "Microsoft.Compute/virtualMachineScaleSets/virtualMachineProfile.storageProfile.osDisk.osType",
                            "like": "Windows*" // Linux - Linux*
                        },
                        {
                            "field": "Microsoft.Compute/virtualMachineScaleSets/extensions/publisher",
                            "notEquals": "Microsoft.Azure.ActiveDirectory" // Linux - Microsoft.Azure.ActiveDirectory.LinuxSSH
                        },
                        {
                            "field": "Microsoft.Compute/virtualMachineScaleSets/extensions/type",
                            "notEquals": "AADLoginForWindows" // Linux - AADLoginForLinux
                        }
                    ]
                },
                {
                    "allOf": [
                        {
                            "field": "type",
                            "equals": "Microsoft.Compute/virtualMachineScaleSets"
                        },
                        {
                            "field": "Microsoft.Compute/virtualMachineScaleSets/virtualMachineProfile.storageProfile.osDisk.osType",
                            "like": "Windows*" // Linux - Linux*
                        },
                        {
                            "count": {
                                "field": "Microsoft.Compute/VirtualMachineScaleSets/extensionProfile.extensions[*]",
                                "where": {
                                    "field": "Microsoft.Compute/VirtualMachineScaleSets/extensionProfile.extensions[*].type",
                                    "equals": "AADLoginForWindows" // Linux - AADLoginForLinux
                                }
                            },
                            "equals": 1
                        }
                    ]
                }
            ]
        },
        "then": {
            "effect": "[parameters('effect')]"
        }
    }
}

Note that I have included what values to change to create another policy for Linux Scale sets.

For installing/remediating the extension if not present you can use this policy as base: https://www.azadvertizer.net/azpolicyadvertizer/56a3e4f8-649b-4fac-887e-5564d11e8d3a.html

Example:

{
    "displayName": "",
    "mode": "Indexed",
    "parameters": {
        "effect": {
            "type": "String",
            "metadata": {
                "displayName": "Effect",
                "description": "Enable or disable the execution of the policy."
            },
            "allowedValues": [
                "DeployIfNotExists",
                "Disabled"
            ],
            "defaultValue": "DeployIfNotExists"
        }
    },
    "policyRule": {
        "if": {
            "allOf": [
                {
                    "field": "type",
                    "equals": "Microsoft.Compute/virtualMachineScaleSets"
                },
                {
                    "field": "Microsoft.Compute/virtualMachineScaleSets/virtualMachineProfile.storageProfile.osDisk.osType",
                    "like": "Windows*" // Linux - Linux*
                }
            ]
        },
        "then": {
            "effect": "[parameters('effect')]",
            "details": {
                "type": "Microsoft.Compute/virtualMachineScaleSets/extensions",
                "roleDefinitionIds": [
                    "/providers/microsoft.authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c"
                ],
                "existenceCondition": {
                    "allOf": [
                        {
                            "field": "Microsoft.Compute/virtualMachineScaleSets/extensions/type",
                            "equals": "AADLoginForWindows" // Linux - AADLoginForLinux
                        },
                        {
                            "field": "Microsoft.Compute/virtualMachineScaleSets/extensions/publisher",
                            "equals": "Microsoft.Azure.ActiveDirectory" // Linux - Microsoft.Azure.ActiveDirectory.LinuxSSH
                        },
                        {
                            "field": "Microsoft.Compute/virtualMachineScaleSets/extensions/provisioningState",
                            "equals": "Succeeded"
                        }
                    ]
                },
                "deployment": {
                    "properties": {
                        "mode": "incremental",
                        "template": {
                            "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                            "contentVersion": "1.0.0.0",
                            "parameters": {
                                "vmName": {
                                    "type": "string"
                                },
                                "location": {
                                    "type": "string"
                                }
                            },
                            "variables": {
                                "extensionName": "AADLoginForWindows", // Linux - AADLoginForLinux
                                "extensionPublisher": "Microsoft.Azure.ActiveDirectory", // Linux - Microsoft.Azure.ActiveDirectory.LinuxSSH
                                "extensionTypeHandlerVersion": "2.2", // Linux - 1.0
                                "extensionType": "AADLoginForWindows" // Linux - AADLoginForLinux
                            },
                            "resources": [
                                {
                                    "name": "[concat(parameters('vmName'), '/', variables('extensionName'))]",
                                    "type": "Microsoft.Compute/virtualMachineScaleSets/extensions",
                                    "location": "[parameters('location')]",
                                    "apiVersion": "2019-07-01",
                                    "properties": {
                                        "publisher": "[variables('extensionPublisher')]",
                                        "type": "[variables('extensionType')]",
                                        "typeHandlerVersion": "[variables('extensionTypeHandlerVersion')]",
                                        "autoUpgradeMinorVersion": true
                                    }
                                }
                            ]
                        },
                        "parameters": {
                            "vmName": {
                                "value": "[field('name')]"
                            },
                            "location": {
                                "value": "[field('location')]"
                            }
                        }
                    }
                }
            }
        }
    }
}

For VMs it is similar:


{
    "displayName": "",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "parameters": {
        "effect": {
            "type": "String",
            "metadata": {
                "displayName": "Effect",
                "description": "Enable or disable the execution of the policy."
            },
            "allowedValues": [
                "DeployIfNotExists",
                "Disabled"
            ],
            "defaultValue": "DeployIfNotExists"
        }
    },
    "policyRule": {
        "if": {
            "allOf": [
                {
                    "field": "type",
                    "equals": "Microsoft.Compute/virtualMachines"
                },
                {
                    "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
                    "like": "Windows*" // Linux - Linux*
                }
            ]
        },
        "then": {
            "effect": "[parameters('effect')]",
            "details": {
                "type": "Microsoft.Compute/virtualMachines/extensions",
                "roleDefinitionIds": [
                    "/providers/microsoft.authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c"
                ],
                "existenceCondition": {
                    "allOf": [
                        {
                            "field": "Microsoft.Compute/virtualMachines/extensions/type",
                            "equals": "AADLoginForWindows" // Linux - AADLoginForLinux
                        },
                        {
                            "field": "Microsoft.Compute/virtualMachines/extensions/publisher",
                            "equals": "Microsoft.Azure.ActiveDirectory" // Linux - Microsoft.Azure.ActiveDirectory.LinuxSSH
                        },
                        {
                            "field": "Microsoft.Compute/virtualMachines/extensions/provisioningState",
                            "equals": "Succeeded"
                        }
                    ]
                },
                "deployment": {
                    "properties": {
                        "mode": "incremental",
                        "template": {
                            "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                            "contentVersion": "1.0.0.0",
                            "parameters": {
                                "vmName": {
                                    "type": "string"
                                },
                                "location": {
                                    "type": "string"
                                }
                            },
                            "variables": {
                                "extensionName": "AADLoginForWindows", // Linux - AADLoginForLinux
                                "extensionPublisher": "Microsoft.Azure.ActiveDirectory", // Linux - Microsoft.Azure.ActiveDirectory.LinuxSSH
                                "extensionTypeHandlerVersion": "2.2", // Linux - 1.0
                                "extensionType": "AADLoginForWindows" // Linux - AADLoginForLinux
                            },
                            "resources": [
                                {
                                    "name": "[concat(parameters('vmName'), '/', variables('extensionName'))]",
                                    "type": "Microsoft.Compute/virtualMachines/extensions",
                                    "location": "[parameters('location')]",
                                    "apiVersion": "2019-07-01",
                                    "properties": {
                                        "publisher": "[variables('extensionPublisher')]",
                                        "type": "[variables('extensionType')]",
                                        "typeHandlerVersion": "[variables('extensionTypeHandlerVersion')]",
                                        "autoUpgradeMinorVersion": true
                                    }
                                }
                            ]
                        },
                        "parameters": {
                            "vmName": {
                                "value": "[field('name')]"
                            },
                            "location": {
                                "value": "[field('location')]"
                            }
                        }
                    }
                }
            }
        }
    }
}

Ashok Gandhi Kotnana 1,585 Reputation points Microsoft Vendor

2024-12-06T10:51:00.68+00:00

Summarizing from the discussion (above). @Virender Rathore , Thanks for posting the question with the community.

Issue: Policy to deny VM & VMSS creation with installing the Entra ID (formerly AAD) extension on them

Error: Policy to deny VM & VMSS

Solution: specific the property you mentioned is not available in the VM resource payload. Due to this limitation, currently unable to create the desired policy for VM, for scale set we have provided the possible sample template how it works

Since the Microsoft Q&A community has a policy that the question author cannot accept their own answer. They can only accept answers by others, I' have summarized and posted the solution/answer to benefit the community users to find the answers quickly.
Ashok Gandhi Kotnana 1,585 Reputation points Microsoft Vendor

2024-12-11T11:44:35.6633333+00:00

Hi Virender Rathore,
Just want to check if the above solution provided by @Stanislav Zhelyazkov worked for you or else please let us know if any help, we are always here to help whenever you need us.
Ashok Gandhi Kotnana 1,585 Reputation points Microsoft Vendor

2024-12-13T06:54:49.59+00:00

Hi Virender Rathore,

Wanted to re check if the above solution provided by @Stanislav Zhelyazkov worked for you or else please let us know if any help, we are always here to help whenever you need us.

Share via

Policy to deny VM & VMSS creation with installing the Entra ID (formerly AAD) extension on them

1 answer

Your answer