{"action":"created","issue":{"url":"https://api.github.com/repos/Azure/azure-policy/issues/29","repository_url":"https://api.github.com/repos/Azure/azure-policy","labels_url":"https://api.github.com/repos/Azure/azure-policy/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/Azure/azure-policy/issues/29/comments","events_url":"https://api.github.com/repos/Azure/azure-policy/issues/29/events","html_url":"https://github.com/Azure/azure-policy/issues/29","id":306694070,"number":29,"title":"SQL DB/Server deny policy for auditing/TDE/threat detection?","user":{"login":"joshidp","id":7415276,"avatar_url":"https://avatars0.githubusercontent.com/u/7415276?v=4","gravatar_id":"","url":"https://api.github.com/users/joshidp","html_url":"https://github.com/joshidp","followers_url":"https://api.github.com/users/joshidp/followers","following_url":"https://api.github.com/users/joshidp/following{/other_user}","gists_url":"https://api.github.com/users/joshidp/gists{/gist_id}","starred_url":"https://api.github.com/users/joshidp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshidp/subscriptions","organizations_url":"https://api.github.com/users/joshidp/orgs","repos_url":"https://api.github.com/users/joshidp/repos","events_url":"https://api.github.com/users/joshidp/events{/privacy}","received_events_url":"https://api.github.com/users/joshidp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-20T01:21:55Z","updated_at":"2018-03-20T06:54:17Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\nI am trying to create policies for SQL Server /db resources where auditing/TDE/threat detection is not enabled. I am using the definition provided ate below url and only changing the effect from auditIfNotExists to deny, but it's not working as per the compliance screen(it shows correctly configured db's also as non-compliante). We have the elastic pool setup configured in our db's.\r\n\r\nPlease suggest how to apply deny policy for db's/servers which are not configured for auditing/TDE/threat detection?\r\n\r\n**policy deifnition for tde;**\r\n```\r\n{\r\n  \"if\": {\r\n    \"field\": \"type\",\r\n    \"equals\": \"Microsoft.SQL/servers/databases\"\r\n  },\r\n  \"then\": {\r\n    \"effect\": \"deny\",\r\n    \"details\": {\r\n      \"type\": \"Microsoft.SQL/servers/databases/transparentDataEncryption\",\r\n      \"name\": \"current\",\r\n      \"existenceCondition\": {\r\n        \"field\": \"Microsoft.Sql/transparentDataEncryption.status\",\r\n        \"equals\": \"Disabled\" //I tried enabled too\r\n      }\r\n    }\r\n  }\r\n}\r\n\r\n```\r\nThanks\r\n"},"comment":{"url":"https://api.github.com/repos/Azure/azure-policy/issues/comments/374494557","html_url":"https://github.com/Azure/azure-policy/issues/29#issuecomment-374494557","issue_url":"https://api.github.com/repos/Azure/azure-policy/issues/29","id":374494557,"user":{"login":"krnese","id":12991708,"avatar_url":"https://avatars2.githubusercontent.com/u/12991708?v=4","gravatar_id":"","url":"https://api.github.com/users/krnese","html_url":"https://github.com/krnese","followers_url":"https://api.github.com/users/krnese/followers","following_url":"https://api.github.com/users/krnese/following{/other_user}","gists_url":"https://api.github.com/users/krnese/gists{/gist_id}","starred_url":"https://api.github.com/users/krnese/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krnese/subscriptions","organizations_url":"https://api.github.com/users/krnese/orgs","repos_url":"https://api.github.com/users/krnese/repos","events_url":"https://api.github.com/users/krnese/events{/privacy}","received_events_url":"https://api.github.com/users/krnese/received_events","type":"User","site_admin":false},"created_at":"2018-03-20T06:54:17Z","updated_at":"2018-03-20T06:54:17Z","author_association":"CONTRIBUTOR","body":"Have you looked at this sample? \r\n\r\nhttps://github.com/Azure/azure-policy/blob/master/samples/SQL/deny-sql-db-tde-disabled/azurepolicy.json "}}
{"actor":{"display_login":"krnese"}}