Update enforcement mode for Policy "Deploy-UserAssignedManagedIdentit…

…y-VMInsights" (#1567)
Azure · Feb 6, 2024 · c863db6 · c863db6
1 parent 046e49f
commit c863db6
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 2 deletions.
diff --git a/docs/wiki/Whats-new.md b/docs/wiki/Whats-new.md
@@ -44,6 +44,7 @@ Here's what's changed in Enterprise Scale/Azure Landing Zones:
 #### Tooling
 
 - Disabled a Policy in the Microsoft Defender for SQL initiative. As it is not required at this stage. See [ALZ AMA FAQ](./ALZ-AMA-FAQ) for more details.
+- Changed enforcementMode of the assignment of Policy "Deploy-UserAssignedManagedIdentity-VMInsights" to Default. This is to ensure that a Resource Group and a User Assigned Managed Identity are created on new subscriptions (subscriptions that are added after the initial deployment).
 
 ### AMA Update for the Portal Accelerator
 

diff --git a/eslzArm/eslzArm.json b/eslzArm/eslzArm.json
@@ -3054,7 +3054,7 @@
                         "value": "[parameters('enterpriseScaleCompanyPrefix')]"
                     },
                     "enforcementMode": {
-                        "value": "DoNotEnforce"
+                        "value": "Default"
                     },
                     "userAssignedManagedIdentityResourceGroup": {
                         "value": "[parameters('userAssignedIdentityResourceGroup')]"

diff --git a/...gementGroupTemplates/policyAssignments/DINE-UserAssignedIdentityVMInsightsAssignment.json b/...gementGroupTemplates/policyAssignments/DINE-UserAssignedIdentityVMInsightsAssignment.json
@@ -34,7 +34,7 @@
                 "Default",
                 "DoNotEnforce"
             ],
-            "defaultValue": "DoNotEnforce"
+            "defaultValue": "Default"
         },
         "nonComplianceMessagePlaceholder": {
             "type": "string",