sql-server-samples/samples/manage/azure-arc-enabled-sql-server/compliance/README.md

Paygo-SQLArc (Windows only)

This Azure Policy ensures that all SQL Arc servers using LicenseType = Paid are marked as non-compliant. Servers with LicenseType = LicenseOnly are treated as compliant. The remediation task sets LicenseType = PAYG.

Use Azure CLI or PowerShell to create the policy definition:

Artifacts

• policy.json: Main policy definition referencing external parameter and rule files.
• params.json: Defines policy parameters.
• rules.json: Contains the policy rule logic.

Create policy

Use the following command to create policy

#!/bin/bash

az policy definition create \
  --name "Paygo-SQLArc" \
  --display-name "Paygo-SQLArc" \
  --description "This Azure Policy ensures that all SQL Arc servers using LicenseType = Paid are marked as non-compliant. Servers with LicenseType = LicenseOnly are treated as compliant. The remediation task sets LicenseType = PAYG." \
  --rules @rules.json \
  --params @params.json \
  --mode Indexed \
  --subscription "<your-subscription-id>"\

Assign policy

Use the following command to assign policy

#!/bin/bash

# Set variables
SUB_ID="<your-subscription-id>"
RG_NAME="<your-resoure-group>" # optional
SCOPE="/subscriptions/$SUB_ID/resourceGroups/$RG_NAME"
LOCATION="<your-azure-region>"

# Create policy assignment
az policy assignment create \
  --name "Paygo-SQLArc-Assign" \
  --policy "Paygo-SQLArc" \
  --scope "$SCOPE" \
  --params '{ "effect": { "value": "DeployIfNotExists" } }' \
  --mi-system-assigned \
  --role "Contributor" \
  --identity-scope "$SCOPE" \
  --location "$LOCATION"

Create remediation task

Us the following command to create a remediation task

#!/bin/bash

RG_NAME="<your-resoure-group>"

az policy remediation create \
  --name "Remediate-Paygo-SQLArc" \
  --policy-assignment "Paygo-SQLArc-Assign" \
  --resource-group "$RG_NAME" \
  --resource-discovery-mode ReEvaluateCompliance