Fix permissions Microsoft Defender for SQL policy assignment (#1564)

Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>

Author: arjenhuitema

docs/wiki/ALZ-AMA-FAQ.md

@@ -41,3 +41,7 @@ It's important to highlight that while MMA deprecation is in August 2024, this d
 - Sentinel: Is only deployed through ALZ, which is still achieved by deploying the Solution. We don't deploy additional configurations. Consult [AMA migration for Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate) for more information.
 - Change Tracking: Aside from the solution being deployed in Log Analytics, we deploy the new components like DCRs and policies to enable Change Tracking through AMA.
 
+## Why is a Policy disbled in the "Configure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace" initiative?
+
+The Microsoft Defender for SQL are custom policies based on the built-in policies. These are made custom to add additional flexibility for resource naming and placement, as well as excluding certain resources from being deployed through Policy. The disabled policy didn’t add any additional value at this moment as the configurations it deploys are handled in the ARM template. 
+

docs/wiki/Whats-new.md

@@ -39,6 +39,12 @@ This article will be updated as and when changes are made to the above and anyth
 
 Here's what's changed in Enterprise Scale/Azure Landing Zones:
 
+### February 2024
+
+#### Tooling
+
+- Disabled a Policy in the Microsoft Defender for SQL initiative. As it is not required at this stage. See [ALZ AMA FAQ](./ALZ-AMA-FAQ) for more details.
+
 ### AMA Update for the Portal Accelerator
 
 The Azure Monitor Agent (AMA) is the new way to collect and send data to Azure Monitor. The Log Analytics agent, or the Microsoft Monitoring Agent (MMA), will no longer be supported after August 2024. To adapt to this change, the ALZ Portal Accelerator has been updated to use AMA instead of MMA.

eslzArm/eslzArm.json

@@ -3472,6 +3472,9 @@
                     },
                     "scope": {
                         "value": "[variables('scopes').lzsManagementGroup]"
+                    },
+                    "platformScope": {
+                        "value": "[variables('scopes').platformManagementGroup]"
                     }
                 }
             }

eslzArm/managementGroupTemplates/policyAssignments/DINE-MDFCDefenderSQLAMAPolicyAssignment.json

@@ -103,6 +103,14 @@
                 "displayName": "Scope",
                 "description": "Scope of the policy assignment"
             }
+        },
+        "platformScope": {
+            "type": "String",
+            "metadata": {
+                "displayName": "Platform Scope",
+                "description": "Scope of the reader role assignment"
+            },
+            "defaultValue": "[parameters('scope')]"
         }
     },
     "variables": {
@@ -124,12 +132,14 @@
         "rbacMonitoringContributor": "749f88d5-cbae-40b8-bcfc-e573ddc772fa",
         "rbacManagedIdentityOperator": "f1a07417-d97a-45cb-824c-7a7467783830",
         "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c",
+        "rbacReader": "acdd72a7-3385-48ef-bd42-f606fba81ae7",
         "roleAssignmentNames": {
             "roleAssignmentNameLogAnalyticsContributor": "[guid(concat(parameters('toplevelManagementGroupPrefix'),variables('policyAssignmentNames').azureDefenderSQL,parameters('scope')))]",
             "roleAssignmentNameVmContributor": "[guid(concat(parameters('toplevelManagementGroupPrefix'),variables('policyAssignmentNames').azureDefenderSQL,'-2',parameters('scope')))]",
             "roleAssignmentNameMonitoringContributor": "[guid(concat(parameters('toplevelManagementGroupPrefix'),variables('policyAssignmentNames').azureDefenderSQL,'-3',parameters('scope')))]",
             "roleAssignmentNameManagedIdentityOperator": "[guid(concat(parameters('toplevelManagementGroupPrefix'),variables('policyAssignmentNames').azureDefenderSQL,'-4',parameters('scope')))]",
-            "roleAssignmentNameContributor": "[guid(concat(parameters('toplevelManagementGroupPrefix'),variables('policyAssignmentNames').azureDefenderSQL,'-5',parameters('scope')))]"
+            "roleAssignmentNameContributor": "[guid(concat(parameters('toplevelManagementGroupPrefix'),variables('policyAssignmentNames').azureDefenderSQL,'-5',parameters('scope')))]",
+            "roleAssignmentNameReader": "[guid(concat(parameters('toplevelManagementGroupPrefix'),variables('policyAssignmentNames').azureDefenderSQL,'-6',parameters('scope')))]"
         }
     },
     "resources": [
@@ -234,7 +244,7 @@
                 "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').azureDefenderSQL), '2019-09-01', 'Full' ).identity.principalId)]"
             }
         },
-                {
+        {
             "type": "Microsoft.Authorization/roleAssignments",
             "apiVersion": "2022-04-01",
             "name": "[variables('roleAssignmentNames').roleAssignmentNameContributor]",
@@ -246,6 +256,21 @@
                 "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]",
                 "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').azureDefenderSQL), '2019-09-01', 'Full' ).identity.principalId)]"
             }
+        },
+        {
+            "condition": "[not(equals(parameters('platformScope'), parameters('scope')))]",
+            "type": "Microsoft.Authorization/roleAssignments",
+            "apiVersion": "2022-04-01",
+            "name": "[variables('roleAssignmentNames').roleAssignmentNameReader]",
+            "scope": "[parameters('platformScope')]",
+            "dependsOn": [
+                "[variables('policyAssignmentNames').azureDefenderSQL]"
+            ],
+            "properties": {
+                "principalType": "ServicePrincipal",
+                "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacReader'))]",
+                "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').azureDefenderSQL), '2019-09-01', 'Full' ).identity.principalId)]"
+            }
         }
     ],
     "outputs": {}

eslzArm/managementGroupTemplates/policyDefinitions/policies.json

@@ -9,7 +9,7 @@
     "displayName": "Configure SQL Virtual Machines to automatically install Microsoft Defender for SQL and DCR with a user-defined LA workspace",
     "description": "Microsoft Defender for SQL collects events from the agent and uses them to provide security alerts and tailored hardening tasks (recommendations). Create a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace.",
     "metadata": {
-      "version": "1.0.0",
+      "version": "1.0.1",
       "category": "Security Center",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -427,7 +427,7 @@
               },
               "parameters": {
                 "resourceGroup": {
-                  "value": "[[parameters('dcrResourceGroup')]"
+                  "value": "[[resourceGroup().name]"
                 },
                 "location": {
                   "value": "[[field('location')]"

src/resources/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-DefenderSQL-DCR.json

@@ -8,7 +8,7 @@
     "displayName": "Configure SQL VMs and Arc-enabled SQL Servers to install Microsoft Defender for SQL and AMA with a user-defined LA workspace",
     "description": "Microsoft Defender for SQL collects events from the agents and uses them to provide security alerts and tailored hardening tasks (recommendations). Creates a resource group and a Data Collection Rule in the same region as the user-defined Log Analytics workspace.",
     "metadata": {
-      "version": "1.0.0",
+      "version": "1.0.1",
       "category": "Security Center",
       "source": "https://github.com/Azure/Enterprise-Scale/",
       "alzCloudEnvironments": [
@@ -208,7 +208,7 @@
         "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy-MDFC-SQL-DefenderSQL-DCR",
         "parameters": {
           "effect": {
-            "value": "[[parameters('effect')]"
+            "value": "Disabled"
           },
           "userWorkspaceResourceId": {
             "value": "[[parameters('userWorkspaceResourceId')]"