{
    "properties": {
        "displayName": "Audit: TLS 1.0 and 1.1 server protocols disabled",
        "policyType": "Custom",
        "mode": "Indexed",
        "description": "Audits that SCHANNEL has the server side of TLS 1.0 and TLS 1.1 explicitly disabled.",
        "metadata": {
            "category": "Guest Configuration",
            "version": "1.0.0",
            "requiredProviders": [
                "Microsoft.GuestConfiguration"
            ],
            "guestConfiguration": {
                "name": "TlsServerProtocols_1.0.0",
                "version": "1.0.0",
                "contentType": "Custom",
                "contentUri": "https://stcontosomc.blob.core.windows.net/machine-configuration/TlsServerProtocols_1.0.0.zip",
                "contentHash": "{{PACKAGE_SHA256}}",
                "contentManagedIdentity": "system",
                "enableAutoRemediation": "[parameters('EnableAutoRemediation')]",
                "autoRemediationAssignmentType": "ApplyAndAutoCorrect"
            }
        },
        "parameters": {
            "IncludeArcMachines": {
                "type": "string",
                "metadata": {
                    "displayName": "Include Arc connected machines",
                    "description": "By selecting this option, you agree to be charged monthly per Arc connected machine.",
                    "portalReview": "true"
                },
                "allowedValues": [
                    "true",
                    "false"
                ],
                "defaultValue": "false"
            },
            "EnableAutoRemediation": {
                "type": "string",
                "metadata": {
                    "displayName": "Enable Auto Remediation",
                    "description": "When true, the policy will automatically enforce remediation. When false, it will only audit"
                },
                "allowedValues": [
                    "true",
                    "false"
                ],
                "defaultValue": "false"
            }
        },
        "policyRule": {
            "if": {
                "allOf": [
                    {
                        "anyOf": [
                            {
                                "allOf": [
                                    {
                                        "anyOf": [
                                            {
                                                "field": "type",
                                                "equals": "Microsoft.Compute/virtualMachines"
                                            },
                                            {
                                                "field": "type",
                                                "equals": "Microsoft.Compute/virtualMachineScaleSets"
                                            }
                                        ]
                                    },
                                    {
                                        "field": "tags['aks-managed-orchestrator']",
                                        "exists": "false"
                                    },
                                    {
                                        "field": "tags['aks-managed-poolName']",
                                        "exists": "false"
                                    },
                                    {
                                        "anyOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "in": [
                                                    "esri",
                                                    "incredibuild",
                                                    "MicrosoftDynamicsAX",
                                                    "MicrosoftSharepoint",
                                                    "MicrosoftVisualStudio",
                                                    "MicrosoftWindowsDesktop",
                                                    "MicrosoftWindowsServerHPCPack"
                                                ]
                                            },
                                            {
                                                "allOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imagePublisher",
                                                        "equals": "MicrosoftWindowsServer"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/imageSKU",
                                                        "notLike": "2008*"
                                                    }
                                                ]
                                            },
                                            {
                                                "allOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imagePublisher",
                                                        "equals": "MicrosoftSQLServer"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/imageOffer",
                                                        "notLike": "SQL2008*"
                                                    }
                                                ]
                                            },
                                            {
                                                "allOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imagePublisher",
                                                        "equals": "microsoft-dsvm"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/imageOffer",
                                                        "like": "dsvm-win*"
                                                    }
                                                ]
                                            },
                                            {
                                                "allOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imagePublisher",
                                                        "equals": "microsoft-ads"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/imageOffer",
                                                        "in": [
                                                            "standard-data-science-vm",
                                                            "windows-data-science-vm"
                                                        ]
                                                    }
                                                ]
                                            },
                                            {
                                                "allOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imagePublisher",
                                                        "equals": "batch"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/imageOffer",
                                                        "equals": "rendering-windows2016"
                                                    }
                                                ]
                                            },
                                            {
                                                "allOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imagePublisher",
                                                        "equals": "center-for-internet-security-inc"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/imageOffer",
                                                        "like": "cis-windows-server-201*"
                                                    }
                                                ]
                                            },
                                            {
                                                "allOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imagePublisher",
                                                        "equals": "pivotal"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/imageOffer",
                                                        "like": "bosh-windows-server*"
                                                    }
                                                ]
                                            },
                                            {
                                                "allOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imagePublisher",
                                                        "equals": "cloud-infrastructure-services"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/imageOffer",
                                                        "like": "ad*"
                                                    }
                                                ]
                                            },
                                            {
                                                "allOf": [
                                                    {
                                                        "anyOf": [
                                                            {
                                                                "field": "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration",
                                                                "exists": true
                                                            },
                                                            {
                                                                "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
                                                                "like": "Windows*"
                                                            },
                                                            {
                                                                "field": "Microsoft.Compute/VirtualMachineScaleSets/osProfile.windowsConfiguration",
                                                                "exists": true
                                                            },
                                                            {
                                                                "field": "Microsoft.Compute/virtualMachineScaleSets/virtualMachineProfile.storageProfile.osDisk.osType",
                                                                "like": "Windows*"
                                                            }
                                                        ]
                                                    },
                                                    {
                                                        "anyOf": [
                                                            {
                                                                "field": "Microsoft.Compute/imageSKU",
                                                                "exists": false
                                                            },
                                                            {
                                                                "allOf": [
                                                                    {
                                                                        "field": "Microsoft.Compute/imageOffer",
                                                                        "notLike": "SQL2008*"
                                                                    },
                                                                    {
                                                                        "field": "Microsoft.Compute/imageSKU",
                                                                        "notLike": "2008*"
                                                                    }
                                                                ]
                                                            }
                                                        ]
                                                    }
                                                ]
                                            }
                                        ]
                                    }
                                ]
                            },
                            {
                                "allOf": [
                                    {
                                        "value": "[parameters('IncludeArcMachines')]",
                                        "equals": "true"
                                    },
                                    {
                                        "anyOf": [
                                            {
                                                "allOf": [
                                                    {
                                                        "field": "type",
                                                        "equals": "Microsoft.HybridCompute/machines"
                                                    },
                                                    {
                                                        "field": "Microsoft.HybridCompute/imageOffer",
                                                        "like": "windows*"
                                                    }
                                                ]
                                            },
                                            {
                                                "allOf": [
                                                    {
                                                        "field": "type",
                                                        "equals": "Microsoft.ConnectedVMwarevSphere/virtualMachines"
                                                    },
                                                    {
                                                        "field": "Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType",
                                                        "like": "windows*"
                                                    }
                                                ]
                                            }
                                        ]
                                    }
                                ]
                            }
                        ]
                    },
                    {
                        "field": "tags['ConfigOwner']",
                        "equals": "ArcMachineConfiguration"
                    }
                ]
            },
            "then": {
                "effect": "deployIfNotExists",
                "details": {
                    "roleDefinitionIds": [
                        "/providers/Microsoft.Authorization/roleDefinitions/088ab73d-1256-47ae-bea9-9de8e7131f31"
                    ],
                    "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
                    "name": "[concat('TlsServerProtocols_1.0.0$pid', uniqueString(policy().assignmentId, policy().definitionReferenceId))]",
                    "existenceCondition": {
                        "allOf": [
                            {
                                "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus",
                                "equals": "Compliant"
                            },
                            {
                                "value": "[parameters('EnableAutoRemediation')]",
                                "in": [
                                    "true",
                                    "false"
                                ]
                            }
                        ]
                    },
                    "deployment": {
                        "properties": {
                            "mode": "incremental",
                            "parameters": {
                                "vmName": {
                                    "value": "[field('name')]"
                                },
                                "location": {
                                    "value": "[field('location')]"
                                },
                                "type": {
                                    "value": "[field('type')]"
                                },
                                "assignmentName": {
                                    "value": "[concat('TlsServerProtocols_1.0.0$pid', uniqueString(policy().assignmentId, policy().definitionReferenceId))]"
                                }
                            },
                            "template": {
                                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                                "contentVersion": "1.0.0.0",
                                "parameters": {
                                    "vmName": {
                                        "type": "string"
                                    },
                                    "location": {
                                        "type": "string"
                                    },
                                    "type": {
                                        "type": "string"
                                    },
                                    "assignmentName": {
                                        "type": "string"
                                    }
                                },
                                "resources": [
                                    {
                                        "condition": "[equals(toLower(parameters('type')), toLower('Microsoft.Compute/virtualMachines'))]",
                                        "apiVersion": "2024-04-05",
                                        "type": "Microsoft.Compute/virtualMachines/providers/guestConfigurationAssignments",
                                        "name": "[concat(parameters('vmName'), '/Microsoft.GuestConfiguration/', parameters('assignmentName'))]",
                                        "location": "[parameters('location')]",
                                        "properties": {
                                            "guestConfiguration": {
                                                "name": "TlsServerProtocols_1.0.0",
                                                "version": "1.0.0",
                                                "contentType": "Custom",
                                                "contentUri": "https://stcontosomc.blob.core.windows.net/machine-configuration/TlsServerProtocols_1.0.0.zip",
                                                "contentHash": "{{PACKAGE_SHA256}}",
                                                "assignmentType": "ApplyAndAutoCorrect",
                                                "contentManagedIdentity": "system"
                                            }
                                        }
                                    },
                                    {
                                        "condition": "[equals(toLower(parameters('type')), toLower('Microsoft.HybridCompute/machines'))]",
                                        "apiVersion": "2024-04-05",
                                        "type": "Microsoft.HybridCompute/machines/providers/guestConfigurationAssignments",
                                        "name": "[concat(parameters('vmName'), '/Microsoft.GuestConfiguration/', parameters('assignmentName'))]",
                                        "location": "[parameters('location')]",
                                        "properties": {
                                            "guestConfiguration": {
                                                "name": "TlsServerProtocols_1.0.0",
                                                "version": "1.0.0",
                                                "contentType": "Custom",
                                                "contentUri": "https://stcontosomc.blob.core.windows.net/machine-configuration/TlsServerProtocols_1.0.0.zip",
                                                "contentHash": "{{PACKAGE_SHA256}}",
                                                "assignmentType": "ApplyAndAutoCorrect",
                                                "contentManagedIdentity": "system"
                                            }
                                        }
                                    },
                                    {
                                        "condition": "[equals(toLower(parameters('type')), toLower('Microsoft.Compute/virtualMachineScaleSets'))]",
                                        "apiVersion": "2024-04-05",
                                        "type": "Microsoft.Compute/virtualMachineScaleSets/providers/guestConfigurationAssignments",
                                        "name": "[concat(parameters('vmName'), '/Microsoft.GuestConfiguration/', parameters('assignmentName'))]",
                                        "location": "[parameters('location')]",
                                        "properties": {
                                            "guestConfiguration": {
                                                "name": "TlsServerProtocols_1.0.0",
                                                "version": "1.0.0",
                                                "contentType": "Custom",
                                                "contentUri": "https://stcontosomc.blob.core.windows.net/machine-configuration/TlsServerProtocols_1.0.0.zip",
                                                "contentHash": "{{PACKAGE_SHA256}}",
                                                "assignmentType": "ApplyAndAutoCorrect",
                                                "contentManagedIdentity": "system"
                                            }
                                        }
                                    }
                                ]
                            }
                        }
                    }
                }
            }
        }
    },
    "name": "ca593085-dfcb-425d-ac9c-12870a55bbaa"
}
