sql-server-samples/samples/manage/azure-arc-enabled-sql-server/compliance/README.md

# Paygo-SQLArc (Windows only)

This Azure Policy ensures that all SQL Arc servers using `LicenseType = Paid` are marked as non-compliant. Servers with `LicenseType = LicenseOnly` are treated as compliant. The remediation task sets `LicenseType = PAYG`.

Use Azure CLI or PowerShell to create the policy definition:

## Artifacts

- **policy.json**: Main policy definition referencing external parameter and rule files.
- **params.json**: Defines policy parameters.
- **rules.json**: Contains the policy rule logic.

## Create policy
Use the following command to create policy

```bash

#!/bin/bash

az policy definition create \
  --name "Paygo-SQLArc" \
  --display-name "Paygo-SQLArc" \
  --description "This Azure Policy ensures that all SQL Arc servers using LicenseType = Paid are marked as non-compliant. Servers with LicenseType = LicenseOnly are treated as compliant. The remediation task sets LicenseType = PAYG." \
  --rules @rules.json \
  --params @params.json \
  --mode Indexed \
  --subscription "<your-subscription-id>"\
```

## Assign policy

Use the following command to assign policy

```bash
#!/bin/bash

# Set variables
SUB_ID="<your-subscription-id>"
RG_NAME="<your-resoure-group>" # optional
SCOPE="/subscriptions/$SUB_ID/resourceGroups/$RG_NAME"
LOCATION="<your-azure-region>"

# Create policy assignment
az policy assignment create \
  --name "Paygo-SQLArc-Assign" \
  --policy "Paygo-SQLArc" \
  --scope "$SCOPE" \
  --params '{ "effect": { "value": "DeployIfNotExists" } }' \
  --mi-system-assigned \
  --role "Contributor" \
  --identity-scope "$SCOPE" \
  --location "$LOCATION"
```

## Create remediation task

Us the following command to create a remediation task

```bash
#!/bin/bash

RG_NAME="<your-resoure-group>"

az policy remediation create \
  --name "Remediate-Paygo-SQLArc" \
  --policy-assignment "Paygo-SQLArc-Assign" \
  --resource-group "$RG_NAME" \
  --resource-discovery-mode ReEvaluateCompliance
```