Azure custom policy for installing extension "AADLoginForWindows"

Question

I'm trying to create Azure custom policy to install extension "AADLoginForWindows" to be enabled on all existing and newly created VMs. When im creating the custom policy definition getting below error message.

Custom policy:

{ "properties": { "policyType": "custom", "displayName": "Install aadloginforwindows extension on Windows 2019 server and Windows 10 VMs", "mode": "all", "description": "Install aadloginforwindows extension on Windows 2019 server and Windows 10 VMs for Azure active directory login",

"parameters": {
  "listOfImageIdToInclude": {
    "type": "Array",
    "metadata": {
      "displayName": "Optional: List of virtual machine images that have supported Windows OS to add to scope",
      "description": "Windows Server 2019 and Windows10 is supported"
    },
    "defaultValue": []
  },
  "effect": {
    "type": "String",
    "metadata": {
      "displayName": "Effect",
      "description": "Enable or disable the execution of the policy"
    },
    "allowedValues": [
      "DeployIfNotExists",
      "Disabled"
    ],
    "defaultValue": "DeployIfNotExists"
  },
  

"policyRule": {
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Compute/virtualMachines"
      },
      
      {
        "anyOf": [
          {
            "field": "Microsoft.Compute/imageId",
            "in": "[parameters('listOfImageIdToInclude')]"
          },
          {
            "allOf": [
              {
                "field": "Microsoft.Compute/imagePublisher",
                "equals": "MicrosoftWindowsServer"
              },
              {
                "field": "Microsoft.Compute/imageOffer",
                "equals": "WindowsServer"
              },
              {
                "field": "Microsoft.Compute/imageSKU",
                "in": [
                  "2019-Datacenter",
                  "2019-Datacenter-smalldisk",
                  "2019-Datacenter-with-Containers",
                  "2019-Datacenter-with-Containers-smalldisk",
                  "2019-Datacenter-zhcn",
                  "2019-datacenter-gensecond"
                ]
              }
            ]
          },{
                                            "allOf": [
              {
                "field": "Microsoft.Compute/imagePublisher",
                "equals": "MicrosoftWindowsDesktop"
              },
              {
                "field": "Microsoft.Compute/imageOffer",
                "equals": "Windows-10"
              }
            ]
          }
        ]
      }
    ]
  },
  "then": {
    "effect": "[parameters('effect')]",
    "details": {
      "type": "Microsoft.Compute/virtualMachines/extensions",
      "roleDefinitionIds": [
        "/providers/microsoft.authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293"
      ],
      "existenceCondition": {
        "allOf": [
          {
            "field": "Microsoft.Compute/virtualMachines/extensions/type",
            "equals": "AADLoginForWindows"
          },
          
          {
            "field": "Microsoft.Compute/virtualMachines/extensions/provisioningState",
            "equals": "Succeeded"
          }
        ]
      },
      "deployment": {
        "properties": {
          "mode": "incremental",
          "template": {
            "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
            "contentVersion": "1.0.0.0",
            "parameters": {
              "vmName": {
                "type": "string"
              },
              "location": {
                "type": "string"
              }
            },
            "variables": {
              "vmExtensionName": "AADLoginForWindows",
              "vmExtensionPublisher": "Microsoft.Azure.ActiveDirectory",
              "vmExtensionType": "AADLoginForWindows",
              "vmExtensionTypeHandlerVersion": "1.0"
            },
            "resources": [
              {
                "type": "Microsoft.Compute/virtualMachines/extensions",
                "name": "[concat(parameters('vmName'), '/', variables('vmExtensionName'))]",
                "apiVersion": "2021-04-01",
                "location": "[parameters('location')]",
                "properties": {
                  "publisher": "[variables('vmExtensionPublisher')]",
                  "type": "[variables('vmExtensionType')]",
                  "typeHandlerVersion": "[variables('vmExtensionTypeHandlerVersion')]",
                  "autoUpgradeMinorVersion": true
                  
                }
              }
            ],
            "outputs": {
              "policy": {
                "type": "string",
                "value": "[concat('Enabled extension for VM', ': ', parameters('vmName'))]"
              }
            }
          },
          "parameters": {
            "vmName": {
              "value": "[field('name')]"
            },
            "location": {
              "value": "[field('location')]"
            }
          }
        }
      }
    }
  }
}

}

}}

---

Error message: The request content was invalid and could not be deserialized: 'Required property 'type' not found in JSON. Path 'properties.parameters.policyRule', line 1, position 571.'.

Any inputs/feedback will be helpful. Couldnt find any policy sample or built in policy for this extension.

Answer 1

• According to the error that you are encountering, the Azure custom policy created by you regarding the 'AADLoginForWindows' extension to be used and mandated by the Azure policy for the Azure AD login to be done on the VMs, the policy properties regarding the conditions of the policy rule are incorrect . Therefore, in the following section as stated by you in the question, the policy rules should be as follows: -

     "policyRule": {
      "if": {
      "allOf": [
  {
    "field": "type",
    "equals": "Microsoft.Compute/virtualMachines"
  },
  
  {
    "anyOf": [
      {
        "field": "Microsoft.Compute/imageId",
        "in": "[parameters('listOfImageIdToInclude')]"
      },
      {
        "allOf": [
          {
            "field": "Microsoft.Compute/imagePublisher",
            "equals": "MicrosoftWindowsServer"
          },
          {
            "field": "Microsoft.Compute/imageOffer",
            "equals": "WindowsServer"
          },
          {
            "field": "Microsoft.Compute/imageSKU",
            "in": [
              "2019-Datacenter",
              "2019-Datacenter-smalldisk",
              "2019-Datacenter-with-Containers",
              "2019-Datacenter-with-Containers-smalldisk",
              "2019-Datacenter-zhcn",
              "2019-datacenter-gensecond"
            ]
          }
        ]
      },
        {
                                        "allOf": [
          {
            "field": "Microsoft.Compute/imagePublisher",
            "equals": "MicrosoftWindowsDesktop"
          },
          {
            "field": "Microsoft.Compute/imageOffer",
            "equals": "Windows-10"
          }

In the above section, the section for 'imageID' should be omitted completely because the 'imageID' is not a correct parameter with regards to 'VM Compute Image' to be included in the custom policy for 'AADLoginForWindows' extension .

Thus, if it is not included as per the sample policy as shown below, the error that you are encountering might not encountered.

      "policyRule": {
       "if": {
       "allOf": [
      {
      "field": "type",
      "equals": "Microsoft.Compute/virtualMachines"
       },
      {
      "anyOf": [
        {
          "allOf": [
            {
              "field": "Microsoft.Compute/imagePublisher",
              "equals": "MicrosoftWindowsServer"
            },
            {
              "field": "Microsoft.Compute/imageOffer",
              "equals": "WindowsServer"
            },
            {
              "field": "Microsoft.Compute/imageSKU",
              "in": [
                "2008-R2-SP1",
                "2008-R2-SP1-smalldisk",
                "2012-Datacenter",
                "2012-Datacenter-smalldisk",
                "2012-R2-Datacenter",
                "2012-R2-Datacenter-smalldisk",
                "2016-Datacenter",
                "2016-Datacenter-Server-Core",
                "2016-Datacenter-Server-Core-smalldisk",
                "2016-Datacenter-smalldisk",
                "2016-Datacenter-with-Containers",
                "2016-Datacenter-with-RDSH",
                "2019-Datacenter",
                "2019-Datacenter-Core",
                "2019-Datacenter-Core-smalldisk",
                "2019-Datacenter-Core-with-Containers",
                "2019-Datacenter-Core-with-Containers-smalldisk",
                "2019-Datacenter-smalldisk",
                "2019-Datacenter-with-Containers",
                "2019-Datacenter-with-Containers-smalldisk",
                "2019-Datacenter-zhcn"
              ]
            }
          ]
        },
        {
          "allOf": [
            {
              "field": "Microsoft.Compute/imagePublisher",
              "equals": "MicrosoftWindowsServer"
            },
            {
              "field": "Microsoft.Compute/imageOffer",
              "equals": "WindowsServerSemiAnnual"
            },
            {
              "field": "Microsoft.Compute/imageSKU",
              "in": [
                "Datacenter-Core-1709-smalldisk",
                "Datacenter-Core-1709-with-Containers-smalldisk",
                "Datacenter-Core-1803-with-Containers-smalldisk"
              ]
            }
          ]
        },
        {
          "allOf": [
            {
              "field": "Microsoft.Compute/imagePublisher",
              "equals": "MicrosoftWindowsServerHPCPack"
            },
            {
              "field": "Microsoft.Compute/imageOffer",
              "equals": "WindowsServerHPCPack"
            }
          ]
        },
        {
          "allOf": [
            {
              "field": "Microsoft.Compute/imagePublisher",
              "equals": "MicrosoftSQLServer"
            },
            {
              "anyOf": [
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "like": "*-WS2019"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "like": "*-WS2019-BYOL"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "like": "*-WS2016"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "like": "*-WS2016-BYOL"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "like": "*-WS2012R2"
                },
                {
                  "field": "Microsoft.Compute/imageOffer",
                  "like": "*-WS2012R2-BYOL"
                }
              ]
            }
          ]
        },

For more detailed information regarding this, kindly visit the below link: -

https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/create-custom-policy-definition#completed-definition