{
    "properties": {
        "displayName": "Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity",
        "policyType": "BuiltIn",
        "mode": "Indexed",
        "description": "This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. For more information on Guest Configuration, visit https://aka.ms/gcpol.",
        "metadata": {
            "category": "Guest Configuration",
            "version": "1.0.0"
        },
        "policyRule": {
            "if": {
                "allOf": [
                    {
                        "field": "type",
                        "equals": "Microsoft.Compute/virtualMachines"
                    },
                    {
                        "anyOf" : [
                            {
                                "anyOf": [
                                    {
                                        "field": "Microsoft.Compute/imagePublisher",
                                        "in": [
                                            "esri",
                                            "incredibuild",
                                            "MicrosoftDynamicsAX",
                                            "MicrosoftSharepoint",
                                            "MicrosoftVisualStudio",
                                            "MicrosoftWindowsDesktop",
                                            "MicrosoftWindowsServerHPCPack"
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "MicrosoftWindowsServer"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageSKU",
                                                "notLike": "2008*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "MicrosoftSQLServer"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "notLike": "SQL2008*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "microsoft-dsvm"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "dsvm-windows"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "microsoft-ads"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "in": [
                                                    "standard-data-science-vm",
                                                    "windows-data-science-vm"
                                                ]
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "batch"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "rendering-windows2016"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "center-for-internet-security-inc"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "cis-windows-server-201*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "pivotal"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "bosh-windows-server*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "cloud-infrastructure-services"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "ad*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "anyOf": [
                                                    {
                                                        "field": "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration",
                                                        "exists": "true"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
                                                        "like": "Windows*"
                                                    }
                                                ]
                                            },
                                            {
                                                "anyOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imageSKU",
                                                        "exists": "false"
                                                    },
                                                    {
                                                        "allOf": [
                                                            {
                                                                "field": "Microsoft.Compute/imageSKU",
                                                                "notLike": "2008*"
                                                            },
                                                            {
                                                                "field": "Microsoft.Compute/imageOffer",
                                                                "notLike": "SQL2008*"
                                                            }
                                                        ]
                                                    }
                                                ]
                                            }
                                        ]
                                    }
                                ]
                            },
                            {
                                "anyOf": [
                                    {
                                        "field": "Microsoft.Compute/imagePublisher",
                                        "in": [
                                            "microsoft-aks",
                                            "qubole-inc",
                                            "datastax",
                                            "couchbase",
                                            "scalegrid",
                                            "checkpoint",
                                            "paloaltonetworks",
                                            "debian"
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "OpenLogic"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "CentOS*"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageSKU",
                                                "notLike": "6*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "Oracle"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "Oracle-Linux"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageSKU",
                                                "notLike": "6*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "RedHat"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "in": [
                                                    "RHEL",
                                                    "RHEL-HA",
                                                    "RHEL-SAP",
                                                    "RHEL-SAP-APPS",
                                                    "RHEL-SAP-HA",
                                                    "RHEL-SAP-HANA"
                                                ]
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageSKU",
                                                "notLike": "6*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "RedHat"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "in": [
                                                    "osa",
                                                    "rhel-byos"
                                                ]
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "center-for-internet-security-inc"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "in": [
                                                    "cis-centos-7-l1",
                                                    "cis-centos-7-v2-1-1-l1",
                                                    "cis-centos-8-l1",
                                                    "cis-debian-linux-8-l1",
                                                    "cis-debian-linux-9-l1",
                                                    "cis-nginx-centos-7-v1-1-0-l1",
                                                    "cis-oracle-linux-7-v2-0-0-l1",
                                                    "cis-oracle-linux-8-l1",
                                                    "cis-postgresql-11-centos-linux-7-level-1",
                                                    "cis-rhel-7-l2",
                                                    "cis-rhel-7-v2-2-0-l1",
                                                    "cis-rhel-8-l1",
                                                    "cis-suse-linux-12-v2-0-0-l1",
                                                    "cis-ubuntu-linux-1604-v1-0-0-l1",
                                                    "cis-ubuntu-linux-1804-l1"
                                                ]
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "credativ"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "Debian"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageSKU",
                                                "notLike": "7*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "Suse"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "SLES*"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageSKU",
                                                "notLike": "11*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "Canonical"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "UbuntuServer"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageSKU",
                                                "notLike": "12*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "microsoft-dsvm"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "in": [
                                                    "linux-data-science-vm-ubuntu",
                                                    "azureml"
                                                ]
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "cloudera"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "cloudera-centos-os"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageSKU",
                                                "notLike": "6*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "cloudera"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "cloudera-altus-centos-os"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "microsoft-ads"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "linux*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "anyOf": [
                                                    {
                                                        "field": "Microsoft.Compute/virtualMachines/osProfile.linuxConfiguration",
                                                        "exists": "true"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
                                                        "like": "Linux*"
                                                    }
                                                ]
                                            },
                                            {
                                                "anyOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imagePublisher",
                                                        "exists": "false"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/imagePublisher",
                                                        "notIn": [
                                                            "OpenLogic",
                                                            "RedHat",
                                                            "credativ",
                                                            "Suse",
                                                            "Canonical",
                                                            "microsoft-dsvm",
                                                            "cloudera",
                                                            "microsoft-ads",
                                                            "center-for-internet-security-inc",
                                                            "Oracle"
                                                        ]
                                                    }
                                                ]
                                            }
                                        ]
                                    }
                                ]
                            }
                        ]
                    },
                    {
                        "value": "[requestContext().apiVersion]",
                        "greaterOrEquals": "2018-10-01"
                    },
                    {
                        "field": "identity.type",
                        "contains": "UserAssigned"
                    },
                    {
                        "field": "identity.type",
                        "notContains": "SystemAssigned"
                    }
                ]
            },
            "then": {
                "effect": "modify",
                "details": {
                    "roleDefinitionIds": [
                        "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
                    ],
                    "operations": [
                        {
                            "operation": "addOrReplace",
                            "field": "identity.type",
                            "value": "[concat(field('identity.type'), ',SystemAssigned')]"
                        }
                    ]
                }
            }
        }
    },
    "id": "/providers/Microsoft.Authorization/policyDefinitions/497dff13-db2a-4c0f-8603-28fa3b331ab6",
    "name": "497dff13-db2a-4c0f-8603-28fa3b331ab6"
}
