Repository navigation
Add MDFC Event Hub exports as a SAS authorization rule with resource group tags - #553
Diego Pauletto (diegosrp) wants to merge 3 commits into
Conversation
Add two subscription-scoped DeployIfNotExists policies under Security Center that configure Microsoft Defender for Cloud continuous export to an Event Hub and additionally apply resource group tags: - deploy-export-to-event-hub-as-a-trusted-service-for-mdfc (trusted service) - deploy-export-to-event-hub-for-mdfc (SAS authorization rule) Why: the built-in export policies create the target resource group without tags, so in subscriptions that enforce mandatory tags at resource group creation the built-in remediation is blocked and the export never deploys. These variants add a resourceGroupTags parameter and merge logic so the group is created or merged with the required tags, unblocking continuous export in tag-governed environments. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Thank you for the contribution. The resource-group tag handling appears to address the scenario described: tags are supplied when a new resource group is created, and existing tags are preserved and merged when an existing resource group is used. The underlying Microsoft Defender for Cloud export behavior also appears consistent with the corresponding built-in policies. Before this can be merged, the pull request needs to be separated to align with the repository contribution guidance. Each pull request should contain one policy and its three policy files. Please split the trusted-service and SAS authorization-rule definitions into separate pull requests and remove the |
03be4e1 to
ffc76ed
Compare
|
I removed the changes about
This PR now contains only the I’ll submit the removed policy in a separate PR, as requested. Please let me know if anything else is needed and Thanks for the feedback. |
Diego Pauletto (diegosrp)
changed the title
Diego Pauletto (diegosrp)
changed the title
Diego Pauletto (diegosrp)
changed the title
2 participants
Add one subscription-scoped DeployIfNotExists policies under Security Center that configure Microsoft Defender for Cloud continuous export to an Event Hub and additionally apply resource group tags:
Why: the built-in export policies create the target resource group without tags, so in subscriptions that enforce mandatory tags at resource group creation the built-in remediation is blocked and the export never deploys. These variants add a resourceGroupTags parameter and merge logic so the group is created or merged with the required tags, unblocking continuous export in tag-governed environments.