{
    "properties": {
      "displayName": "Private endpoint connections on Automation Accounts should be enabled",
      "policyType": "BuiltIn",
      "mode": "Indexed",
      "description": "Private endpoint connections allow secure communication by enabling private connectivity to Automation accounts without a need for public IP addresses at the source or destination. Learn more about private endpoints in Azure Automation at https://docs.microsoft.com/azure/automation/how-to/private-link-security",
      "metadata": {
        "version": "1.0.0",
        "category": "Automation" 
      },
      "parameters": {
        "effect": {
          "type": "String",
          "metadata": {
            "displayName": "Effect",
            "description": "Enable or disable the execution of the policy"
          },
          "allowedValues": [
            "AuditIfNotExists",
            "Disabled"
          ],
          "defaultValue": "AuditIfNotExists"
        }
      },
      "policyRule": {
        "if": {
          "field": "type",
          "equals": "Microsoft.Automation/automationAccounts"
        },
        "then": {
          "effect": "[parameters('effect')]",
          "details": {
            "type": "Microsoft.Automation/automationAccounts/privateEndpointConnections",
            "existenceCondition": {
                "field": "Microsoft.Automation/automationAccounts/privateEndpointConnections/privateLinkServiceConnectionState.status",
                "equals": "Approved"
            }
          }
        }
      }
    },
    "id": "/providers/Microsoft.Authorization/policyDefinitions/0c2b3618-68a8-4034-a150-ff4abc873462",
    "name": "0c2b3618-68a8-4034-a150-ff4abc873462"
  }