The servers/devOpsAuditingSettings resource type can be deployed with operations that target:
For a list of changed properties in each API version, see change log.
To create a Microsoft.Sql/servers/devOpsAuditingSettings resource, add the following JSON to your template.
{
"type": "Microsoft.Sql/servers/devOpsAuditingSettings",
"apiVersion": "2023-05-01-preview",
"name": "Default",
"properties": {
"isAzureMonitorTargetEnabled": "bool",
"isManagedIdentityInUse": "bool",
"state": "string",
"storageAccountAccessKey": "string",
"storageAccountSubscriptionId": "string",
"storageEndpoint": "string"
}
}
Name | Description | Value |
---|---|---|
type | The resource type | 'Microsoft.Sql/servers/devOpsAuditingSettings' |
apiVersion | The resource api version | '2023-05-01-preview' |
name | The resource name See how to set names and types for child resources in JSON ARM templates. |
'Default' |
properties | Resource properties. | ServerDevOpsAuditSettingsProperties |
Name | Description | Value |
---|---|---|
isAzureMonitorTargetEnabled | Specifies whether DevOps audit events are sent to Azure Monitor. In order to send the events to Azure Monitor, specify 'State' as 'Enabled' and 'IsAzureMonitorTargetEnabled' as true. When using REST API to configure DevOps audit, Diagnostic Settings with 'DevOpsOperationsAudit' diagnostic logs category on the master database should be also created. Diagnostic Settings URI format: PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{serverName}/databases/master/providers/microsoft.insights/diagnosticSettings/{settingsName}?api-version=2017-05-01-preview For more information, see Diagnostic Settings REST API or Diagnostic Settings PowerShell |
bool |
isManagedIdentityInUse | Specifies whether Managed Identity is used to access blob storage | bool |
state | Specifies the state of the audit. If state is Enabled, storageEndpoint or isAzureMonitorTargetEnabled are required. | 'Disabled' 'Enabled' (required) |
storageAccountAccessKey | Specifies the identifier key of the auditing storage account. If state is Enabled and storageEndpoint is specified, not specifying the storageAccountAccessKey will use SQL server system-assigned managed identity to access the storage. Prerequisites for using managed identity authentication: 1. Assign SQL Server a system-assigned managed identity in Azure Active Directory (AAD). 2. Grant SQL Server identity access to the storage account by adding 'Storage Blob Data Contributor' RBAC role to the server identity. For more information, see Auditing to storage using Managed Identity authentication |
string Constraints: Sensitive value. Pass in as a secure parameter. |
storageAccountSubscriptionId | Specifies the blob storage subscription Id. | string Constraints: Min length = 36 Max length = 36 Pattern = ^[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$ |
storageEndpoint | Specifies the blob storage endpoint (e.g. https://MyAccount.blob.core.windows.net ). If state is Enabled, storageEndpoint or isAzureMonitorTargetEnabled is required. |
string |
The following quickstart templates deploy this resource type.
Template | Description |
---|---|
Azure SQL Server with Auditing written to a blob storage |
This template allows you to deploy an Azure SQL server with Auditing enabled to write audit logs to a blob storage |
Azure SQL Server with Auditing written to Event Hub |
This template allows you to deploy an Azure SQL server with Auditing enabled to write audit logs to Event Hub |
Azure SQL Server with Auditing written to Log Analytics |
This template allows you to deploy an Azure SQL server with Auditing enabled to write audit logs to Log Analytics (OMS workspace) |