From 626538f0b9114a68d39a3a677e32ccfb3290ecca Mon Sep 17 00:00:00 2001 From: Tom Claes Date: Sat, 4 Apr 2026 16:27:46 +0200 Subject: [PATCH 1/7] Replace git clone with curl downloads in README Remove the full-repo git clone instruction and replace it with targeted curl commands that download only the three required files (policy/azurepolicy.json, scripts/deployment.ps1, scripts/start-remediation.ps1). This avoids cloning the entire sql-server-samples repository, reducing setup time and bandwidth for users who only need the Arc SQL license type policy. Changes: - Add optional mkdir/cd step for a clean local working directory - Add curl commands to fetch individual files into the expected policy/ and scripts/ folder structure - Add note about curl alias on Windows PowerShell 5.1 - Remove git clone and deep cd instructions No script changes required: deployment.ps1 resolves the policy JSON via Join-Path relative to PSScriptRoot, which is preserved by the new folder layout. --- .../arc-sql-license-type-compliance/README.md | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md index cb6ce7b66..1a7c99080 100644 --- a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md +++ b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md @@ -29,13 +29,26 @@ Parameter reference: Definition and assignment creation: -1. Clone the repo. +1. Download the required files. ```powershell -git clone https://github.com/microsoft/sql-server-samples.git -cd sql-server-samples/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance +# Optional: create and enter a local working directory +mkdir sql-arc-lt-compliance +cd sql-arc-lt-compliance ``` +```powershell +$baseUrl = "https://raw.githubusercontent.com/microsoft/sql-server-samples/master/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance" + +New-Item -ItemType Directory -Path policy, scripts -Force | Out-Null + +curl -sLo policy/azurepolicy.json "$baseUrl/policy/azurepolicy.json" +curl -sLo scripts/deployment.ps1 "$baseUrl/scripts/deployment.ps1" +curl -sLo scripts/start-remediation.ps1 "$baseUrl/scripts/start-remediation.ps1" +``` + +> **Note:** On Windows PowerShell 5.1, `curl` is an alias for `Invoke-WebRequest`. Use `curl.exe` instead, or run the commands in PowerShell 7+. + 2. Login to Azure. ```powershell From 74df34e61b22c7f249b372e46fc1bbfc115a298c Mon Sep 17 00:00:00 2001 From: Tom Claes Date: Sat, 4 Apr 2026 16:32:08 +0200 Subject: [PATCH 2/7] Make ManagementGroupId optional, default to tenant root management group Change ManagementGroupId from required to optional in both deployment.ps1 and start-remediation.ps1. When not specified, the scripts resolve the tenant root management group ID automatically via (Get-AzContext).Tenant.Id. Changes: - deployment.ps1: ManagementGroupId parameter now Mandatory=false; auto-resolves to tenant root group with informational output - start-remediation.ps1: same parameter change and auto-resolve - README.md: updated both parameter tables (Required=No, default shown as 'Tenant root group'); simplified examples to omit ManagementGroupId where the default suffices; added explicit management group examples for users who need a custom scope --- .../arc-sql-license-type-compliance/README.md | 24 ++++++++++++------- .../scripts/deployment.ps1 | 7 +++++- .../scripts/start-remediation.ps1 | 7 +++++- 3 files changed, 27 insertions(+), 11 deletions(-) diff --git a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md index 1a7c99080..67868feba 100644 --- a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md +++ b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/README.md @@ -21,7 +21,7 @@ Parameter reference: | Parameter | Required | Default | Allowed values | Description | |---|---|---|---|---| -| `ManagementGroupId` | Yes | N/A | Any valid management group ID | Scope where the policy definition is created. | +| `ManagementGroupId` | No | Tenant root group | Any valid management group ID | Scope where the policy definition is created. Defaults to the tenant root management group when not specified. | | `ExtensionType` | No | `Both` | `Windows`, `Linux`, `Both` | Targets the Arc SQL extension platform. When `Both` (default), a single policy definition and assignment covers both platforms. When a specific type is selected, the naming and scope are tailored to that platform. | | `SubscriptionId` | No | Not set | Any valid subscription ID | If provided, policy assignment scope is the subscription. | | `TargetLicenseType` | Yes | N/A | `Paid`, `PAYG` | Target `LicenseType` value to enforce. | @@ -56,11 +56,14 @@ Connect-AzAccount ``` ```powershell -# Example: target both platforms (default) +# Example: target both platforms (default), using tenant root management group +.\scripts\deployment.ps1 -SubscriptionId "" -TargetLicenseType "PAYG" -LicenseTypesToOverwrite @("Paid") + +# Example: target both platforms with explicit management group .\scripts\deployment.ps1 -ManagementGroupId "" -SubscriptionId "" -TargetLicenseType "PAYG" -LicenseTypesToOverwrite @("Paid") # Example: target only Linux -.\scripts\deployment.ps1 -ManagementGroupId "" -ExtensionType "Linux" -SubscriptionId "" -TargetLicenseType "PAYG" -LicenseTypesToOverwrite @("Paid") +.\scripts\deployment.ps1 -ExtensionType "Linux" -SubscriptionId "" -TargetLicenseType "PAYG" -LicenseTypesToOverwrite @("Paid") ``` The first example (without `-ExtensionType`) will: * Create/update a single policy definition and assignment covering **both** Windows and Linux. @@ -74,13 +77,13 @@ Scenario examples: ```powershell # Target Paid, both Linux and Windows, but only for resources with missing LicenseType or LicenseOnly (do not target PAYG) -.\scripts\deployment.ps1 -ManagementGroupId "" -TargetLicenseType "Paid" -LicenseTypesToOverwrite @("Unspecified","LicenseOnly") +.\scripts\deployment.ps1 -TargetLicenseType "Paid" -LicenseTypesToOverwrite @("Unspecified","LicenseOnly") # Target PAYG, but only where current LicenseType is Paid (do not target missing or LicenseOnly) -.\scripts\deployment.ps1 -ManagementGroupId "" -ExtensionType "Linux" -TargetLicenseType "PAYG" -LicenseTypesToOverwrite @("Paid") +.\scripts\deployment.ps1 -ExtensionType "Linux" -TargetLicenseType "PAYG" -LicenseTypesToOverwrite @("Paid") # Overwrite all known existing LicenseType values (Paid, PAYG, LicenseOnly), but not missing -.\scripts\deployment.ps1 -ManagementGroupId "" -ExtensionType "Linux" -TargetLicenseType "Paid" -LicenseTypesToOverwrite @("Paid","PAYG","LicenseOnly") +.\scripts\deployment.ps1 -ExtensionType "Linux" -TargetLicenseType "Paid" -LicenseTypesToOverwrite @("Paid","PAYG","LicenseOnly") ``` Note: `scripts/deployment.ps1` automatically grants required roles to the policy assignment managed identity at assignment scope, preventing common `PolicyAuthorizationFailed` errors during DeployIfNotExists deployments. @@ -91,18 +94,21 @@ Parameter reference: | Parameter | Required | Default | Allowed values | Description | |---|---|---|---|---| -| `ManagementGroupId` | Yes | N/A | Any valid management group ID | Used to resolve the policy definition/assignment naming context. | +| `ManagementGroupId` | No | Tenant root group | Any valid management group ID | Used to resolve the policy definition/assignment naming context. Defaults to the tenant root management group when not specified. | | `ExtensionType` | No | `Both` | `Windows`, `Linux`, `Both` | Must match the platform used for the assignment. When `Both` (default), remediates the combined assignment. | | `SubscriptionId` | No | Not set | Any valid subscription ID | If provided, remediation runs at subscription scope. | | `TargetLicenseType` | Yes | N/A | `Paid`, `PAYG` | Must match the assignment target license type. | | `GrantMissingPermissions` | No | `false` | Switch (`present`/`not present`) | If set, checks and assigns missing required roles before remediation. | ```powershell -# Example: remediate both platforms (default) +# Example: remediate both platforms (default), using tenant root management group +.\scripts\start-remediation.ps1 -SubscriptionId "" -TargetLicenseType "PAYG" -GrantMissingPermissions + +# Example: remediate with explicit management group .\scripts\start-remediation.ps1 -ManagementGroupId "" -SubscriptionId "" -TargetLicenseType "PAYG" -GrantMissingPermissions # Example: remediate only Linux -.\scripts\start-remediation.ps1 -ManagementGroupId "" -ExtensionType "Linux" -SubscriptionId "" -TargetLicenseType "PAYG" -GrantMissingPermissions +.\scripts\start-remediation.ps1 -ExtensionType "Linux" -SubscriptionId "" -TargetLicenseType "PAYG" -GrantMissingPermissions ``` ## Managed Identity And Roles diff --git a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/deployment.ps1 b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/deployment.ps1 index 98aab3392..cf9148382 100644 --- a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/deployment.ps1 +++ b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/deployment.ps1 @@ -1,5 +1,5 @@ param( - [Parameter(Mandatory = $true)] + [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string]$ManagementGroupId, @@ -23,6 +23,11 @@ param( [switch]$SkipManagedIdentityRoleAssignment ) +if (-not $PSBoundParameters.ContainsKey('ManagementGroupId')) { + $ManagementGroupId = (Get-AzContext).Tenant.Id + Write-Output "ManagementGroupId not specified. Using tenant root management group: $ManagementGroupId" +} + $AssignmentScope = "/providers/Microsoft.Management/managementGroups/$ManagementGroupId" if ($PSBoundParameters.ContainsKey('SubscriptionId')) { diff --git a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/start-remediation.ps1 b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/start-remediation.ps1 index b2f895c0b..1ea317104 100644 --- a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/start-remediation.ps1 +++ b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/start-remediation.ps1 @@ -1,5 +1,5 @@ param( - [Parameter(Mandatory = $true)] + [Parameter(Mandatory = $false)] [ValidateNotNullOrEmpty()] [string]$ManagementGroupId, @@ -31,6 +31,11 @@ param( [switch]$GrantMissingPermissions ) +if (-not $PSBoundParameters.ContainsKey('ManagementGroupId')) { + $ManagementGroupId = (Get-AzContext).Tenant.Id + Write-Output "ManagementGroupId not specified. Using tenant root management group: $ManagementGroupId" +} + $AssignmentScope = "/providers/Microsoft.Management/managementGroups/$ManagementGroupId" if ($PSBoundParameters.ContainsKey('SubscriptionId')) { From 546847b3d9351dd58733b5c7eeeec9f96e7e6f68 Mon Sep 17 00:00:00 2001 From: Tom Claes Date: Sat, 4 Apr 2026 16:44:09 +0200 Subject: [PATCH 3/7] Make policy definition and assignment display names generic Remove hardcoded license type references from policy displayName and description. The actual target license type is controlled by parameters at assignment time, so the definition metadata should not imply a specific value. Changes: - azurepolicy.json: displayName and description now use generic 'Configure Arc-enabled SQL Server license type' wording - deployment.ps1: collapsed the PAYG/SA conditional display name logic into a single generic label per platform --- .../policy/azurepolicy.json | 4 ++-- .../scripts/deployment.ps1 | 10 ++-------- 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/policy/azurepolicy.json b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/policy/azurepolicy.json index 5450371d0..9f5634b53 100644 --- a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/policy/azurepolicy.json +++ b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/policy/azurepolicy.json @@ -1,8 +1,8 @@ { - "displayName": "Set Arc-enabled SQL Server license type to 'License With Software Assurance'", + "displayName": "Configure Arc-enabled SQL Server license type", "policyType": "Custom", "mode": "Indexed", - "description": "This policy sets the license type for Arc-enabled SQL Server to 'License With Software Assurance'. ", + "description": "This policy configures the license type for Arc-enabled SQL Server extensions to a specified target value.", "metadata": { "category": "" }, diff --git a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/deployment.ps1 b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/deployment.ps1 index cf9148382..964b91871 100644 --- a/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/deployment.ps1 +++ b/samples/manage/azure-arc-enabled-sql-server/compliance/arc-sql-license-type-compliance/scripts/deployment.ps1 @@ -60,14 +60,8 @@ else { $PolicyDefinitionName = "activate-sql-arc-$LicenseToken-$PlatformToken" $PolicyAssignmentName = "sql-arc-$LicenseToken-$PlatformToken" -if ($TargetLicenseType -eq 'PAYG') { - $PolicyDefinitionDisplayName = "Arc-enabled SQL Server ($PlatformLabel) license type to 'Pay-as-you-go'" - $PolicyAssignmentDisplayName = "Arc-enabled SQL Server ($PlatformLabel) license type to 'Pay-as-you-go'" -} -else { - $PolicyDefinitionDisplayName = "Set Arc-enabled SQL Server ($PlatformLabel) license type to 'License With Software Assurance'" - $PolicyAssignmentDisplayName = "Set Arc-enabled SQL Server ($PlatformLabel) license type to 'License With Software Assurance'" -} +$PolicyDefinitionDisplayName = "Configure Arc-enabled SQL Server ($PlatformLabel) license type" +$PolicyAssignmentDisplayName = "Configure Arc-enabled SQL Server ($PlatformLabel) license type" #Create policy definition New-AzPolicyDefinition ` From 868cc2759735071d5a4c929387f0d5aa6a92b91d Mon Sep 17 00:00:00 2001 From: Tom Claes Date: Sat, 4 Apr 2026 16:53:11 +0200 Subject: [PATCH 4/7] Add dynamic license type label to policy display names Include the selected target license type in the policy definition and assignment display names for clarity in the Azure Portal. Format: Configure Arc-enabled SQL Server () license type to '