Skip to content

Commit 24ae46a

Browse files
Springstonegithub-actions[bot]
Springstone
and
github-actions[bot]
authored
Sentinel Deployment Fix (#1709)
Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 7b7ff1d commit 24ae46a

File tree

5 files changed

+58
-413
lines changed

5 files changed

+58
-413
lines changed

‎docs/wiki/Whats-new.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
## In this Section
22

33
- [Updates](#updates)
4+
- [August 2024](#august-2024)
45
- [July 2024](#july-2024)
56
- [June 2024](#june-2024)
67
- [🆕 AMA Updates](#-ama-updates)
@@ -47,6 +48,14 @@ This article will be updated as and when changes are made to the above and anyth
4748

4849
Here's what's changed in Enterprise Scale/Azure Landing Zones:
4950

51+
### August 2024
52+
53+
#### Other
54+
55+
- Cleaned up the Log Analytics "solutions" in portal ARM template, as these are no longer required and deployed by ALZ.
56+
- Re-introduced the option to enable "Sentinel" in the portal accelerator.
57+
- Updated Microsoft Sentinel onboarding (enablement) using the new mechanism that fixes issues after 1 July 2024. Microsoft Sentinel is enabled by default through the portal accelerator as a best practice - we do not however configure any data connectors, we only enable the service. Should you wish to remove this, you can delete the association from the Azure Portal after deployment from the "Sentinel" feature blade.
58+
5059
### July 2024
5160

5261
#### Policy

‎eslzArm/eslz-portal.json

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -439,6 +439,26 @@
439439
"style": "Info"
440440
}
441441
},
442+
{
443+
"name": "enableSentinel",
444+
"type": "Microsoft.Common.OptionsGroup",
445+
"label": "Deploy Microsoft Sentinel (configuration required to activate)",
446+
"defaultValue": "Yes (recommended)",
447+
"toolTip": "If 'Yes' is selected Sentinel will be enabled on the Log Analytics workspace. Note additional configuration is required to complete Sentinel onboarding.",
448+
"constraints": {
449+
"allowedValues": [
450+
{
451+
"label": "Yes (recommended)",
452+
"value": "Yes"
453+
},
454+
{
455+
"label": "No",
456+
"value": "No"
457+
}
458+
]
459+
},
460+
"visible": true
461+
},
442462
{
443463
"name": "esMgmtSubSection",
444464
"type": "Microsoft.Common.Section",
@@ -8972,6 +8992,7 @@
89728992
"enableUpdateMgmt": "[steps('management').enableUpdateMgmt]",
89738993
"enableVmInsights": "[steps('management').enableVmInsights]",
89748994
"retentionInDays": "[string(steps('management').retentionInDays)]",
8995+
"enableSentinel": "[steps('management').enableSentinel]",
89758996
"managementSubscriptionId": "[steps('management').esMgmtSubSection.esMgmtSub]",
89768997
"enableAsc": "[steps('management').enableAsc]",
89778998
"emailContactAsc": "[steps('management').emailContactAsc]",

‎eslzArm/eslzArm.json

Lines changed: 10 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,10 @@
4040
"type": "string",
4141
"defaultValue": ""
4242
},
43+
"enableSentinel": {
44+
"type": "string",
45+
"defaultValue": "Yes"
46+
},
4347
"managementSubscriptionId": {
4448
"type": "string",
4549
"defaultValue": "",
@@ -203,14 +207,6 @@
203207
],
204208
"defaultValue": "Disabled"
205209
},
206-
"enableSecuritySolution": {
207-
"type": "string",
208-
"defaultValue": "Yes",
209-
"allowedValues": [
210-
"Yes",
211-
"No"
212-
]
213-
},
214210
"enableMonitorBaselines": {
215211
"type": "string",
216212
"defaultValue": "",
@@ -1596,7 +1592,6 @@
15961592
"resourceGroup": "[uri(deployment().properties.templateLink.uri, 'subscriptionTemplates/resourceGroup.json')]",
15971593
"ddosProtection": "[uri(deployment().properties.templateLink.uri, 'resourceGroupTemplates/ddosProtection.json')]",
15981594
"logAnalyticsPolicyAssignment": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/DINE-LogAnalyticsPolicyAssignment.json')]",
1599-
"monitoringSolutions": "[uri(deployment().properties.templateLink.uri, 'subscriptionTemplates/logAnalyticsSolutions.json')]",
16001595
"asbPolicyInitiative": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/DINE-ASBPolicyAssignment.json')]",
16011596
"regulatoryComplianceInitaitves": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/ENFORCE-RegulatoryCompliancePolicyAssignment.json')]",
16021597
"resourceDiagnosticsInitiative": "[uri(deployment().properties.templateLink.uri, 'managementGroupTemplates/policyAssignments/DINE-ResourceDiagnosticsPolicyAssignment.json')]",
@@ -1714,7 +1709,6 @@
17141709
"monitorManagementDeploymentName": "[take(concat('alz-ManagementMonitor', variables('deploymentSuffix')), 64)]",
17151710
"monitorLandingZoneDeploymentName": "[take(concat('alz-LandingZoneMonitor', variables('deploymentSuffix')), 64)]",
17161711
"monitorServiceHealthDeploymentName": "[take(concat('alz-SvcHealthMonitor', variables('deploymentSuffix')), 64)]",
1717-
"monitoringSolutionsDeploymentName": "[take(concat('alz-Solutions', variables('deploymentSuffix')), 64)]",
17181712
"asbPolicyDeploymentName": "[take(concat('alz-ASB', variables('deploymentSuffix')), 64)]",
17191713
"regulatoryComplianceInitativesToAssignDeploymentName": "[take(concat('alz-RegComp-', deployment().location, '-', uniqueString(parameters('currentDateTimeUtcNow')), '-'), 64)]",
17201714
"resourceDiagnosticsPolicyDeploymentName": "[take(concat('alz-ResourceDiagnostics', variables('deploymentSuffix')), 64)]",
@@ -1842,7 +1836,6 @@
18421836
"subnetNsgIdentityLitePolicyDeploymentName": "[take(concat('alz-SubnetNsgIdentity', variables('deploymentSuffix')), 64)]",
18431837
"monitoringLiteDeploymentName": "[take(concat('alz-MonitoringLite', variables('deploymentSuffix')), 64)]",
18441838
"logAnalyticsLitePolicyDeploymentName": "[take(concat('alz-LAPolicyLite', variables('deploymentSuffix')), 64)]",
1845-
"monitoringSolutionsLiteDeploymentName": "[take(concat('alz-SolutionsLite', variables('deploymentSuffix')), 64)]",
18461839
"platformLiteSubscriptionPlacement": "[take(concat('alz-PlatformSubLite', variables('deploymentSuffix')), 64)]",
18471840
"vnetConnectivityHubLiteDeploymentName": "[take(concat('alz-VnetHubLite', variables('deploymentSuffix')), 64)]",
18481841
"vwanConnectivityHubLiteDeploymentName": "[take(concat('alz-VWanHubLite', variables('deploymentSuffix')), 64)]",
@@ -2414,6 +2407,9 @@
24142407
},
24152408
"retentionInDays": {
24162409
"value": "[parameters('retentionInDays')]"
2410+
},
2411+
"enableSentinel": {
2412+
"value": "[parameters('enableSentinel')]"
24172413
}
24182414
}
24192415
}
@@ -2538,40 +2534,6 @@
25382534
}
25392535
}
25402536
},
2541-
{
2542-
// Deploying Sentinel to Log Analytics workspace if condition is true
2543-
"condition": "[and(equals(parameters('enableLogAnalytics'), 'Yes'), not(empty(parameters('managementSubscriptionId'))), equals(parameters('enableSecuritySolution'), 'Yes'))]",
2544-
"type": "Microsoft.Resources/deployments",
2545-
"apiVersion": "2020-10-01",
2546-
"name": "[variables('deploymentNames').monitoringSolutionsDeploymentName]",
2547-
"location": "[deployment().location]",
2548-
"subscriptionId": "[parameters('managementSubscriptionId')]",
2549-
"dependsOn": [
2550-
"[resourceId('Microsoft.Resources/deployments', variables('deploymentNames').monitoringDeploymentName)]",
2551-
"policyCompletion"
2552-
],
2553-
"properties": {
2554-
"mode": "Incremental",
2555-
"templateLink": {
2556-
"contentVersion": "1.0.0.0",
2557-
"uri": "[variables('deploymentUris').monitoringSolutions]"
2558-
},
2559-
"parameters": {
2560-
"rgName": {
2561-
"value": "[variables('platformRgNames').mgmtRg]"
2562-
},
2563-
"workspaceName": {
2564-
"value": "[variables('platformResourceNames').logAnalyticsWorkspace]"
2565-
},
2566-
"workspaceRegion": {
2567-
"value": "[deployment().location]"
2568-
},
2569-
"enableSecuritySolution": {
2570-
"value": "[parameters('enableSecuritySolution')]"
2571-
}
2572-
}
2573-
}
2574-
},
25752537
{
25762538
// Assigning Log Analytics workspace policy to management management group if condition is true
25772539
"condition": "[and(equals(parameters('enableLogAnalytics'), 'Yes'), not(empty(parameters('managementSubscriptionId'))))]",
@@ -7544,6 +7506,9 @@
75447506
},
75457507
"retentionInDays": {
75467508
"value": "[parameters('retentionInDays')]"
7509+
},
7510+
"enableSentinel": {
7511+
"value": "[parameters('enableSentinel')]"
75477512
}
75487513
}
75497514
}
@@ -7581,43 +7546,6 @@
75817546
}
75827547
}
75837548
},
7584-
/*
7585-
Note: ES Lite only: the following deployments will deploy Sentinel to the platform subscription
7586-
*/
7587-
{
7588-
// Deploying Sentinel to the Log Analytics workspace if condition is true
7589-
"condition": "[and(equals(parameters('enableLogAnalytics'), 'Yes'), not(empty(parameters('singlePlatformSubscriptionId'))), equals(parameters('enableSecuritySolution'), 'Yes'))]",
7590-
"type": "Microsoft.Resources/deployments",
7591-
"apiVersion": "2020-10-01",
7592-
"name": "[variables('esLiteDeploymentNames').monitoringSolutionsLiteDeploymentName]",
7593-
"location": "[deployment().location]",
7594-
"subscriptionId": "[parameters('singlePlatformSubscriptionId')]",
7595-
"dependsOn": [
7596-
"[resourceId('Microsoft.Resources/deployments', variables('esLiteDeploymentNames').monitoringLiteDeploymentName)]",
7597-
"policyCompletion"
7598-
],
7599-
"properties": {
7600-
"mode": "Incremental",
7601-
"templateLink": {
7602-
"contentVersion": "1.0.0.0",
7603-
"uri": "[variables('deploymentUris').monitoringSolutions]"
7604-
},
7605-
"parameters": {
7606-
"rgName": {
7607-
"value": "[variables('platformRgNames').mgmtRg]"
7608-
},
7609-
"workspaceName": {
7610-
"value": "[variables('platformResourceNames').logAnalyticsWorkspace]"
7611-
},
7612-
"workspaceRegion": {
7613-
"value": "[deployment().location]"
7614-
},
7615-
"enableSecuritySolution": {
7616-
"value": "[parameters('enableSecuritySolution')]"
7617-
}
7618-
}
7619-
}
7620-
},
76217549
/*
76227550
Note: ES Lite only: deploy Log Analytics workspace policy to the platform management group
76237551
*/

0 commit comments

Comments
 (0)