NL_BIO_Cloud_Theme_V2.json

{
  "properties": {
    "displayName": "NL BIO Cloud Theme V2",
    "policyType": "BuiltIn",
    "description": "This initiative includes policies that address the Dutch Baseline Informatiebeveiliging (BIO) controls specifically for the 'thema-uitwerking Clouddiensten' and include policies covered under the SOC2 and ISO 27001:2013 controls.",
    "metadata": {
      "category": "Regulatory Compliance",
      "version": "2.2.0"
    },
    "version": "2.2.0",
    "policyDefinitionGroups": [
      {
        "category": "B.01 Laws and Regulations",
        "name": "NL_BIO_Cloud_Theme_B.01.3(2)",
        "description": "The requirements applicable to the CSC arising from laws and regulations have been identified, especially with regard to geographically distributed processing, storage and communications for which different legislation exists, such as measures arising from the GDPR.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_B.01.3(2)"
      },
      {
        "category": "B.09 Privacy and protection of personal data",
        "name": "NL_BIO_Cloud_Theme_B.09.1(2)",
        "description": "Availability, integrity and confidentiality measures have been taken for the storage, processing and transport of data",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_B.09.1(2)"
      },
      {
        "category": "B.10 Security Organization",
        "name": "NL_BIO_Cloud_Theme_B.10.2(2)",
        "description": "The security feature provides proactive support for, cloud risk assessment activities; classifying information and systems; use of encryption; securing related projects; developing business continuity program and security audits.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_B.10.2(2)"
      },
      {
        "category": "B.10 Security Organization",
        "name": "NL_BIO_Cloud_Theme_B.10.3(2)",
        "description": "The CSP has given the information security organization a formal position within the entire organization.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_B.10.3(2)"
      },
      {
        "category": "B.10 Security Organization",
        "name": "NL_BIO_Cloud_Theme_B.10.4(2)",
        "description": "The CSP has described and assigned information security responsibilities for defining, coordinating and evaluating  to specific officers.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_B.10.4(2)"
      },
      {
        "category": "C.04 Technical Vulnerability Management",
        "name": "NL_BIO_Cloud_Theme_C.04.3(2)",
        "description": "If the probability of abuse and the expected damage are both high (NCSC classification vulnerability warnings), patches are installed as soon as possible, but no later than within a week. In the meantime, mitigating measures are taken on the basis of an explicit risk assessment.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_C.04.3(2)"
      },
      {
        "category": "C.04 Technical Vulnerability Management",
        "name": "NL_BIO_Cloud_Theme_C.04.6(2)",
        "description": "Technical weaknesses can be remedied by performing patch management in a timely manner, which includes: identifying, registering and acquiring patches; the decision-making around the use of patches; testing patches; performing patches; registering implemented patches.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_C.04.6(2)"
      },
      {
        "category": "C.04 Technical Vulnerability Management",
        "name": "NL_BIO_Cloud_Theme_C.04.7(2)",
        "description": "Evaluations of technical vulnerabilities are recorded and reported.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_C.04.7(2)"
      },
      {
        "category": "C.04 Technical Vulnerability Management",
        "name": "NL_BIO_Cloud_Theme_C.04.8(2)",
        "description": "The evaluation reports contain suggestions for improvement and are communicated with managers/owners of ICT components in which vulnerabilities and weaknesses have been found.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_C.04.8(2)"
      },
      {
        "category": "C.05 Security Monitoring Reporting",
        "name": "NL_BIO_Cloud_Theme_C.05.5(2)",
        "description": "Demonstrably, follow-up is given to improvement proposals from analysis reports.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_C.05.5(2)"
      },
      {
        "category": "U.03 Business Continuity Services",
        "name": "NL_BIO_Cloud_Theme_U.03(2)",
        "description": "The agreed continuity is guaranteed by sufficiently logical or physically multiple system functions.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.03(2)"
      },
      {
        "category": "U.03 Business Continuity Services",
        "name": "NL_BIO_Cloud_Theme_U.03.1(2)",
        "description": "The agreed continuity is guaranteed by sufficiently logical or physically multiple system functions.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.03.1(2)"
      },
      {
        "category": "U.03 Business Continuity Services",
        "name": "NL_BIO_Cloud_Theme_U.03.2(2)",
        "description": "The continuity requirements for cloud services agreed with the CSC organization are ensured by specific measures described in the system architecture.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.03.2(2)"
      },
      {
        "category": "U.04 Data and Cloud Service Recovery",
        "name": "NL_BIO_Cloud_Theme_U.04.1(2)",
        "description": "In the event of calamities, the data and cloud services are restored within the agreed period and maximum data loss and made available to the CSC.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.04.1(2)"
      },
      {
        "category": "U.04 Data and Cloud Service Recovery",
        "name": "NL_BIO_Cloud_Theme_U.04.2(2)",
        "description": "The continuous process of recoverable protection of data is monitored.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.04.2(2)"
      },
      {
        "category": "U.04 Data and Cloud Service Recovery",
        "name": "NL_BIO_Cloud_Theme_U.04.3(2)",
        "description": "The adequate functioning of recovery functions is periodically tested by qualified personnel and the results are shared with the CSC.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.04.3(2)"
      },
      {
        "category": "U.05 Data protection",
        "name": "NL_BIO_Cloud_Theme_U.05.1(2)",
        "description": "Data transport is secured with cryptography to the latest state of the art (in accordance with the Forum for Standardization), whereby the key management is carried out by the CSC itself if possible.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.05.1(2)"
      },
      {
        "category": "U.05 Data protection",
        "name": "NL_BIO_Cloud_Theme_U.05.2(2)",
        "description": "Data stored in the cloud service shall be protected to the latest state of the art with encryption and with a key length sufficient at least for the purpose, whereby the key management is not purchased as a cloud service if possible and is carried out by the CSC itself.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.05.2(2)"
      },
      {
        "category": "U.07 Data separation",
        "name": "NL_BIO_Cloud_Theme_U.07.1(2)",
        "description": "Permanent isolation of data is realized within a multi-tenant architecture. Patches and adjustments of applications and infrastructure are realized in a controlled manner for all cloud services that the CSC purchases.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.07.1(2)"
      },
      {
        "category": "U.07 Data separation",
        "name": "NL_BIO_Cloud_Theme_U.07.3(2)",
        "description": "Isolation of CSC data is ensured by separating it at least logically from the data of other CSCs under all operating conditions.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.07.3(2)"
      },
      {
        "category": "U.09 Malware Protection",
        "name": "NL_BIO_Cloud_Theme_U.09.3(2)",
        "description": "The malware protection is carried out on various environments, such as on mail servers, (desktop) computers and when accessing the organization's network. The scan for malware includes: all files received over networks or through any form of storage medium, even before use; all attachments and downloads even before use; virtual machines; network traffic.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.09.3(2)"
      },
      {
        "category": "U.10 Access to IT services and data",
        "name": "NL_BIO_Cloud_Theme_U.10.2(2)",
        "description": "Under the responsibility of the CSP, administrators shall be granted access: to data with the least privilege principle; to data with the need-to-know principle; with multi-factor authentication; to data and application functions via technical measures.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.10.2(2)"
      },
      {
        "category": "U.10 Access to IT services and data",
        "name": "NL_BIO_Cloud_Theme_U.10.3(2)",
        "description": "Only users with authenticated equipment can access IT services and data.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.10.3(2)"
      },
      {
        "category": "U.10 Access to IT services and data",
        "name": "NL_BIO_Cloud_Theme_U.10.5(2)",
        "description": "Under the responsibility of the CSP, privileges (system authorisations) for users are granted through formal procedures.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.10.5(2)"
      },
      {
        "category": "U.11 Cryptoservices",
        "name": "NL_BIO_Cloud_Theme_U.11.1(2)",
        "description": "The cryptography policy includes at least the following topics: when cryptography is used; who is responsible for the implementation of cryptology; who is responsible for key management; which standards serve as a basis for cryptography and the way in which the standards of the Standardisation Forum are applied; the way in which the level of protection is determined; in the case of communication between organizations, the policy is determined among themselves.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.11.1(2)"
      },
      {
        "category": "U.11 Cryptoservices",
        "name": "NL_BIO_Cloud_Theme_U.11.2(2)",
        "description": "In the case of PKIoverheid certificates: apply the PKIoverheid requirements with regard to key management. In other situations: use the ISO 11770 standard for managing cryptographic keys.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.11.2(2)"
      },
      {
        "category": "U.11 Cryptoservices",
        "name": "NL_BIO_Cloud_Theme_U.11.3(2)",
        "description": "Sensitive data (on transport and at rest) is always encrypted, with private keys managed by the CSC. The use of a private key by the CSP is based on a controlled procedure and must be jointly agreed with the CSC organisation.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.11.3(2)"
      },
      {
        "category": "U.12 Interfaces",
        "name": "NL_BIO_Cloud_Theme_U.12.1(2)",
        "description": "In connection points with external or untrusted zones, measures have been taken to identify and respond to possible attacks that negatively affect the availability of information (e.g. Distributed Denial of Service attacks (DDos) attacks).",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.12.1(2)"
      },
      {
        "category": "U.12 Interfaces",
        "name": "NL_BIO_Cloud_Theme_U.12.2(2)",
        "description": "Physical and virtualized network components are designed and configured in such a way that network connections between trusted and untrusted networks are limited and monitored (monitored).",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.12.2(2)"
      },
      {
        "category": "U.15 Logging and monitoring",
        "name": "NL_BIO_Cloud_Theme_U.15.1(2)",
        "description": "The violation of the policy rules is recorded by the CSP and the CSC.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.15.1(2)"
      },
      {
        "category": "U.15 Logging and monitoring",
        "name": "NL_BIO_Cloud_Theme_U.15.3(2)",
        "description": "The CSP maintains a list of all assets that are critical in terms of logging and monitoring and regularly reviews this list for correctness.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.15.3(2)"
      },
      {
        "category": "U.17 Multi-tenant architecture",
        "name": "NL_BIO_Cloud_Theme_U.17.1(2)",
        "description": "CSC data on transport and at rest is encrypted.",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/NL_BIO_Cloud_Theme_U.17.1(2)"
      }
    ],
    "parameters": {
      "allowedContainerImagesRegex-1": {
        "type": "String",
        "metadata": {
          "displayName": "Allowed registry or registries regex",
          "description": "The RegEx rule used to match allowed container image field in a Kubernetes cluster. For example, to allow any Azure Container Registry image by matching partial path: ^[^\\/]+\\.azurecr\\.io\\/.+$ and for multiple registries: ^([^\\/]+\\.azurecr\\.io|registry\\.io)\\/.+$",
          "portalReview": true
        }
      },
      "effects-1": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "The effect determines what happens when the policy rule is evaluated to match."
        },
        "allowedValues": [
          "Audit",
          "Disabled"
        ],
        "defaultValue": "Audit"
      },
      "supplementalGroupsRule-1": {
        "type": "String",
        "metadata": {
          "displayName": "Supplemental group rule",
          "description": "The 'SupplementalGroups' rule that containers are allowed to run with. MustRunAs requires at least one range to be specified. MayRunAs does not require that 'SupplementalGroups' be specified. RunAsAny allows any",
          "portalReview": true
        },
        "allowedValues": [
          "MustRunAs",
          "MayRunAs",
          "RunAsAny"
        ],
        "defaultValue": "RunAsAny"
      },
      "LinuxJavaVersion-1": {
        "type": "String",
        "metadata": {
          "displayName": "Linux Java version",
          "description": "Specify a supported Java version for App Service"
        },
        "defaultValue": ""
      },
      "allowedServicePortsList-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Allowed service ports list",
          "description": "The list of service ports allowed in a Kubernetes cluster. Array only accepts strings. Example: [\"443\", \"80\"]",
          "portalReview": true
        }
      },
      "evaluatedSkuNames-1": {
        "type": "Array",
        "metadata": {
          "displayName": "API Management SKU Names",
          "description": "List of API Management SKUs against which this policy will be evaluated."
        },
        "allowedValues": [
          "Developer",
          "Basic",
          "Standard",
          "Premium",
          "Consumption"
        ],
        "defaultValue": [
          "Developer",
          "Premium"
        ]
      },
      "minPort-1": {
        "type": "Integer",
        "metadata": {
          "displayName": "Min host port",
          "description": "The minimum value in the allowable host port range that pods can use in the host network namespace.",
          "portalReview": true
        },
        "defaultValue": 0
      },
      "supportedSKUs-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Supported SKUs",
          "description": "The list of SKUs that support software-based double encryption"
        },
        "allowedValues": [
          "DataBox",
          "DataBoxHeavy"
        ],
        "defaultValue": [
          "DataBox",
          "DataBoxHeavy"
        ]
      },
      "resourceGroupName-1": {
        "type": "String",
        "metadata": {
          "displayName": "NetworkWatcher resource group name",
          "description": "Name of the resource group of NetworkWatcher, such as NetworkWatcherRG. This is the resource group where the Network Watchers are located."
        },
        "defaultValue": "NetworkWatcherRG"
      },
      "runAsGroupRule-1": {
        "type": "String",
        "metadata": {
          "displayName": "Run as group rule",
          "description": "The 'RunAsGroup' rule that containers are allowed to run with. MustRunAs requires at least one range to be specified. MayRunAs does not require that 'RunAsGroup' be specified. RunAsAny allows any",
          "portalReview": true
        },
        "allowedValues": [
          "MustRunAs",
          "MayRunAs",
          "RunAsAny"
        ],
        "defaultValue": "RunAsAny"
      },
      "enableDoubleEncryption-1": {
        "type": "Boolean",
        "metadata": {
          "displayName": "Double encryption should be enabled on Recovery Services vaults for Backup",
          "description": "Check if double encryption is enabled on Recovery Services vaults for Backup.  For more details refer to https://aka.ms/AB-InfraEncryption."
        },
        "allowedValues": [
          true,
          false
        ],
        "defaultValue": false
      },
      "scopeToSupportedImages-1": {
        "type": "Boolean",
        "metadata": {
          "displayName": "Scope Policy to Azure Monitor Agent-Supported Operating Systems",
          "description": "If set to true, the policy will apply only to virtual machines with supported operating systems. Otherwise, the policy will apply to all virtual machine resources in the assignment scope. For supported operating systems, see https://aka.ms/AMAOverview."
        },
        "allowedValues": [
          true,
          false
        ],
        "defaultValue": true
      },
      "MinimumTLSVersion-1": {
        "type": "String",
        "metadata": {
          "displayName": "Minimum TLS version",
          "description": "The minimum TLS protocol version that should be enabled. Windows machines with lower TLS versions will be marked as non-compliant."
        },
        "allowedValues": [
          "1.1",
          "1.2"
        ],
        "defaultValue": "1.2"
      },
      "excludedNamespaces-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Namespace exclusions",
          "description": "List of Kubernetes namespaces to exclude from policy evaluation. System namespaces \"kube-system\", \"gatekeeper-system\" and \"azure-arc\" are always excluded by design. \"azure-extensions-usage-system\" is optional to remove."
        },
        "defaultValue": [
          "kube-system",
          "gatekeeper-system",
          "azure-arc",
          "azure-extensions-usage-system"
        ]
      },
      "setting-1": {
        "type": "String",
        "metadata": {
          "displayName": "Desired Auditing setting"
        },
        "allowedValues": [
          "enabled",
          "disabled"
        ],
        "defaultValue": "enabled"
      },
      "allowedCapabilities-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Allowed capabilities",
          "description": "The list of capabilities that are allowed to be added to a container. Provide empty list as input to block everything.",
          "portalReview": true
        },
        "defaultValue": []
      },
      "listOfResourceTypes-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Resource Types",
          "strongType": "resourceTypes"
        }
      },
      "allowedIPAddresses-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Allowed IP addresses",
          "description": "Array with allowed public IP addresses. An empty array is evaluated as to allow all IPs."
        },
        "defaultValue": []
      },
      "IncludeArcMachines-1": {
        "type": "String",
        "metadata": {
          "displayName": "Include Arc connected servers",
          "description": "By selecting this option, you agree to be charged monthly per Arc connected machine.",
          "portalReview": "true"
        },
        "allowedValues": [
          "true",
          "false"
        ],
        "defaultValue": "false"
      },
      "requiredRetentionDays-1": {
        "type": "String",
        "metadata": {
          "displayName": "Required retention (days)",
          "description": "The required resource logs retention (in days)"
        },
        "defaultValue": "365"
      },
      "source-1": {
        "type": "String",
        "metadata": {
          "displayName": "Source",
          "description": "The source k8s object for constraint evaluation. 'Original' means only evaluate against the specific GroupVersionKind specified in the policy definition. 'Generated' means only evaluate against k8s objects generated by Gatekeeper ExpansionTemplates. 'All' means evaluate against both the original object and any generated ones."
        },
        "allowedValues": [
          "All",
          "Generated",
          "Original"
        ],
        "defaultValue": "Original"
      },
      "allowHostNetwork-1": {
        "type": "Boolean",
        "metadata": {
          "displayName": "Allow host network usage",
          "description": "Set this value to true if pod is allowed to use host network otherwise false.",
          "portalReview": true
        },
        "defaultValue": false
      },
      "NotAvailableMachineState-1": {
        "type": "String",
        "metadata": {
          "displayName": "Status if Windows Defender is not available on machine",
          "description": "Windows Defender Exploit Guard is only available starting with Windows 10/Windows Server with update 1709. Setting this value to 'Non-Compliant' shows machines with older versions on which Windows Defender Exploit Guard is not available (such as Windows Server 2012 R2) as non-compliant. Setting this value to 'Compliant' shows these machines as compliant."
        },
        "allowedValues": [
          "Compliant",
          "Non-Compliant"
        ],
        "defaultValue": "Compliant"
      },
      "runAsUserRanges-1": {
        "type": "Object",
        "metadata": {
          "displayName": "Allowed user ID ranges",
          "description": "The user ID ranges that are allowed for containers to use. Set 'max' as '-1' to skip max limit evaluation. Empty array blocks every defined value for 'MustRunAs'.",
          "portalReview": true
        },
        "defaultValue": {
          "ranges": []
        },
        "schema": {
          "type": "object",
          "properties": {
            "ranges": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "min": {
                    "type": "integer"
                  },
                  "max": {
                    "type": "integer"
                  }
                },
                "required": [
                  "min",
                  "max"
                ],
                "additionalProperties": false
              }
            }
          },
          "required": [
            "ranges"
          ],
          "additionalProperties": false
        }
      },
      "fsGroupRule-1": {
        "type": "String",
        "metadata": {
          "displayName": "File system group rule",
          "description": "The 'FSGroup' rule that containers are allowed to run with. MustRunAs requires at least one range to be specified. MayRunAs does not require that 'FSGroup' be specified. RunAsAny allows any",
          "portalReview": true
        },
        "allowedValues": [
          "MustRunAs",
          "MayRunAs",
          "RunAsAny"
        ],
        "defaultValue": "RunAsAny"
      },
      "runAsUserRule-1": {
        "type": "String",
        "metadata": {
          "displayName": "Run as user rule",
          "description": "The 'RunAsUser' rule that containers are allowed to run with. MustRunAs requires at least one range to be specified. MustRunAsNonRoot requires the pod be submitted with non-zero runAsUser or have USER directive defined (using a numeric UID) in the image. RunAsAny allows any runAsUser to be specified",
          "portalReview": true
        },
        "allowedValues": [
          "MustRunAs",
          "MustRunAsNonRoot",
          "RunAsAny"
        ],
        "defaultValue": "MustRunAsNonRoot"
      },
      "requiredDropCapabilities-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Required drop capabilities",
          "description": "The list of capabilities that must be dropped by a container.",
          "portalReview": true
        },
        "defaultValue": []
      },
      "allowedProfiles-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Allowed AppArmor profiles",
          "description": "The list of AppArmor profiles that containers are allowed to use. E.g. [ \"runtime/default\", \"docker/default\" ]. Provide empty list as input to block everything.",
          "portalReview": true
        },
        "defaultValue": [
          "runtime/default"
        ]
      },
      "listOfAllowedLocations-1": {
        "type": "Array",
        "metadata": {
          "description": "The list of locations that resource groups can be created in.",
          "strongType": "location",
          "displayName": "Allowed locations"
        }
      },
      "metricsEnabled-1": {
        "type": "Boolean",
        "metadata": {
          "displayName": "Metrics Enabled"
        },
        "allowedValues": [
          true,
          false
        ],
        "defaultValue": true
      },
      "listOfImageIdToInclude_linux-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Optional: List of virtual machine images that have supported Linux OS to add to scope",
          "description": "Example value: '/subscriptions/<subscriptionId>/resourceGroups/YourResourceGroup/providers/Microsoft.Compute/images/ContosoStdImage'"
        },
        "defaultValue": []
      },
      "excludedImages-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Image exclusions",
          "description": "The list of InitContainers and Containers to exclude from policy evaluation. The identifier is the image of container. Prefix-matching can be signified with `*`. For example: `myregistry.azurecr.io/istio:*`. It is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name) in order to avoid unexpectedly exempting images from an untrusted repository.",
          "portalReview": true
        },
        "defaultValue": []
      },
      "forbiddenIPAddresses-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Forbidden IP addresses",
          "description": "Array with forbidden public IP addresses. An empty array is evaluated as there are no forbidden IP addresses."
        },
        "defaultValue": []
      },
      "memoryLimit-1": {
        "type": "String",
        "metadata": {
          "displayName": "Max allowed memory bytes",
          "description": "The maximum memory bytes allowed for a container. E.g. 1Gi. For more information, please refer https://aka.ms/k8s-policy-pod-limits",
          "portalReview": true
        }
      },
      "fsGroupRanges-1": {
        "type": "Object",
        "metadata": {
          "displayName": "Allowed file system group ID ranges",
          "description": "The file system group ranges that are allowed for pods to use. Set 'max' as '-1' to skip max limit evaluation. Empty array blocks every defined value for 'MustRunAs' and 'MayRunAs'.",
          "portalReview": true
        },
        "defaultValue": {
          "ranges": []
        },
        "schema": {
          "type": "object",
          "properties": {
            "ranges": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "min": {
                    "type": "integer"
                  },
                  "max": {
                    "type": "integer"
                  }
                },
                "required": [
                  "min",
                  "max"
                ],
                "additionalProperties": false
              }
            }
          },
          "required": [
            "ranges"
          ],
          "additionalProperties": false
        }
      },
      "maxPort-1": {
        "type": "Integer",
        "metadata": {
          "displayName": "Max host port",
          "description": "The maximum value in the allowable host port range that pods can use in the host network namespace.",
          "portalReview": true
        },
        "defaultValue": 0
      },
      "LinuxPythonVersion-1": {
        "type": "String",
        "metadata": {
          "displayName": "Linux Python version",
          "description": "Specify a supported Python version for App Service"
        },
        "defaultValue": ""
      },
      "namespaces-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Namespace inclusions",
          "description": "List of Kubernetes namespaces to only include in policy evaluation. An empty list means the policy is applied to all resources in all namespaces."
        },
        "defaultValue": []
      },
      "restrictIPAddresses-1": {
        "type": "String",
        "metadata": {
          "displayName": "Would you like to restrict specific IP addresses?",
          "description": "Select (Yes) to allow or forbid a list of IP addresses. If (No), the list of IP addresses won't have any effect in the policy enforcement"
        },
        "allowedValues": [
          "Yes",
          "No"
        ],
        "defaultValue": "No"
      },
      "LinuxPHPVersion-1": {
        "type": "String",
        "metadata": {
          "displayName": "Linux PHP version",
          "description": "Specify a supported PHP version for App Service"
        },
        "defaultValue": ""
      },
      "labelSelector-1": {
        "type": "Object",
        "metadata": {
          "displayName": "Kubernetes label selector",
          "description": "Label query to select Kubernetes resources for policy evaluation. An empty label selector matches all Kubernetes resources."
        },
        "defaultValue": {},
        "schema": {
          "description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all resources.",
          "type": "object",
          "properties": {
            "matchLabels": {
              "description": "matchLabels is a map of {key,value} pairs.",
              "type": "object",
              "additionalProperties": {
                "type": "string"
              },
              "minProperties": 1
            },
            "matchExpressions": {
              "description": "matchExpressions is a list of values, a key, and an operator.",
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "key": {
                    "description": "key is the label key that the selector applies to.",
                    "type": "string"
                  },
                  "operator": {
                    "description": "operator represents a key's relationship to a set of values.",
                    "type": "string",
                    "enum": [
                      "In",
                      "NotIn",
                      "Exists",
                      "DoesNotExist"
                    ]
                  },
                  "values": {
                    "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.",
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  }
                },
                "required": [
                  "key",
                  "operator"
                ],
                "additionalProperties": false
              },
              "minItems": 1
            }
          },
          "additionalProperties": false
        }
      },
      "cpuLimit-1": {
        "type": "String",
        "metadata": {
          "displayName": "Max allowed CPU units",
          "description": "The maximum CPU units allowed for a container. E.g. 200m. For more information, please refer https://aka.ms/k8s-policy-pod-limits",
          "portalReview": true
        }
      },
      "allowedHostPaths-1": {
        "type": "Object",
        "metadata": {
          "displayName": "Allowed host paths",
          "description": "The host paths allowed for pod hostPath volumes to use. Provide an empty paths list to block all host paths.",
          "portalReview": true
        },
        "defaultValue": {
          "paths": []
        },
        "schema": {
          "type": "object",
          "properties": {
            "paths": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "pathPrefix": {
                    "type": "string"
                  },
                  "readOnly": {
                    "type": "boolean"
                  }
                },
                "required": [
                  "pathPrefix",
                  "readOnly"
                ],
                "additionalProperties": false
              }
            }
          },
          "required": [
            "paths"
          ],
          "additionalProperties": false
        }
      },
      "supplementalGroupsRanges-1": {
        "type": "Object",
        "metadata": {
          "displayName": "Allowed supplemental group ID ranges",
          "description": "The supplemental group ID ranges that are allowed for containers to use. Set 'max' as '-1' to skip max limit evaluation. Empty array blocks every defined value for 'MustRunAs' and 'MayRunAs'.",
          "portalReview": true
        },
        "defaultValue": {
          "ranges": []
        },
        "schema": {
          "type": "object",
          "properties": {
            "ranges": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "min": {
                    "type": "integer"
                  },
                  "max": {
                    "type": "integer"
                  }
                },
                "required": [
                  "min",
                  "max"
                ],
                "additionalProperties": false
              }
            }
          },
          "required": [
            "ranges"
          ],
          "additionalProperties": false
        }
      },
      "excludedKinds-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Excluded Kinds",
          "description": "The list of excluded API kinds for customer-managed key, default is the list of API kinds that don't have data stored in Cognitive Services"
        },
        "defaultValue": [
          "CognitiveServices",
          "ContentSafety",
          "ImmersiveReader",
          "HealthInsights",
          "LUIS.Authoring",
          "LUIS",
          "QnAMaker",
          "QnAMaker.V2",
          "AIServices",
          "MetricsAdvisor",
          "SpeechTranslation",
          "Internal.AllInOne",
          "ConversationalLanguageUnderstanding",
          "knowledge",
          "TranscriptionIntelligence",
          "HealthDecisionSupport"
        ]
      },
      "runAsGroupRanges-1": {
        "type": "Object",
        "metadata": {
          "displayName": "Allowed group ID ranges",
          "description": "The group ID ranges that are allowed for containers to use. Set 'max' as '-1' to skip max limit evaluation. Empty array blocks every defined value for 'MustRunAs' and 'MayRunAs'.",
          "portalReview": true
        },
        "defaultValue": {
          "ranges": []
        },
        "schema": {
          "type": "object",
          "properties": {
            "ranges": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "min": {
                    "type": "integer"
                  },
                  "max": {
                    "type": "integer"
                  }
                },
                "required": [
                  "min",
                  "max"
                ],
                "additionalProperties": false
              }
            }
          },
          "required": [
            "ranges"
          ],
          "additionalProperties": false
        }
      },
      "warn-1": {
        "type": "Boolean",
        "metadata": {
          "displayName": "Warn",
          "description": "Whether or not to return warnings back to the user in the kubectl cli"
        },
        "defaultValue": false
      },
      "listOfImageIdToInclude_windows-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Optional: List of virtual machine images that have supported Windows OS to add to scope",
          "description": "Example value: '/subscriptions/<subscriptionId>/resourceGroups/YourResourceGroup/providers/Microsoft.Compute/images/ContosoStdImage'"
        },
        "defaultValue": []
      },
      "listOfLinuxImageIdToInclude-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Additional Virtual Machine Images",
          "description": "List of virtual machine images that have supported Linux OS to add to scope. Example values: '/subscriptions/<subscriptionId>/resourceGroups/YourResourceGroup/providers/Microsoft.Compute/images/ContosoStdImage'"
        },
        "defaultValue": []
      },
      "logsEnabled-1": {
        "type": "Boolean",
        "metadata": {
          "displayName": "Logs Enabled"
        },
        "allowedValues": [
          true,
          false
        ],
        "defaultValue": true
      },
      "excludedContainers-1": {
        "type": "Array",
        "metadata": {
          "displayName": "Containers exclusions",
          "description": "The list of InitContainers and Containers to exclude from policy evaluation. The identify is the name of container. Use an empty list to apply this policy to all containers in all namespaces."
        },
        "defaultValue": []
      }
    },
    "policyDefinitions": [
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Allowed locations for resource groups",
        "parameters": {
          "listOfAllowedLocations": {
            "value": "[parameters('listOfAllowedLocations-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_B.01.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e765b5de-1225-4ba3-bd56-1ac6695af988"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Allowed locations",
        "parameters": {
          "listOfAllowedLocations": {
            "value": "[parameters('listOfAllowedLocations-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_B.01.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/22bee202-a82f-4305-9a2a-6d7f44d4dedb",
        "parameters": {},
        "policyDefinitionReferenceId": "Only secure connections to your Azure Cache for Redis should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_B.09.1(2)",
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9",
        "parameters": {},
        "policyDefinitionReferenceId": "Secure transfer to storage accounts should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_B.09.1(2)",
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4f11b553-d42e-4e3a-89be-32ca364cad4c",
        "parameters": {},
        "policyDefinitionReferenceId": "A maximum of 3 owners should be designated for your subscription",
        "groupNames": [
          "NL_BIO_Cloud_Theme_B.10.2(2)",
          "NL_BIO_Cloud_Theme_B.10.3(2)",
          "NL_BIO_Cloud_Theme_B.10.4(2)",
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)",
          "NL_BIO_Cloud_Theme_U.17.1(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/09024ccc-0c5f-475e-9457-b7c0d9ed487b",
        "parameters": {},
        "policyDefinitionReferenceId": "There should be more than one owner assigned to your subscription",
        "groupNames": [
          "NL_BIO_Cloud_Theme_B.10.2(2)",
          "NL_BIO_Cloud_Theme_B.10.3(2)",
          "NL_BIO_Cloud_Theme_B.10.4(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.17.1(2)"
        ]
      },
      {
        "definitionVersion": "4.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/feedbf84-6b99-488c-acc2-71c829aa5ffc",
        "parameters": {},
        "policyDefinitionReferenceId": "SQL databases should have vulnerability findings resolved",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_C.04.8(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/501541f7-f7e7-4cd6-868c-4190fdad3ac9",
        "parameters": {},
        "policyDefinitionReferenceId": "A vulnerability assessment solution should be enabled on your virtual machines",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_C.04.8(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4da35fc9-c9e7-4960-aec9-797fe7d9051d",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Defender for servers should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0049a6b3-a662-4f3e-8635-39cf44ace45a",
        "parameters": {},
        "policyDefinitionReferenceId": "Vulnerability assessment should be enabled on your Synapse workspaces",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_U.17.1(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0e6763cc-5078-4e64-889d-ff4d9a839047",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Defender for Key Vault should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1c988dd6-ade4-430f-a608-2a3e5b0a6d38",
        "parameters": {},
        "policyDefinitionReferenceId": "Microsoft Defender for Containers should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2913021d-f2fd-4f3d-b958-22354e2bdbcb",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Defender for App Service should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6581d072-105e-4418-827f-bd446d56421b",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Defender for SQL servers on machines should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c3d20c29-b36d-48fe-808b-99a87530ad99",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Defender for Resource Manager should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7fe3b40f-802b-4cdd-8bd4-fd799c948cc2",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Defender for Azure SQL Database servers should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "4.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e2c1c086-2d84-4019-bff3-c44ccd95113c",
        "parameters": {},
        "policyDefinitionReferenceId": "Function apps should use latest -HTTP Version-",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fb893a29-21bb-418c-a157-e99480ec364c",
        "parameters": {},
        "policyDefinitionReferenceId": "Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/496223c3-ad65-4ecd-878a-bae78737e9ed",
        "parameters": {
          "LinuxJavaVersion": {
            "value": "[parameters('LinuxJavaVersion-1')]"
          }
        },
        "policyDefinitionReferenceId": "App Service apps that use Java should use a specified -Java version-",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ]
      },
      {
        "definitionVersion": "4.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7008174a-fd10-4ef0-817e-fc820a951d73",
        "parameters": {
          "LinuxPythonVersion": {
            "value": "[parameters('LinuxPythonVersion-1')]"
          }
        },
        "policyDefinitionReferenceId": "App Service apps that use Python should use a specified -Python version-",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ]
      },
      {
        "definitionVersion": "4.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7238174a-fd10-4ef0-817e-fc820a951d73",
        "parameters": {
          "LinuxPythonVersion": {
            "value": "[parameters('LinuxPythonVersion-1')]"
          }
        },
        "policyDefinitionReferenceId": "Function apps that use Python should use a specified -Python version-",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7261b898-8a84-4db8-9e04-18527132abb3",
        "parameters": {
          "LinuxPHPVersion": {
            "value": "[parameters('LinuxPHPVersion-1')]"
          }
        },
        "policyDefinitionReferenceId": "App Service apps that use PHP should use a specified -PHP version-",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ]
      },
      {
        "definitionVersion": "4.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8c122334-9d20-4eb8-89ea-ac9a705b74ae",
        "parameters": {},
        "policyDefinitionReferenceId": "App Service apps should use latest -HTTP Version-",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc",
        "parameters": {
          "LinuxJavaVersion": {
            "value": "[parameters('LinuxJavaVersion-1')]"
          }
        },
        "policyDefinitionReferenceId": "Function apps that use Java should use a specified -Java version-",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6ba6d016-e7c3-4842-b8f2-4992ebc0d72d",
        "parameters": {},
        "policyDefinitionReferenceId": "SQL servers on machines should have vulnerability findings resolved",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_C.04.8(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bed48b13-6647-468e-aa2f-1af1d3f4dd40",
        "parameters": {
          "IncludeArcMachines": {
            "value": "[parameters('IncludeArcMachines-1')]"
          },
          "NotAvailableMachineState": {
            "value": "[parameters('NotAvailableMachineState-1')]"
          }
        },
        "policyDefinitionReferenceId": "Windows Defender Exploit Guard should be enabled on your machines",
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.3(2)",
          "NL_BIO_Cloud_Theme_C.04.6(2)",
          "NL_BIO_Cloud_Theme_C.04.7(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Machine Learning compute instances should be recreated to get the latest software updates",
        "parameters": {
          "effects": {
            "value": "[parameters('effects-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.6(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f110a506-2dcb-422e-bcea-d533fc8c35e2"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Policy Add-on for Kubernetes service (AKS) should be installed and enabled on your clusters",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0a15ec92-a229-4763-bb14-0ea34a568f8d"
      },
      {
        "definitionVersion": "9.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster containers should only use allowed images",
        "parameters": {
          "allowedContainerImagesRegex": {
            "value": "[parameters('allowedContainerImagesRegex-1')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/febd0533-8e55-448f-b837-bd0e06f16469"
      },
      {
        "definitionVersion": "9.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster should not allow privileged containers",
        "parameters": {
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/95edb821-ddaf-4404-9732-666045e056b4"
      },
      {
        "definitionVersion": "8.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster services should listen only on allowed ports",
        "parameters": {
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "allowedServicePortsList": {
            "value": "[parameters('allowedServicePortsList-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/233a2a17-77ca-4fb1-9b6b-69223d272a44"
      },
      {
        "definitionVersion": "9.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster containers CPU and memory resource limits should not exceed the specified limits",
        "parameters": {
          "cpuLimit": {
            "value": "[parameters('cpuLimit-1')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "memoryLimit": {
            "value": "[parameters('memoryLimit-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e345eecc-fa47-480f-9e88-67dcc122b164"
      },
      {
        "definitionVersion": "6.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster pods and containers should only run with approved user and group IDs",
        "parameters": {
          "source": {
            "value": "[parameters('source-1')]"
          },
          "fsGroupRule": {
            "value": "[parameters('fsGroupRule-1')]"
          },
          "fsGroupRanges": {
            "value": "[parameters('fsGroupRanges-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "runAsUserRanges": {
            "value": "[parameters('runAsUserRanges-1')]"
          },
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "runAsUserRule": {
            "value": "[parameters('runAsUserRule-1')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          },
          "runAsGroupRule": {
            "value": "[parameters('runAsGroupRule-1')]"
          },
          "runAsGroupRanges": {
            "value": "[parameters('runAsGroupRanges-1')]"
          },
          "supplementalGroupsRule": {
            "value": "[parameters('supplementalGroupsRule-1')]"
          },
          "supplementalGroupsRanges": {
            "value": "[parameters('supplementalGroupsRanges-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f06ddb64-5fa3-4b77-b166-acb36f7f6042"
      },
      {
        "definitionVersion": "7.*.*",
        "policyDefinitionReferenceId": "Kubernetes clusters should not allow container privilege escalation",
        "parameters": {
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1c6e92c9-99f0-4e55-9cf2-0c234dc48f99"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster containers should not share host process ID or host IPC namespace",
        "parameters": {
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8"
      },
      {
        "definitionVersion": "6.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster containers should run with a read only root file system",
        "parameters": {
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/df49d893-a74c-421d-bc95-c663042e5b80"
      },
      {
        "definitionVersion": "6.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster containers should only use allowed capabilities",
        "parameters": {
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "allowedCapabilities": {
            "value": "[parameters('allowedCapabilities-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "requiredDropCapabilities": {
            "value": "[parameters('requiredDropCapabilities-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c26596ff-4d70-4e6a-9a30-c2506bd2f80c"
      },
      {
        "definitionVersion": "6.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster containers should only use allowed AppArmor profiles",
        "parameters": {
          "allowedProfiles": {
            "value": "[parameters('allowedProfiles-1')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/511f5417-5d12-434d-ab2e-816901e72a5e"
      },
      {
        "definitionVersion": "6.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster pods should only use approved host network and port range",
        "parameters": {
          "allowHostNetwork": {
            "value": "[parameters('allowHostNetwork-1')]"
          },
          "maxPort": {
            "value": "[parameters('maxPort-1')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "minPort": {
            "value": "[parameters('minPort-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/82985f06-dc18-4a48-bc1c-b9f4f0098cfe"
      },
      {
        "definitionVersion": "6.*.*",
        "policyDefinitionReferenceId": "Kubernetes cluster pod hostPath volumes should only use allowed host paths",
        "parameters": {
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "allowedHostPaths": {
            "value": "[parameters('allowedHostPaths-1')]"
          },
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/098fc59e-46c7-4d99-9b16-64990e543d75"
      },
      {
        "definitionVersion": "4.*.*",
        "policyDefinitionReferenceId": "Kubernetes clusters should not use the default namespace",
        "parameters": {
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9f061a12-e40d-4183-a00e-171812443373"
      },
      {
        "definitionVersion": "4.*.*",
        "policyDefinitionReferenceId": "Kubernetes clusters should disable automounting API credentials",
        "parameters": {
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/423dd1ba-798e-40e4-9c4d-b6902674b423"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Kubernetes clusters should not grant CAP_SYS_ADMIN security capabilities",
        "parameters": {
          "excludedImages": {
            "value": "[parameters('excludedImages-1')]"
          },
          "excludedContainers": {
            "value": "[parameters('excludedContainers-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d2e7ea85-6b44-4317-a0be-1b951587f626"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Function apps should have remote debugging turned off",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0e60b895-3786-45da-8377-9c6b4b6ac5f9"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "App Service apps should have remote debugging turned off",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cb510bfd-1cba-4d9f-a230-cb0976f4bb71"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Function apps should not have CORS configured to allow every resource to access your apps",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0820b7b9-23aa-4725-a1ce-ae4558f718e5"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "App Service apps should not have CORS configured to allow every resource to access your apps",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5744710e-cc2f-4ee8-8809-3b11e89f4bc9"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/17f4b1cc-c55c-4d94-b1f9-2978f6ac2957"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Azure Kubernetes Service clusters should have Defender profile enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.04.7(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a1840de2-8088-4ea8-b153-b4c723e9cb01"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Subscriptions should have a contact email address for security issues",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.05.5(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Email notification for high severity alerts should be enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.05.5(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6e2593d9-add6-4083-9c9b-4b7d2188c899"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Email notification to subscription owner for high severity alerts should be enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_C.05.5(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0b15565f-aa9e-48ba-8619-45960f2c314d"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Geo-redundant backup should be enabled for Azure Database for MySQL",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.03(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/82339799-d096-41ae-8538-b108becf0970"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Geo-redundant backup should be enabled for Azure Database for PostgreSQL",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.03(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/48af4db5-9b8b-401c-8e74-076be876a430"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Geo-redundant backup should be enabled for Azure Database for MariaDB",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.03(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0ec47710-77ff-4a3d-9181-6aa50af424d0"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56",
        "parameters": {},
        "policyDefinitionReferenceId": "Audit virtual machines without disaster recovery configured",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.03.1(2)",
          "NL_BIO_Cloud_Theme_U.03.2(2)",
          "NL_BIO_Cloud_Theme_U.04.1(2)",
          "NL_BIO_Cloud_Theme_U.04.2(2)",
          "NL_BIO_Cloud_Theme_U.04.3(2)",
          "NL_BIO_Cloud_Theme_U.17.1(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/013e242c-8828-4970-87b3-ab247555486d",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Backup should be enabled for Virtual Machines",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.03.1(2)",
          "NL_BIO_Cloud_Theme_U.03.2(2)",
          "NL_BIO_Cloud_Theme_U.17.1(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0b60c0b2-2dc2-4e1c-b5c9-abbed971de53",
        "parameters": {},
        "policyDefinitionReferenceId": "Key vaults should have deletion protection enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.04.1(2)",
          "NL_BIO_Cloud_Theme_U.04.2(2)",
          "NL_BIO_Cloud_Theme_U.04.3(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d",
        "parameters": {},
        "policyDefinitionReferenceId": "Key vaults should have soft delete enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.04.1(2)",
          "NL_BIO_Cloud_Theme_U.04.2(2)",
          "NL_BIO_Cloud_Theme_U.04.3(2)"
        ]
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab",
        "parameters": {},
        "policyDefinitionReferenceId": "Function apps should only be accessible over HTTPS",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "4.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a4af4a39-4135-47fb-b175-47fbdf85311d",
        "parameters": {},
        "policyDefinitionReferenceId": "App Service apps should only be accessible over HTTPS",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/08a6b96f-576e-47a2-8511-119a212d344d",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Edge Hardware Center devices should have double encryption support enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1760f9d4-7206-436e-a28f-d9f3a5c8a227",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Batch pools should have disk encryption enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d9da03a1-f3c3-412a-9709-947156872263",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure HDInsight clusters should use encryption in transit to encrypt communication between Azure HDInsight cluster nodes",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "8.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d",
        "parameters": {
          "warn": {
            "value": "[parameters('warn-1')]"
          },
          "namespaces": {
            "value": "[parameters('namespaces-1')]"
          },
          "source": {
            "value": "[parameters('source-1')]"
          },
          "excludedNamespaces": {
            "value": "[parameters('excludedNamespaces-1')]"
          },
          "labelSelector": {
            "value": "[parameters('labelSelector-1')]"
          }
        },
        "policyDefinitionReferenceId": "Kubernetes clusters should be accessible only over HTTPS",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/399b2637-a50f-4f95-96f8-3a145476eb15",
        "parameters": {},
        "policyDefinitionReferenceId": "Function apps should require FTPS only",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b",
        "parameters": {},
        "policyDefinitionReferenceId": "App Service apps should require FTPS only",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "4.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5752e6d6-1206-46d8-8ab1-ecc2f71a8112",
        "parameters": {
          "MinimumTLSVersion": {
            "value": "[parameters('MinimumTLSVersion-1')]"
          },
          "IncludeArcMachines": {
            "value": "[parameters('IncludeArcMachines-1')]"
          }
        },
        "policyDefinitionReferenceId": "Windows machines should be configured to use secure communication protocols",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d158790f-bfb0-486c-8631-2dc6b4e8e6af",
        "parameters": {},
        "policyDefinitionReferenceId": "Enforce SSL connection should be enabled for PostgreSQL database servers",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Azure SQL Database should be running TLS version 1.2 or newer",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/32e6bbec-16b6-44c2-be37-c5b672d103cf"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Front Door Standard and Premium should be running minimum TLS version of 1.2",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/679da822-78a7-4eff-8fff-a899454a9970"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e802a67a-daf5-4436-9ea6-f6d821dd0c5d",
        "parameters": {},
        "policyDefinitionReferenceId": "Enforce SSL connection should be enabled for MySQL database servers",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b",
        "parameters": {},
        "policyDefinitionReferenceId": "App Service apps should use the latest TLS version",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f9d614c5-c173-4d56-95a7-b4437057d193",
        "parameters": {},
        "policyDefinitionReferenceId": "Function apps should use the latest TLS version",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.1(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/17k78e20-9358-41c9-923c-fb736d382a12",
        "parameters": {},
        "policyDefinitionReferenceId": "Transparent Data Encryption on SQL databases should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1fd32ebd-e4c3-4e13-a54a-d7422d4d95f6",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure HDInsight clusters should use encryption at host to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/24fba194-95d6-48c0-aea7-f65bf859c598",
        "parameters": {},
        "policyDefinitionReferenceId": "Infrastructure encryption should be enabled for Azure Database for PostgreSQL servers",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3a58212a-c829-4f13-9872-6371df2fd0b4",
        "parameters": {},
        "policyDefinitionReferenceId": "Infrastructure encryption should be enabled for Azure Database for MySQL servers",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*-preview",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1c30f9cd-b84c-49cc-aa2c-9288447cc3b3",
        "parameters": {},
        "policyDefinitionReferenceId": "vTPM should be enabled on supported virtual machines",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "4.*.*-preview",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/97566dd7-78ae-4997-8b36-1c7bfe0d8121",
        "parameters": {},
        "policyDefinitionReferenceId": "Secure Boot should be enabled on supported Windows virtual machines",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "6.*.*-preview",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/672fe5a1-2fcd-42d7-b85d-902b6e28c6ff",
        "parameters": {},
        "policyDefinitionReferenceId": "Guest Attestation extension should be installed on supported Linux virtual machines",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "5.*.*-preview",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a21f8c92-9e22-4f09-b759-50500d1d2dda",
        "parameters": {},
        "policyDefinitionReferenceId": "Guest Attestation extension should be installed on supported Linux virtual machines scale sets",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "4.*.*-preview",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1cb4d9c2-f88f-4069-bee0-dba239a57b09",
        "parameters": {},
        "policyDefinitionReferenceId": "Guest Attestation extension should be installed on supported Windows virtual machines",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*-preview",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f655e522-adff-494d-95c2-52d4f6d56a42",
        "parameters": {},
        "policyDefinitionReferenceId": "Guest Attestation extension should be installed on supported Windows virtual machines scale sets",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fc4d8e41-e223-45ea-9bf5-eada37891d87",
        "parameters": {},
        "policyDefinitionReferenceId": "Virtual machines and virtual machine scale sets should have encryption at host enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ec068d99-e9c7-401f-8cef-5bdde4e6ccf1",
        "parameters": {},
        "policyDefinitionReferenceId": "Double encryption should be enabled on Azure Data Explorer",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c349d81b-9985-44ae-a8da-ff98d108ede8",
        "parameters": {
          "supportedSKUs": {
            "value": "[parameters('supportedSKUs-1')]"
          }
        },
        "policyDefinitionReferenceId": "Azure Data Box jobs should enable double encryption for data at rest on the device",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ea0dfaed-95fb-448c-934e-d6e713ce393d",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Monitor Logs clusters should be created with infrastructure-encryption enabled (double encryption)",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4733ea7b-a883-42fe-8cac-97454c2a9e4a",
        "parameters": {},
        "policyDefinitionReferenceId": "Storage accounts should have infrastructure encryption",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f4b53539-8df9-40e4-86c6-6b607703bd4e",
        "parameters": {},
        "policyDefinitionReferenceId": "Disk encryption should be enabled on Azure Data Explorer",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/41425d9f-d1a5-499a-9932-f8ed8453932c",
        "parameters": {},
        "policyDefinitionReferenceId": "Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/051cba44-2429-45b9-9649-46cec11c7119",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure API for FHIR should use a customer-managed key to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0a370ff3-6cab-4e85-8995-295fd854c5b8",
        "parameters": {},
        "policyDefinitionReferenceId": "SQL servers should use customer-managed keys to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0aa61e00-0a01-4a3c-9945-e93cffedf0e6",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Container Instance container group should use customer-managed key for encryption",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/18adea5e-f416-4d0f-8aa8-d24321e3e274",
        "parameters": {},
        "policyDefinitionReferenceId": "PostgreSQL servers should use customer-managed keys to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1f68a601-6e6d-4e42-babf-3f643a047ea2",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Monitor Logs clusters should be encrypted with customer-managed key",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1f905d99-2ab7-462c-a6b0-f709acca6c8f",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Cosmos DB accounts should use customer-managed keys to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1fafeaf6-7927-4059-a50a-8eb2a7a6f2b5",
        "parameters": {},
        "policyDefinitionReferenceId": "Logic Apps Integration Service Environment should be encrypted with customer-managed keys",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/295fc8b1-dc9f-4f53-9c61-3f313ceab40a",
        "parameters": {},
        "policyDefinitionReferenceId": "Service Bus Premium namespaces should use a customer-managed key for encryption",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*-preview",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2e94d99a-8a36-4563-bc77-810d8893b671",
        "parameters": {
          "enableDoubleEncryption": {
            "value": "[parameters('enableDoubleEncryption-1')]"
          }
        },
        "policyDefinitionReferenceId": "Azure Recovery Services vaults should use customer-managed keys for encrypting backup data",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*-preview",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/47031206-ce96-41f8-861b-6a915f3de284",
        "parameters": {},
        "policyDefinitionReferenceId": "IoT Hub device provisioning service data should be encrypted using customer-managed keys (CMK)",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4ec52d6d-beb7-40c4-9a9e-fe753254690e",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure data factories should be encrypted with a customer-managed key",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/51522a96-0869-4791-82f3-981000c2c67f",
        "parameters": {},
        "policyDefinitionReferenceId": "Bot Service should be encrypted with a customer-managed key",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/56a5ee18-2ae6-4810-86f7-18e39ce5629b",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Automation accounts should use customer-managed keys to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5b9159ae-1701-4a6f-9a7a-aa9c8ddd0580",
        "parameters": {},
        "policyDefinitionReferenceId": "Container registries should be encrypted with a customer-managed key",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/64d314f6-6062-4780-a861-c23e8951bee5",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure HDInsight clusters should use customer-managed keys to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/67121cc7-ff39-4ab8-b7e3-95b84dab487d",
        "parameters": {
          "excludedKinds": {
            "value": "[parameters('excludedKinds-1')]"
          }
        },
        "policyDefinitionReferenceId": "Azure AI Services resources should encrypt data at rest with a customer-managed key (CMK)",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6fac406b-40ca-413b-bf8e-0bf964659c25",
        "parameters": {},
        "policyDefinitionReferenceId": "Storage accounts should use customer-managed key for encryption",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/702dd420-7fcc-42c5-afe8-4026edd20fe0",
        "parameters": {},
        "policyDefinitionReferenceId": "OS and data disks should be encrypted with a customer-managed key",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7d7be79c-23ba-4033-84dd-45e2a5ccdd67",
        "parameters": {},
        "policyDefinitionReferenceId": "Both operating systems and data disks in Azure Kubernetes Service clusters should be encrypted by customer-managed keys",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/81e74cea-30fd-40d5-802f-d72103c2aaaa",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Data Explorer encryption at rest should use a customer-managed key",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/83cef61d-dbd1-4b20-a4fc-5fbc7da10833",
        "parameters": {},
        "policyDefinitionReferenceId": "MySQL servers should use customer-managed keys to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/86efb160-8de7-451d-bc08-5d475b0aadae",
        "parameters": {
          "supportedSKUs": {
            "value": "[parameters('supportedSKUs-1')]"
          }
        },
        "policyDefinitionReferenceId": "Azure Data Box jobs should use a customer-managed key to encrypt the device unlock password",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/87ba29ef-1ab3-4d82-b763-87fcd4f531f7",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Stream Analytics jobs should use customer-managed keys to encrypt data",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/970f84d8-71b6-4091-9979-ace7e3fb6dbb",
        "parameters": {},
        "policyDefinitionReferenceId": "HPC Cache accounts should use customer-managed key for encryption",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/99e9ccd8-3db9-4592-b0d1-14b1715a4d8a",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Batch account should use customer-managed keys to encrypt data",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a1ad735a-e96f-45d2-a7b2-9a4932cab7ec",
        "parameters": {},
        "policyDefinitionReferenceId": "Event Hub namespaces should use a customer-managed key for encryption",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ac01ad65-10e5-46df-bdd9-6b0cad13e1d2",
        "parameters": {},
        "policyDefinitionReferenceId": "SQL managed instances should use customer-managed keys to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b5ec538c-daa0-4006-8596-35468b9148e8",
        "parameters": {},
        "policyDefinitionReferenceId": "Storage account encryption scopes should use customer-managed keys to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ba769a63-b8cc-4b2d-abf6-ac33c7204be8",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Machine Learning workspaces should be encrypted with a customer-managed key",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ca91455f-eace-4f96-be59-e6e2c35b4816",
        "parameters": {},
        "policyDefinitionReferenceId": "Managed disks should be double encrypted with both platform-managed and customer-managed keys",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f7d52b2d-e161-4dfa-a82b-55e564167385",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Synapse workspaces should use customer-managed keys to encrypt data at rest",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fa298e57-9444-42ba-bf04-86e8470e32c7",
        "parameters": {},
        "policyDefinitionReferenceId": "Saved-queries in Azure Monitor should be saved in customer storage account for logs encryption",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)",
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost.",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.05.2(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3dc5edcd-002d-444c-b216-e123bbfa37c0"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Azure Machine Learning Workspaces should disable public network access",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/438c38d2-3772-465a-a9cc-7a6666a275ce"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Cosmos DB should disable public network access",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/797b37f7-06b8-444c-b1ad-fc62867f335a"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Machine Learning Computes should be in a virtual network",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7804b5c7-01dc-4723-969b-ae300cc07ff1"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Databricks Workspaces should disable public network access",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0e7849de-b939-4c50-ab48-fc6b0f5eeba2"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Databricks Clusters should disable public IP",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/51c1490f-3319-459c-bbbc-7f391bbed753"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Databricks Workspaces should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/258823f2-4595-4b52-b333-cc96192710d8"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Databricks Workspaces should be in a virtual network",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9c25c9e4-ee12-4882-afd2-11fb9d87893f"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/34c877ad-507e-4c82-993e-3452a6e0ad3c",
        "parameters": {},
        "policyDefinitionReferenceId": "Storage accounts should restrict network access",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)",
          "NL_BIO_Cloud_Theme_U.12.1(2)",
          "NL_BIO_Cloud_Theme_U.12.2(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9daedab3-fb2d-461e-b861-71790eead4f6",
        "parameters": {},
        "policyDefinitionReferenceId": "All network ports should be restricted on network security groups associated to your virtual machine",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)",
          "NL_BIO_Cloud_Theme_U.12.1(2)",
          "NL_BIO_Cloud_Theme_U.12.2(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/055aa869-bc98-4af8-bafc-23f1ab6ffe2c",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Web Application Firewall should be enabled for Azure Front Door entry-points",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.12.1(2)",
          "NL_BIO_Cloud_Theme_U.12.2(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Azure AI Services resources should restrict network access",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/037eea7a-bd0a-46c5-9a66-03aea78705d3"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Private endpoint should be enabled for PostgreSQL servers",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0564d078-92f5-4f97-8398-b9f58a51f70b"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Private endpoint should be enabled for MariaDB servers",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0a1302fb-a631-4106-9753-f3d494733990"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Authorized IP ranges should be defined on Kubernetes Services",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0e246bcf-5f6f-4f87-bc6f-775d4712c7ea"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Public network access on Azure SQL Database should be disabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1b8ca024-1d5c-4dec-8995-b1a932b41780"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Service Bus namespaces should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1c06e275-d63d-4540-b761-71f364c2111d"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure File Sync should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1d320205-c6a1-4ac6-873d-46224024e8e2"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure API for FHIR should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1ee56206-5dd1-42ab-b02d-8aae8b1634ce"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "VM Image Builder templates should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2154edb9-244f-4741-9970-660785bccdaa"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Management ports should be closed on your virtual machines",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/22730e10-96f6-4aac-ad84-9383d35b5917"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Storage accounts should restrict network access using virtual network rules",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2a1a9cdf-e04d-429a-8416-3bfb72a1b26f"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Event Grid topics should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4b90e17e-8448-49db-875e-bd83fb6f804f"
      },
      {
        "definitionVersion": "3.*.*-preview",
        "policyDefinitionReferenceId": "Storage account public access should be disallowed",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4fa4b6c0-31ca-4c0d-b10d-24b96f62a751"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Azure Key Vault should have firewall enabled",
        "parameters": {
          "restrictIPAddresses": {
            "value": "[parameters('restrictIPAddresses-1')]"
          },
          "allowedIPAddresses": {
            "value": "[parameters('allowedIPAddresses-1')]"
          },
          "forbiddenIPAddresses": {
            "value": "[parameters('forbiddenIPAddresses-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/55615ac9-af46-4a59-874e-391cc3dfb490"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/564feb30-bf6a-4854-b4bb-0d2d2d1e6c66",
        "parameters": {},
        "policyDefinitionReferenceId": "Web Application Firewall (WAF) should be enabled for Application Gateway",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.12.1(2)",
          "NL_BIO_Cloud_Theme_U.12.2(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "CosmosDB accounts should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/58440f8a-10c5-4151-bdce-dfbaad4a20b7"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Machine Learning workspaces should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/45e05259-1eb5-4f70-9574-baf73e9d219b"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure SignalR Service should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2393d2cf-a342-44cd-a2e2-fe0188fd1234"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Key Vaults should use private link",
        "parameters": {
          "audit_effect": {
            "value": "[parameters('effects-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a6abeaec-4d90-4a02-805f-6b26c4d3fbe9"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Web PubSub Service should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/eb907f70-7514-460d-92b3-a5ae93b4f917"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Storage accounts should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6edd7eda-6dd8-40f7-810d-67160c639cd9"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Synapse workspaces should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/72d11df1-dd8a-41f7-8925-b05b960ebafc"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Private endpoint should be enabled for MySQL servers",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7595c971-233d-4bcf-bd18-596129188c49"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Private endpoint connections on Azure SQL Database should be enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7698e800-9299-47a6-b3b6-5a0fee576eed"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Cache for Redis should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7803067c-7d34-46e3-8c79-0ca68fc4036d"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Azure Cosmos DB accounts should have firewall rules",
        "parameters": {
          "effect": {
            "value": "Audit"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Data Factory should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8b0323be-cc25-4b61-935d-002c3798c6ea"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Event Grid domains should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9830b652-8523-49cc-b1b3-e17dce1127ca"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Cognitive Search service should use a SKU that supports private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a049bf77-880b-470f-ba6d-9f21c530cf83"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Management ports of virtual machines should be protected with just-in-time network access control",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b0f33259-77d7-4c9e-aac6-3aabcfae693c"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Public network access should be disabled for PostgreSQL servers",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b52376f7-9612-48a1-81cd-1ffe4b61032c"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Event Hub namespaces should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b8564268-eb4a-4337-89be-a19db070c59d"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Non-internet-facing virtual machines should be protected with network security groups",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bb91dfba-c30d-4263-9add-9c2384e659a6"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "App Configuration should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ca610c1d-041c-4332-9d88-7ed3094967c7"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Container registries should not allow unrestricted network access",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d0793b48-0edc-4296-a390-4c75d1bdfd71"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Public network access should be disabled for MySQL servers",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d9844e8a-1437-4aeb-a32c-0c992f056095"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "IoT Hub device provisioning service instances should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/df39c015-56a4-45de-b4a3-efe77bed320d"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Subnets should be associated with a Network Security Group",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e71308d3-144b-4262-b144-efdc3cc90517"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Container registries should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e8eef0a8-67cf-4eb4-9386-14b0e78733d4"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Cognitive Search services should disable public network access",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ee980b6d-0eca-4501-8d54-f6290fd512c3"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "API Management services should use a virtual network",
        "parameters": {
          "evaluatedSkuNames": {
            "value": "[parameters('evaluatedSkuNames-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ef619a2c-cc4d-4d03-b2ba-8c94a834d85b"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Disk access resources should use private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f39f5f49-4abf-44de-8c70-0756997bfb51"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Internet-facing virtual machines should be protected with network security groups",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f6de0be7-9a8a-4b8a-b349-43cf02d22f7c"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure SQL Managed Instances should disable public network access",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9dfea752-dd46-4766-aed1-c355fa93fb91"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Front Door profiles should use Premium tier that supports managed WAF rules and private link",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/dfc212af-17ea-423a-9dcb-91e2cb2caa6b"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "Public network access should be disabled for MariaDB servers",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fdccbe47-f3e3-4213-ad5d-ea459b2fa077"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bd352bd5-2853-4985-bf0d-73806b4a5744",
        "parameters": {},
        "policyDefinitionReferenceId": "IP Forwarding on your virtual machine should be disabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.1(2)",
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.12.1(2)",
          "NL_BIO_Cloud_Theme_U.12.2(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ac4a19c2-fa67-49b4-8ae5-0b2e78c49457",
        "parameters": {},
        "policyDefinitionReferenceId": "Role-Based Access Control (RBAC) should be used on Kubernetes Services",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0cfea604-3201-4e14-88fc-fae4c427a6c5",
        "parameters": {},
        "policyDefinitionReferenceId": "Blocked accounts with owner permissions on Azure resources should be removed",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e9ac8f8e-ce22-4355-8f04-99b911d6be52",
        "parameters": {},
        "policyDefinitionReferenceId": "Guest accounts with read permissions on Azure resources should be removed",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/94e1c2ac-cbbe-4cac-a2b5-389c812dee87",
        "parameters": {},
        "policyDefinitionReferenceId": "Guest accounts with write permissions on Azure resources should be removed",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/339353f6-2387-4a45-abe4-7f529d121046",
        "parameters": {},
        "policyDefinitionReferenceId": "Guest accounts with owner permissions on Azure resources should be removed",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8d7e1fde-fe26-4b5f-8108-f8e432cbc2be",
        "parameters": {},
        "policyDefinitionReferenceId": "Blocked accounts with read and write permissions on Azure resources should be removed",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3657f5a0-770e-44a3-b44e-9431ba1e9735",
        "parameters": {},
        "policyDefinitionReferenceId": "Automation account variables should be encrypted",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/617c02be-7f02-4efd-8836-3180d47b6c68",
        "parameters": {},
        "policyDefinitionReferenceId": "Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "App Service Environment should have internal encryption enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fb74e86f-d351-4b8d-b034-93da7391c01f"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b54ed75b-3e1a-44ac-a333-05ba39b99ff0",
        "parameters": {},
        "policyDefinitionReferenceId": "Service Fabric clusters should only use Azure Active Directory for client authentication",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/71ef260a-8f18-47b7-abcb-62d0673d94dc",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure AI Services resources should have key access disabled (disable local authentication)",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1f314764-cb73-4fc9-b863-8eca98ac36e9",
        "parameters": {},
        "policyDefinitionReferenceId": "An Azure Active Directory administrator should be provisioned for SQL servers",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a451c1ef-c6ca-483d-87ed-f49761e3ffb5",
        "parameters": {},
        "policyDefinitionReferenceId": "Audit usage of custom RBAC roles",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0da106f2-4ca3-48e8-bc85-c638fe6aea8f",
        "parameters": {},
        "policyDefinitionReferenceId": "Function apps should use managed identity",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54",
        "parameters": {},
        "policyDefinitionReferenceId": "Storage accounts should prevent shared key access",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2b9ad585-36bc-4615-b300-fd4435808332",
        "parameters": {},
        "policyDefinitionReferenceId": "App Service apps should use managed identity",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.07.3(2)",
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a7aca53f-2ed4-4466-a25e-0b45ade68efd",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure DDoS Protection should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.12.1(2)",
          "NL_BIO_Cloud_Theme_U.12.2(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Vulnerability assessment should be enabled on your SQL servers",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.09.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Vulnerability assessment should be enabled on SQL Managed Instance",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.09.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1b7aa243-30e4-4c9e-bca8-d0d3022b634a"
      },
      {
        "definitionVersion": "6.*.*-preview",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8dfab9c4-fe7b-49ad-85e4-1e9be085358f",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Arc enabled Kubernetes clusters should have Microsoft Defender for Cloud extension installed",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Defender for SQL should be enabled for unprotected Azure SQL servers",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Defender for SQL should be enabled for unprotected SQL Managed Instances",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.09.3(2)",
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure registry container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.09.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/090c7b07-b4ed-4561-ad20-e9075f3ccaff"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Machines should be configured to periodically check for missing system updates",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.09.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/bd876905-5b84-4f73-ab2d-2e7a7c4568d9"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Microsoft Defender for SQL should be enabled for unprotected Synapse workspaces",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.09.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d31e5c31-63b2-4f12-887b-e49456834fa1"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Defender for SQL should be enabled for unprotected PostgreSQL flexible servers",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.09.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d38668f5-d155-42c7-ab3d-9b57b50f8fbf"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e96a9a5f-07ca-471b-9bc5-6a0f33cbd68f",
        "parameters": {},
        "policyDefinitionReferenceId": "Azure Machine Learning Computes should have local authentication methods disabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/37e0d2fe-28a5-43d6-a273-67d37d1f5606",
        "parameters": {},
        "policyDefinitionReferenceId": "Storage accounts should be migrated to new Azure Resource Manager resources",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1d84d5fb-01f6-4d12-ba4f-4a26081d403d",
        "parameters": {},
        "policyDefinitionReferenceId": "Virtual machines should be migrated to new Azure Resource Manager resources",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a4d",
        "parameters": {},
        "policyDefinitionReferenceId": "Audit VMs that do not use managed disks",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f6ec09a3-78bf-4f8f-99dc-6c77182d0f99",
        "parameters": {
          "IncludeArcMachines": {
            "value": "[parameters('IncludeArcMachines-1')]"
          }
        },
        "policyDefinitionReferenceId": "Audit Linux machines that have accounts without passwords",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ea53dbee-c6c9-4f0e-9f9e-de0039b78023",
        "parameters": {
          "IncludeArcMachines": {
            "value": "[parameters('IncludeArcMachines-1')]"
          }
        },
        "policyDefinitionReferenceId": "Audit Linux machines that allow remote connections from accounts without passwords",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/21a6bc25-125e-4d13-b82d-2e19b7208ab7",
        "parameters": {},
        "policyDefinitionReferenceId": "VPN gateways should use only Azure Active Directory (Azure AD) authentication for point-to-site users",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.2(2)",
          "NL_BIO_Cloud_Theme_U.10.3(2)",
          "NL_BIO_Cloud_Theme_U.10.5(2)",
          "NL_BIO_Cloud_Theme_U.07.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "App Service apps should have Client Certificates (Incoming client certificates) enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/19dd1db6-f442-49cf-a838-b0786b4401ef"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "SQL servers with auditing to storage account destination should be configured with 90 days retention or higher",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/89099bee-89e0-4b26-a5f4-165451757743"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure SQL Managed Instance should have Microsoft Entra-only authentication enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0c28c3fb-c244-42d5-a9bf-f35f2999577b"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Synapse Workspaces should use only Microsoft Entra identities for authentication during workspace creation",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2158ddbe-fefa-408e-b43f-d4faef8ff3b8"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Synapse Workspaces should have Microsoft Entra-only authentication enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6ea81a52-5ca7-4575-9669-eaa910b7edf8"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure SQL Managed Instances should have Microsoft Entra-only authentication enabled during creation",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/78215662-041e-49ed-a9dd-5385911b3a1f"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure SQL Database should have Microsoft Entra-only authentication enabled during creation",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/abda6d70-9778-44e7-84a8-06713e6db027"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure SQL Database should have Microsoft Entra-only authentication enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b3a22bc9-66de-45fb-98fa-00f5df42f41a"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "A Microsoft Entra administrator should be provisioned for PostgreSQL servers",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.10.5(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b4dec045-250a-48c2-b5cc-e0c4eec8b5b4"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/da0f98fe-a24b-4ad5-af69-bd0400233661",
        "parameters": {
          "IncludeArcMachines": {
            "value": "[parameters('IncludeArcMachines-1')]"
          }
        },
        "policyDefinitionReferenceId": "Audit Windows machines that do not store passwords using reversible encryption",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.11.1(2)",
          "NL_BIO_Cloud_Theme_U.11.2(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost.",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.11.3(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ca88aadc-6e2b-416c-9de2-5a0f01d1693f"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Resource logs in Azure Kubernetes Service should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/245fc9df-fa96-4414-9a0b-3738c2f7341c"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionReferenceId": "App Service apps should have resource logs enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/91a78b24-f231-4a8a-8da9-02c35b2b6510"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Resource logs in Azure Machine Learning Workspaces should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/afe0c3be-ba3b-4544-ba52-0c99672a8ad6"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Resource logs in Azure Databricks Workspaces should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/138ff14d-b687-4faa-a81c-898c91a87fa2"
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7f89b1eb-583c-429a-8828-af049802c1d9",
        "parameters": {
          "listOfResourceTypes": {
            "value": "[parameters('listOfResourceTypes-1')]"
          },
          "metricsEnabled": {
            "value": "[parameters('metricsEnabled-1')]"
          },
          "logsEnabled": {
            "value": "[parameters('logsEnabled-1')]"
          }
        },
        "policyDefinitionReferenceId": "Audit diagnostic setting for selected resource types",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)",
          "NL_BIO_Cloud_Theme_U.15.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9",
        "parameters": {
          "setting": {
            "value": "[parameters('setting-1')]"
          }
        },
        "policyDefinitionReferenceId": "Auditing on SQL server should be enabled",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)",
          "NL_BIO_Cloud_Theme_U.15.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e2dd799a-a932-4e9d-ac17-d473bc3c6c10",
        "parameters": {
          "listOfImageIdToInclude_windows": {
            "value": "[parameters('listOfImageIdToInclude_windows-1')]"
          },
          "listOfImageIdToInclude_linux": {
            "value": "[parameters('listOfImageIdToInclude_linux-1')]"
          }
        },
        "policyDefinitionReferenceId": "Dependency agent should be enabled in virtual machine scale sets for listed virtual machine images",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)",
          "NL_BIO_Cloud_Theme_U.15.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/11ac78e3-31bc-4f0c-8434-37ab963cea07",
        "parameters": {
          "listOfImageIdToInclude_windows": {
            "value": "[parameters('listOfImageIdToInclude_windows-1')]"
          },
          "listOfImageIdToInclude_linux": {
            "value": "[parameters('listOfImageIdToInclude_linux-1')]"
          }
        },
        "policyDefinitionReferenceId": "Dependency agent should be enabled for listed virtual machine images",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)",
          "NL_BIO_Cloud_Theme_U.15.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138",
        "parameters": {
          "listOfImageIdToInclude_windows": {
            "value": "[parameters('listOfImageIdToInclude_windows-1')]"
          },
          "listOfImageIdToInclude_linux": {
            "value": "[parameters('listOfImageIdToInclude_linux-1')]"
          }
        },
        "policyDefinitionReferenceId": "Log Analytics extension should be enabled in virtual machine scale sets for listed virtual machine images",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)",
          "NL_BIO_Cloud_Theme_U.15.3(2)"
        ]
      },
      {
        "definitionVersion": "2.*.*-preview",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/32133ab0-ee4b-4b44-98d6-042180979d50",
        "parameters": {
          "listOfImageIdToInclude_windows": {
            "value": "[parameters('listOfImageIdToInclude_windows-1')]"
          },
          "listOfImageIdToInclude_linux": {
            "value": "[parameters('listOfImageIdToInclude_linux-1')]"
          }
        },
        "policyDefinitionReferenceId": "Log Analytics Extension should be enabled for listed virtual machine images",
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)",
          "NL_BIO_Cloud_Theme_U.15.3(2)"
        ]
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Front Door should have Resource logs enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8a04f872-51e9-4313-97fb-fc1c35430fd8"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Azure Front Door Standard or Premium (Plus WAF) should have resource logs enabled",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cd906338-3453-47ba-9334-2d654bf845af"
      },
      {
        "definitionVersion": "1.*.*-preview",
        "policyDefinitionReferenceId": "Network traffic data collection agent should be installed on Linux virtual machines",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/04c4380f-3fae-46e8-96c9-30193528f602"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Resource logs in Azure Data Lake Store should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/057ef27e-665e-4328-8ea3-04b3122bd9fb"
      },
      {
        "definitionVersion": "1.*.*-preview",
        "policyDefinitionReferenceId": "Network traffic data collection agent should be installed on Windows virtual machines",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2f2ee1de-44aa-4762-b6bd-0893fc3f306d"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Resource logs in Logic Apps should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/34f95f76-5386-4de7-b824-0d8478470c9d"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Resource logs in IoT Hub should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/383856f8-de7f-44a2-81fc-e5135b5c2aa4"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Resource logs in Batch accounts should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/428256e6-1fac-4f48-a757-df34c2b3336d"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Resource logs in Event Hub should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/83a214f7-d01a-484b-91a9-ed54470c9a6a"
      },
      {
        "definitionVersion": "1.*.*-preview",
        "policyDefinitionReferenceId": "Log Analytics extension should be installed on your Linux Azure Arc machines",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/842c54e8-c2f9-4d79-ae8d-38d8b8019373"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Guest Configuration extension should be installed on your machines",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ae89ebca-1c92-4898-ac2c-9f63decb045c"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Resource logs in Search services should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b4330a05-a843-4bc8-bf9a-cacce50c67f4"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Network Watcher should be enabled",
        "parameters": {
          "resourceGroupName": {
            "value": "[parameters('resourceGroupName-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b6e2945c-0b7b-40f5-9233-7a5323b5cdc6"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Resource logs in Data Lake Analytics should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c95c74d9-38fe-4f0d-af86-0c7d626a315c"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Resource logs in Key Vault should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cf820ca0-f99e-4f3e-84fb-66e913812d21"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Virtual machines- Guest Configuration extension should be deployed with system-assigned managed identity",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d26f7642-7545-4e18-9b75-8c9bbdee3a9a"
      },
      {
        "definitionVersion": "1.*.*-preview",
        "policyDefinitionReferenceId": "Log Analytics extension should be installed on your Windows Azure Arc machines",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d69b1763-b96d-40b8-a2d9-ca31e9fd0d3e"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Resource logs in Service Bus should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f8d36e2f-389b-4ee4-898d-21aeb69a0f45"
      },
      {
        "definitionVersion": "5.*.*",
        "policyDefinitionReferenceId": "Resource logs in Azure Stream Analytics should be enabled",
        "parameters": {
          "requiredRetentionDays": {
            "value": "[parameters('requiredRetentionDays-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f9be5368-9bf5-4b84-9e0a-7850da98bb46"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Linux virtual machines should have Azure Monitor Agent installed",
        "parameters": {
          "scopeToSupportedImages": {
            "value": "[parameters('scopeToSupportedImages-1')]"
          },
          "listOfLinuxImageIdToInclude": {
            "value": "[parameters('listOfLinuxImageIdToInclude-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1afdc4b6-581a-45fb-b630-f1e6051e3e7a"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Linux virtual machine scale sets should have Azure Monitor Agent installed",
        "parameters": {
          "scopeToSupportedImages": {
            "value": "[parameters('scopeToSupportedImages-1')]"
          },
          "listOfLinuxImageIdToInclude": {
            "value": "[parameters('listOfLinuxImageIdToInclude-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/32ade945-311e-4249-b8a4-a549924234d7"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Windows virtual machine scale sets should have Azure Monitor Agent installed",
        "parameters": {
          "scopeToSupportedImages": {
            "value": "[parameters('scopeToSupportedImages-1')]"
          },
          "listOfWindowsImageIdToInclude": {
            "value": "[parameters('listOfLinuxImageIdToInclude-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3672e6f7-a74d-4763-b138-fcf332042f8f"
      },
      {
        "definitionVersion": "3.*.*",
        "policyDefinitionReferenceId": "Windows virtual machines should have Azure Monitor Agent installed",
        "parameters": {
          "scopeToSupportedImages": {
            "value": "[parameters('scopeToSupportedImages-1')]"
          },
          "listOfWindowsImageIdToInclude": {
            "value": "[parameters('listOfLinuxImageIdToInclude-1')]"
          }
        },
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c02729e5-e5e7-4458-97fa-2b5ad0661f28"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Windows Arc-enabled machines should have Azure Monitor Agent installed",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ec621e21-8b48-403d-a549-fc9023d4747f"
      },
      {
        "definitionVersion": "1.*.*",
        "policyDefinitionReferenceId": "Linux Arc-enabled machines should have Azure Monitor Agent installed",
        "parameters": {},
        "groupNames": [
          "NL_BIO_Cloud_Theme_U.15.1(2)"
        ],
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f17d891d-ff20-46f2-bad3-9e0a5403a4d3"
      }
    ],
    "versions": [
      "2.2.0",
      "2.1.0",
      "2.0.0"
    ]
  },
  "id": "/providers/Microsoft.Authorization/policySetDefinitions/d8b2ffbe-c6a8-4622-965d-4ade11d1d2ee",
  "name": "d8b2ffbe-c6a8-4622-965d-4ade11d1d2ee"
}