Azure · jtracey93 · Feb 25, 2022 · Feb 23, 2022 · Feb 25, 2022 · Feb 25, 2022
diff --git a/infra-as-code/bicep/modules/policy/assignments/README.md b/infra-as-code/bicep/modules/policy/assignments/README.md
@@ -91,7 +91,7 @@ There are two different sets of input parameters files; one for deploying to Azu
  | China regions  | policyAssignmentManagementGroup.bicep | mc-policyAssignmentManagementGroup.parameters.example-dine.json |
 
 
-In this example, the `Deploy-ASCDF-Config` custom policy definition will be deployed/assigned to the `alz-landingzones` management group (intermediate root management group). And the managed identity associated with the policy will also be assigned to the `alz-platform` management group, as defined in the parameter file: `policyAssignmentManagementGroup.parameters.example-dine.json` or `mc-policyAssignmentManagementGroup.parameters.example-dine.json`
+In this example, the `Deploy-MDFC-Config` custom policy definition will be deployed/assigned to the `alz-landingzones` management group (intermediate root management group). And the managed identity associated with the policy will also be assigned to the `alz-platform` management group, as defined in the parameter file: `policyAssignmentManagementGroup.parameters.example-dine.json` or `mc-policyAssignmentManagementGroup.parameters.example-dine.json`
 #### Azure CLI - DINE
 
 ```bash

diff --git a/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep b/infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep
diff --git a/.../bicep/modules/policy/assignments/lib/policy_assignments/_policyAssignmentsBicepInput.txt b/.../bicep/modules/policy/assignments/lib/policy_assignments/_policyAssignmentsBicepInput.txt
@@ -78,11 +78,6 @@ var varPolicyAssignmentDeployASCMonitoring = {
 	libDefinition: json(loadTextContent('../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_asc_monitoring.tmpl.json'))
 }
 
-var varPolicyAssignmentDeployASCDFConfig = {
-	definitionID: '${modManagementGroups.outputs.outTopLevelMGId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-ASCDF-Config'
-	libDefinition: json(loadTextContent('../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_ascdf_config.tmpl.json'))
-}
-
 var varPolicyAssignmentDeployAzActivityLog = {
 	definitionID: '/providers/Microsoft.Authorization/policyDefinitions/2465583e-4e78-4c15-b6be-a36cbc7c8b0f'
 	libDefinition: json(loadTextContent('../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azactivity_log.tmpl.json'))
@@ -98,6 +93,11 @@ var varPolicyAssignmentDeployLXArcMonitoring = {
 	libDefinition: json(loadTextContent('../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_lx_arc_monitoring.tmpl.json'))
 }
 
+var varPolicyAssignmentDeployMDFCConfig = {
+	definitionID: '${modManagementGroups.outputs.outTopLevelMGId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config'
+	libDefinition: json(loadTextContent('../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_config.tmpl.json'))
+}
+
 var varPolicyAssignmentDeployPrivateDNSZones = {
 	definitionID: '${modManagementGroups.outputs.outTopLevelMGId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-Private-DNS-Zones'
 	libDefinition: json(loadTextContent('../../policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_private_dns_zones.tmpl.json'))

diff --git a/...signment_es_deploy_ascdf_config.tmpl.json → ...ssignment_es_deploy_mdfc_config.tmpl.json b/...signment_es_deploy_ascdf_config.tmpl.json → ...ssignment_es_deploy_mdfc_config.tmpl.json
@@ -1,5 +1,5 @@
 {
-  "name": "Deploy-ASCDF-Config",
+  "name": "Deploy-MDFC-Config",
   "type": "Microsoft.Authorization/policyAssignments",
   "apiVersion": "2019-09-01",
   "properties": {
@@ -50,7 +50,7 @@
         "value": "DeployIfNotExists"
       }
     },
-    "policyDefinitionId": "${modManagementGroups.outputs.outTopLevelMGId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-ASCDF-Config",
+    "policyDefinitionId": "${modManagementGroups.outputs.outTopLevelMGId}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config",
     "scope": null,
     "enforcementMode": "Default"
   },

diff --git a/...p/modules/policy/assignments/policyAssignmentManagementGroup.parameters.example-dine.json b/...p/modules/policy/assignments/policyAssignmentManagementGroup.parameters.example-dine.json
@@ -3,7 +3,7 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "parPolicyAssignmentName": {
-            "value": "Deploy-ASCDF-Config"
+            "value": "Deploy-MDFC-Config"
         },
         "parPolicyAssignmentDisplayName": {
             "value": "Deploy Microsoft Defender for Cloud configuration"
@@ -12,7 +12,7 @@
             "value": "Deploy Microsoft Defender for Cloud configuration and Security Contacts"
         },
         "parPolicyAssignmentDefinitionID": {
-            "value": "/providers/Microsoft.Management/managementGroups/alz/providers/Microsoft.Authorization/policySetDefinitions/Deploy-ASCDF-Config"
+            "value": "/providers/Microsoft.Management/managementGroups/alz/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config"
         },
         "parPolicyAssignmentParameters": {
             "value": {
@@ -29,31 +29,31 @@
                     "value": "${parDefaultRegion}"
                 },
                 "enableAscForServers": {
-                    "value": "Disabled"
+                    "value": "DeployIfNotExists"
                 },
                 "enableAscForSql": {
                     "value": "Disabled"
                 },
                 "enableAscForAppServices": {
-                    "value": "Disabled"
+                    "value": "DeployIfNotExists"
                 },
                 "enableAscForStorage": {
-                    "value": "Disabled"
+                    "value": "DeployIfNotExists"
                 },
                 "enableAscForContainers": {
-                    "value": "Disabled"
+                    "value": "DeployIfNotExists"
                 },
                 "enableAscForKeyVault": {
-                    "value": "Disabled"
+                    "value": "DeployIfNotExists"
                 },
                 "enableAscForSqlOnVm": {
                     "value": "Disabled"
                 },
                 "enableAscForArm": {
-                    "value": "Disabled"
+                    "value": "DeployIfNotExists"
                 },
                 "enableAscForDns": {
-                    "value": "Disabled"
+                    "value": "DeployIfNotExists"
                 },
                 "enableAscForOssDb": {
                     "value": "Disabled"

diff --git a/infra-as-code/bicep/modules/policy/definitions/custom-policy-definitions.bicep b/infra-as-code/bicep/modules/policy/definitions/custom-policy-definitions.bicep
@@ -2,7 +2,7 @@
 SUMMARY: This module deploys the custom Azure Policy Definitions & Initiatives supplied by the Enterprise Scale conceptual architecture and reference implementation to a specified Management Group.
 DESCRIPTION: This module deploys the custom Azure Policy Definitions & Initiatives supplied by the Enterprise Scale conceptual architecture and reference implementation defined here (https://aka.ms/enterprisescale) to a specified Management Group.
 AUTHOR/S: jtracey93
-VERSION: 1.0.0
+VERSION: 1.0.1
 */
 
 targetScope = 'managementGroup'
@@ -489,72 +489,6 @@ var varCustomPolicySetDefinitionsArray = [
       }
     ]
   }
-  {
-    name: 'Deploy-ASCDF-Config'
-    libSetDefinition: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.json'))
-    libSetChildDefinitions: [
-      {
-        definitionReferenceID: 'ascExport'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/ffb6f416-7bd2-4488-8828-56585fef2be9'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).ascExport.parameters
-      }
-      {
-        definitionReferenceID: 'defenderForAppServices'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/b40e7bcd-a1e5-47fe-b9cf-2f534d0bfb7d'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).defenderForAppServices.parameters
-      }
-      {
-        definitionReferenceID: 'defenderForArm'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/b7021b2b-08fd-4dc0-9de7-3c6ece09faf9'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).defenderForArm.parameters
-      }
-      {
-        definitionReferenceID: 'defenderforContainers'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/c9ddb292-b203-4738-aead-18e2716e858f'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).defenderforContainers.parameters
-      }
-      {
-        definitionReferenceID: 'defenderForDns'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/2370a3c1-4a25-4283-a91a-c9c1a145fb2f'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).defenderForDns.parameters
-      }
-      {
-        definitionReferenceID: 'defenderForKeyVaults'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/1f725891-01c0-420a-9059-4fa46cb770b7'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).defenderForKeyVaults.parameters
-      }
-      {
-        definitionReferenceID: 'defenderForOssDb'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/44433aa3-7ec2-4002-93ea-65c65ff0310a'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).defenderForOssDb.parameters
-      }
-      {
-        definitionReferenceID: 'defenderForSqlPaas'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/b99b73e7-074b-4089-9395-b7236f094491'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).defenderForSqlPaas.parameters
-      }
-      {
-        definitionReferenceID: 'defenderForSqlServerVirtualMachines'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/50ea7265-7d8c-429e-9a7d-ca1f410191c3'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).defenderForSqlServerVirtualMachines.parameters
-      }
-      {
-        definitionReferenceID: 'defenderForStorageAccounts'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/74c30959-af11-47b3-9ed2-a26e03f427a3'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).defenderForStorageAccounts.parameters
-      }
-      {
-        definitionReferenceID: 'defenderForVM'
-        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/8e86a5b6-b9bd-49d1-8e21-4bb8a0862222'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).defenderForVM.parameters
-      }
-      {
-        definitionReferenceID: 'securityEmailContact'
-        definitionID: '${varTargetManagementGroupResourceID}/providers/Microsoft.Authorization/policyDefinitions/Deploy-ASC-SecurityContacts'
-        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_ascdf_config.parameters.json')).securityEmailContact.parameters
-      }
-    ]
-  }
   {
     name: 'Deploy-Diagnostics-LogAnalytics'
     libSetDefinition: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_diagnostics_loganalytics.json'))
@@ -871,6 +805,72 @@ var varCustomPolicySetDefinitionsArray = [
       }
     ]
   }
+  {
+    name: 'Deploy-MDFC-Config'
+    libSetDefinition: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.json'))
+    libSetChildDefinitions: [
+      {
+        definitionReferenceID: 'ascExport'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/ffb6f416-7bd2-4488-8828-56585fef2be9'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).ascExport.parameters
+      }
+      {
+        definitionReferenceID: 'defenderForAppServices'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/b40e7bcd-a1e5-47fe-b9cf-2f534d0bfb7d'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).defenderForAppServices.parameters
+      }
+      {
+        definitionReferenceID: 'defenderForArm'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/b7021b2b-08fd-4dc0-9de7-3c6ece09faf9'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).defenderForArm.parameters
+      }
+      {
+        definitionReferenceID: 'defenderforContainers'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/c9ddb292-b203-4738-aead-18e2716e858f'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).defenderforContainers.parameters
+      }
+      {
+        definitionReferenceID: 'defenderForDns'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/2370a3c1-4a25-4283-a91a-c9c1a145fb2f'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).defenderForDns.parameters
+      }
+      {
+        definitionReferenceID: 'defenderForKeyVaults'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/1f725891-01c0-420a-9059-4fa46cb770b7'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).defenderForKeyVaults.parameters
+      }
+      {
+        definitionReferenceID: 'defenderForOssDb'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/44433aa3-7ec2-4002-93ea-65c65ff0310a'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).defenderForOssDb.parameters
+      }
+      {
+        definitionReferenceID: 'defenderForSqlPaas'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/b99b73e7-074b-4089-9395-b7236f094491'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).defenderForSqlPaas.parameters
+      }
+      {
+        definitionReferenceID: 'defenderForSqlServerVirtualMachines'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/50ea7265-7d8c-429e-9a7d-ca1f410191c3'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).defenderForSqlServerVirtualMachines.parameters
+      }
+      {
+        definitionReferenceID: 'defenderForStorageAccounts'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/74c30959-af11-47b3-9ed2-a26e03f427a3'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).defenderForStorageAccounts.parameters
+      }
+      {
+        definitionReferenceID: 'defenderForVM'
+        definitionID: '/providers/Microsoft.Authorization/policyDefinitions/8e86a5b6-b9bd-49d1-8e21-4bb8a0862222'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).defenderForVM.parameters
+      }
+      {
+        definitionReferenceID: 'securityEmailContact'
+        definitionID: '${varTargetManagementGroupResourceID}/providers/Microsoft.Authorization/policyDefinitions/Deploy-ASC-SecurityContacts'
+        definitionParameters: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_mdfc_config.parameters.json')).securityEmailContact.parameters
+      }
+    ]
+  }
   {
     name: 'Deploy-Private-DNS-Zones'
     libSetDefinition: json(loadTextContent('lib/policy_set_definitions/policy_set_definition_es_deploy_private_dns_zones.json'))