Added a new MDFC policy definition and assignment to allow users to pass MDFC for server and APIs with plan as needed

modules/archetypes/lib/archetype_definitions/archetype_definition_es_root.tmpl.json

@@ -13,6 +13,7 @@
       "Deploy-MDEndpoints",
       "Deploy-MDEndpointsAMA",
       "Deploy-MDFC-Config-H224",
+      "Deploy-MDFC-Config-H324",
       "Deploy-MDFC-OssDb",
       "Deploy-MDFC-SqlAtp",
       "Enforce-ACSB"
@@ -93,6 +94,7 @@
       "DenyAction-ActivityLogs",
       "DenyAction-DeleteResources",
       "DenyAction-DiagnosticLogs",
+      "Deploy-ASC-APIs",
       "Deploy-ASC-SecurityContacts",
       "Deploy-Budget",
       "Deploy-Custom-Route-Table",
@@ -184,6 +186,7 @@
       "DenyAction-DeleteProtection",
       "Deploy-AUM-CheckUpdates",
       "Deploy-Diagnostics-LogAnalytics",
+      "Deploy-MDFC-Config_20241027",
       "Deploy-MDFC-Config_20240319",
       "Deploy-MDFC-Config",
       "Deploy-MDFC-DefenderSQL-AMA",

modules/archetypes/lib/policy_assignments/policy_assignment_es_deploy_mdfc_config_h324.tmpl.json

@@ -0,0 +1,82 @@
+{
+  "type": "Microsoft.Authorization/policyAssignments",
+  "apiVersion": "2022-06-01",
+  "name": "Deploy-MDFC-Config-H324",
+  "location": "${default_location}",
+  "dependsOn": [],
+  "identity": {
+    "type": "SystemAssigned"
+  },
+  "properties": {
+    "description": "Deploy Microsoft Defender for Cloud and Security Contacts",
+    "displayName": "Deploy Microsoft Defender for Cloud configuration",
+    "policyDefinitionId": "${root_scope_resource_id}/providers/Microsoft.Authorization/policySetDefinitions/Deploy-MDFC-Config_20241027",
+    "enforcementMode": "Default",
+    "nonComplianceMessages": [
+      {
+        "message": "Microsoft Defender for Cloud and Security Contacts {enforcementMode} be deployed."
+      }
+    ],
+    "parameters": {
+      "emailSecurityContact": {
+        "value": "security_contact@replace_me"
+      },
+      "logAnalytics": {
+        "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/${root_scope_id}-mgmt/providers/Microsoft.OperationalInsights/workspaces/${root_scope_id}-la"
+      },
+      "ascExportResourceGroupName": {
+        "value": "${root_scope_id}-asc-export"
+      },
+      "ascExportResourceGroupLocation": {
+        "value": "${default_location}"
+      },
+      "enableAscForAPIs": {
+        "value": "Disabled"
+      },
+      "enableAscForAPIsSubPlan": {
+        "value": "P1"
+      },
+      "enableAscForServers": {
+        "value": "Disabled"
+      },
+      "enableAscForServersSubPlan": {
+        "value": "P2"
+      },
+      "enableAscForServersVulnerabilityAssessments": {
+        "value": "Disabled"
+      },
+      "enableAscForSql": {
+        "value": "Disabled"
+      },
+      "enableAscForAppServices": {
+        "value": "Disabled"
+      },
+      "enableAscForStorage": {
+        "value": "Disabled"
+      },
+      "enableAscForContainers": {
+        "value": "Disabled"
+      },
+      "enableAscForKeyVault": {
+        "value": "Disabled"
+      },
+      "enableAscForSqlOnVm": {
+        "value": "Disabled"
+      },
+      "enableAscForArm": {
+        "value": "Disabled"
+      },
+      "enableAscForOssDb": {
+        "value": "Disabled"
+      },
+      "enableAscForCosmosDbs": {
+        "value": "Disabled"
+      },
+      "enableAscForCspm": {
+        "value": "Disabled"
+      }
+    },
+    "scope": "${current_scope_resource_id}",
+    "notScopes": []
+  }
+}

modules/archetypes/lib/policy_definitions/policy_definition_es_deploy_asc_apis.json

@@ -0,0 +1,112 @@
+{
+  "name": "Deploy-ASC-APIs",
+  "type": "Microsoft.Authorization/policyDefinitions",
+  "apiVersion": "2021-06-01",
+  "scope": null,
+  "properties": {
+    "displayName": "Configure Microsoft Defender for APIs plan",
+    "policyType": "Custom",
+    "mode": "All",
+    "description": "New capabilities are continuously being added to Defender for APIs, which may require the user's explicit enablement. Use this policy to make sure all new capabilities will be enabled.",
+    "metadata": {
+      "version": "2.0.0",
+      "category": "Security Center",
+      "source": "https://github.com/Azure/Enterprise-Scale/",
+      "alzCloudEnvironments": [
+        "AzureCloud",
+        "AzureChinaCloud",
+        "AzureUSGovernment"
+      ]
+    },
+    "parameters": {
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "DeployIfNotExists",
+          "Disabled"
+        ],
+        "defaultValue": "DeployIfNotExists"
+      },
+      "subPlan": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Defender for APIs plans",
+          "description": "Select a Defender for APIs plan"
+        },
+        "allowedValues": [
+          "P1",
+          "P2",
+          "P3",
+          "P4",
+          "P5"
+        ],
+        "defaultValue": "P1"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "field": "type",
+        "equals": "Microsoft.Resources/subscriptions"
+      },
+      "then": {
+        "effect": "[parameters('effect')]",
+        "details": {
+          "type": "Microsoft.Security/pricings",
+          "name": "Api",
+          "deploymentScope": "subscription",
+          "existenceScope": "subscription",
+          "roleDefinitionIds": [
+            "/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635"
+          ],
+          "existenceCondition": {
+            "allOf": [
+              {
+                "field": "Microsoft.Security/pricings/pricingTier",
+                "equals": "Standard"
+              },
+              {
+                "field": "Microsoft.Security/pricings/subPlan",
+                "equals": "[parameters('subPlan')]"
+              }
+            ]
+          },
+          "deployment": {
+            "location": "westeurope",
+            "properties": {
+              "mode": "incremental",
+              "parameters": {
+                "subPlan": {
+                  "value": "[parameters('subPlan')]"
+                }
+              },
+              "template": {
+                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+                "contentVersion": "1.0.0.0",
+                "parameters": {
+                  "subPlan": {
+                    "type": "String"
+                  }
+                },
+                "resources": [
+                  {
+                    "type": "Microsoft.Security/pricings",
+                    "apiVersion": "2023-01-01",
+                    "name": "Api",
+                    "properties": {
+                      "pricingTier": "Standard",
+                      "subPlan": "[parameters('subPlan')]"
+                    }
+                  }
+                ]
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}