{
   "if": {
      "field": "type",
      "equals": "Microsoft.Sql/servers"
   },
   "then": {
      "effect": "DeployIfNotExists",
      "details": {
         "type": "Microsoft.Sql/servers/auditingSettings",
         "name": "Default",
         "existenceCondition": {
            "field": "Microsoft.Sql/auditingSettings.state",
            "equals": "Enabled"
         },
         "roleDefinitionIds": [
            "/providers/microsoft.authorization/roleDefinitions/056cd41c-7e88-42e1-933e-88ba6a50c9c3",
            "/providers/microsoft.authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab"
         ],
         "deployment": {
            "properties": {
               "mode": "incremental",
               "template": {
                  "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "parameters": {
                     "serverName": {
                        "type": "string"
                     },
                     "auditRetentionDays": {
                        "type": "string"
                     },
                     "storageAccountsResourceGroup": {
                        "type": "string"
                     },
                     "location": {
                        "type": "string"
                     }
                  },
                  "variables": {
                     "retentionDays": "[int(parameters('auditRetentionDays'))]",
                     "subscriptionId": "[subscription().subscriptionId]",
                     "uniqueStorage": "[uniqueString(variables('subscriptionId'), parameters('location'), parameters('storageAccountsResourceGroup'))]",
                     "locationCode": "[substring(parameters('location'), 0, 3)]",
                     "storageName": "[tolower(concat('sqlaudit', variables('locationCode'), variables('uniqueStorage')))]",
                     "createStorageAccountDeploymentName": "[concat('sqlServerAuditingStorageAccount-', uniqueString(variables('locationCode'), parameters('serverName')))]"
                  },
                  "resources": [
                     {
                        "apiVersion": "2017-05-10",
                        "name": "[variables('createStorageAccountDeploymentName')]",
                        "type": "Microsoft.Resources/deployments",
                        "resourceGroup": "[parameters('storageAccountsResourceGroup')]",
                        "properties": {
                           "mode": "Incremental",
                           "parameters": {
                              "location": {
                                 "value": "[parameters('location')]"
                              },
                              "storageName": {
                                 "value": "[variables('storageName')]"
                              }
                           },
                           "templateLink": {
                              "uri": "https://raw.githubusercontent.com/Azure/azure-policy/master/samples/SQL/deploy-sql-server-auditing/createStorage.template.json",
                              "contentVersion": "1.0.0.0"
                           }
                        }
                     },
                     {
                        "name": "[concat(parameters('serverName'), '/Default')]",
                        "type": "Microsoft.Sql/servers/auditingSettings",
                        "apiVersion": "2017-03-01-preview",
                        "properties": {
                           "state": "Enabled",
                           "storageEndpoint": "[reference(variables('createStorageAccountDeploymentName')).outputs.storageAccountEndPoint.value]",
                           "storageAccountAccessKey": "[reference(variables('createStorageAccountDeploymentName')).outputs.storageAccountKey.value]",
                           "retentionDays": "[variables('retentionDays')]",
                           "auditActionsAndGroups": null,
                           "storageAccountSubscriptionId": "[subscription().subscriptionId]",
                           "isStorageSecondaryKeyInUse": false
                        }
                     }
                  ]
               },
               "parameters": {
                  "serverName": {
                     "value": "[field('name')]"
                  },
                  "auditRetentionDays": {
                     "value": "[parameters('retentionDays')]"
                  },
                  "storageAccountsResourceGroup": {
                     "value": "[parameters('storageAccountsResourceGroup')]"
                  },
                  "location": {
                     "value": "[field('location')]"
                  }
               }
            }
         }
      }
   }
}