{
   "properties": {
      "displayName": "Deploy network watcher when virtual networks are created",
      "policyType": "BuiltIn",
      "mode": "Indexed",
      "description": "This policy creates a network watcher resource in regions with virtual networks. You need to ensure existence of a resource group named networkWatcherRG, which will be used to deploy network watcher instances.",
      "metadata": {
         "category": "Network"
      },
      "policyRule": {
         "if": {
            "field": "type",
            "equals": "Microsoft.Network/virtualNetworks"
         },
         "then": {
            "effect": "deployIfNotExists",
            "details": {
               "type": "Microsoft.Network/networkWatchers",
               "resourceGroupName": "networkWatcherRG",
               "existenceCondition": {
                  "field": "location",
                  "equals": "[field('location')]"
               },
               "roleDefinitionIds": [
                  "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7"
               ],
               "deployment": {
                  "properties": {
                     "mode": "incremental",
                     "template": {
                        "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json",
                        "contentVersion": "1.0.0.0",
                        "parameters": {
                           "location": {
                              "type": "string"
                           }
                        },
                        "resources": [
                           {
                              "apiVersion": "2016-09-01",
                              "type": "Microsoft.Network/networkWatchers",
                              "name": "[concat('networkWatcher_', parameters('location'))]",
                              "location": "[parameters('location')]"
                           }
                        ]
                     },
                     "parameters": {
                        "location": {
                           "value": "[parameters('location')]"
                        }
                     }
                  }
               }
            }
         }
      }
   },
   "id": "/providers/Microsoft.Authorization/policyDefinitions/a9b99dd8-06c5-4317-8629-9d86a3c6e7d9",
   "name": "a9b99dd8-06c5-4317-8629-9d86a3c6e7d9"
}