|
| 1 | +--- |
| 2 | +title: Use Azure Resource Manager templates to onboard Update Management | Microsoft Docs |
| 3 | +description: You can use an Azure Resource Manager template to onboard the Azure Automation Update Management solution. |
| 4 | +ms.service: automation |
| 5 | +ms.subservice: update-management |
| 6 | +ms.topic: conceptual |
| 7 | +author: mgoedtel |
| 8 | +ms.author: magoedte |
| 9 | +ms.date: 02/27/2020 |
| 10 | + |
| 11 | +--- |
| 12 | + |
| 13 | +# Onboard Update Management solution using Azure Resource Manager template |
| 14 | + |
| 15 | +You can use [Azure Resource Manager templates](../azure-resource-manager/templates/template-syntax.md) to enable the Azure Automation Update Management solution in your resource group. This article provides a sample template that automates the following: |
| 16 | + |
| 17 | +* Creation of a Azure Monitor Log Analytics workspace. |
| 18 | +* Creation of an Azure Automation account. |
| 19 | +* Links the Automation account to the Log Analytics workspace if not already linked. |
| 20 | +* Onboard the Azure Automation Update Management solution |
| 21 | + |
| 22 | +The template does not automate the onboarding of one or more Azure or non-Azure VMs. |
| 23 | + |
| 24 | +If you already have a Log Analytics workspace and Automation account deployed in a supported region in your subscription, they are not linked, and the workspace doesn't already have the Update Management solution deployed, using this template successfully creates the link and deploys the Update Management solution. |
| 25 | + |
| 26 | +## API versions |
| 27 | + |
| 28 | +The following table lists the API version for the resources used in this example. |
| 29 | + |
| 30 | +| Resource | Resource type | API version | |
| 31 | +|:---|:---|:---| |
| 32 | +| Workspace | workspaces | 2017-03-15-preview | |
| 33 | +| Automation account | automation | 2015-10-31 | |
| 34 | +| Solution | solutions | 2015-11-01-preview | |
| 35 | + |
| 36 | +## Before using the template |
| 37 | + |
| 38 | +If you choose to install and use PowerShell locally, this article requires the Azure PowerShell Az module. Run `Get-Module -ListAvailable Az` to find the version. If you need to upgrade, see [Install the Azure PowerShell module](/powershell/azure/install-az-ps). If you are running PowerShell locally, you also need to run `Connect-AzAccount` to create a connection with Azure. With Azure PowerShell, deployment uses [New-AzResourceGroupDeployment](/powershell/module/az.resources/new-azresourcegroupdeployment). |
| 39 | + |
| 40 | +If you choose to install and use the CLI locally, this article requires that you are running the Azure CLI version 2.1.0 or later. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli?view=azure-cli-latest). With Azure CLI, this deployment uses [az group deployment create](https://docs.microsoft.com/cli/azure/group/deployment?view=azure-cli-latest#az-group-deployment-create). |
| 41 | + |
| 42 | +The JSON template is configured to prompt you for: |
| 43 | + |
| 44 | +* The name of the workspace |
| 45 | +* The region to create the workspace in |
| 46 | +* The name of the Automation account |
| 47 | +* The region to create the account in |
| 48 | + |
| 49 | +The JSON template specifies a default value for the other parameters that would likely be used as a standard configuration in your environment. You can store the template in an Azure storage account for shared access in your organization. For further information about working with templates, see [Deploy resources with Resource Manager templates and Azure CLI](../azure-resource-manager/templates/deploy-cli.md). |
| 50 | + |
| 51 | +The following parameters in the template are set with a default value for the Log Analytics workspace: |
| 52 | + |
| 53 | +* sku - defaults to the new Per-GB pricing tier released in the April 2018 pricing model |
| 54 | +* data retention - defaults to thirty days |
| 55 | + |
| 56 | +>[!WARNING] |
| 57 | +>If creating or configuring a Log Analytics workspace in a subscription that has opted into the new April 2018 pricing model, the only valid Log Analytics pricing tier is **PerGB2018**. |
| 58 | +> |
| 59 | +
|
| 60 | +>[!NOTE] |
| 61 | +>Before using this template, review [additional details](../azure-monitor/platform/template-workspace-configuration.md#create-a-log-analytics-workspace) to fully understand workspace configuration options such as access control mode, pricing tier, retention, and capacity reservation level. If you are new to Azure Monitor logs and have not deployed a workspace already, you should review the [workspace design](../azure-monitor/platform/design-logs-deployment.md) guidance to learn about access control, and an understanding of the design implementation strategies we recommend for your organization. |
| 62 | +
|
| 63 | +## Deploy template |
| 64 | + |
| 65 | +1. Copy and paste the following JSON syntax into your file: |
| 66 | + |
| 67 | + ```json |
| 68 | + { |
| 69 | + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", |
| 70 | + "contentVersion": "1.0.0.0", |
| 71 | + "parameters": { |
| 72 | + "workspaceName": { |
| 73 | + "type": "string", |
| 74 | + "metadata": { |
| 75 | + "description": "Workspace name" |
| 76 | + } |
| 77 | + }, |
| 78 | + "pricingTier": { |
| 79 | + "type": "string", |
| 80 | + "allowedValues": [ |
| 81 | + "pergb2018", |
| 82 | + "Free", |
| 83 | + "Standalone", |
| 84 | + "PerNode", |
| 85 | + "Standard", |
| 86 | + "Premium" |
| 87 | + ], |
| 88 | + "defaultValue": "pergb2018", |
| 89 | + "metadata": { |
| 90 | + "description": "Pricing tier: perGB2018 or legacy tiers (Free, Standalone, PerNode, Standard or Premium) which are not available to all customers." |
| 91 | + } |
| 92 | + }, |
| 93 | + "dataRetention": { |
| 94 | + "type": "int", |
| 95 | + "defaultValue": 30, |
| 96 | + "minValue": 7, |
| 97 | + "maxValue": 730, |
| 98 | + "metadata": { |
| 99 | + "description": "Number of days of retention. Workspaces in the legacy Free pricing tier can only have 7 days." |
| 100 | + } |
| 101 | + }, |
| 102 | + "immediatePurgeDataOn30Days": { |
| 103 | + "type": "bool", |
| 104 | + "defaultValue": "[bool('false')]", |
| 105 | + "metadata": { |
| 106 | + "description": "If set to true when changing retention to 30 days, older data will be immediately deleted. Use this with extreme caution. This only applies when retention is being set to 30 days." |
| 107 | + } |
| 108 | + }, |
| 109 | + "location": { |
| 110 | + "type": "string", |
| 111 | + "allowedValues": [ |
| 112 | + "australiacentral", |
| 113 | + "australiaeast", |
| 114 | + "australiasoutheast", |
| 115 | + "brazilsouth", |
| 116 | + "canadacentral", |
| 117 | + "centralindia", |
| 118 | + "centralus", |
| 119 | + "eastasia", |
| 120 | + "eastus", |
| 121 | + "eastus2", |
| 122 | + "francecentral", |
| 123 | + "japaneast", |
| 124 | + "koreacentral", |
| 125 | + "northcentralus", |
| 126 | + "northeurope", |
| 127 | + "southafricanorth", |
| 128 | + "southcentralus", |
| 129 | + "southeastasia", |
| 130 | + "uksouth", |
| 131 | + "ukwest", |
| 132 | + "westcentralus", |
| 133 | + "westeurope", |
| 134 | + "westus", |
| 135 | + "westus2" |
| 136 | + ], |
| 137 | + "metadata": { |
| 138 | + "description": "Specifies the location in which to create the workspace." |
| 139 | + } |
| 140 | + }, |
| 141 | + "automationAccountName": { |
| 142 | + "type": "string", |
| 143 | + "metadata": { |
| 144 | + "description": "Automation account name" |
| 145 | + } |
| 146 | + }, |
| 147 | + "automationAccountLocation": { |
| 148 | + "type": "string", |
| 149 | + "metadata": { |
| 150 | + "description": "Specify the location in which to create the Automation account." |
| 151 | + } |
| 152 | + } |
| 153 | + }, |
| 154 | + "variables": { |
| 155 | + "Updates": { |
| 156 | + "name": "[concat('Updates', '(', parameters('workspaceName'), ')')]", |
| 157 | + "galleryName": "Updates" |
| 158 | + } |
| 159 | + }, |
| 160 | + "resources": [ |
| 161 | + { |
| 162 | + "type": "Microsoft.OperationalInsights/workspaces", |
| 163 | + "name": "[parameters('workspaceName')]", |
| 164 | + "apiVersion": "2017-03-15-preview", |
| 165 | + "location": "[parameters('location')]", |
| 166 | + "properties": { |
| 167 | + "sku": { |
| 168 | + "name": "CapacityReservation", |
| 169 | + "capacityReservationLevel": 100 |
| 170 | + }, |
| 171 | + "retentionInDays": "[parameters('dataRetention')]", |
| 172 | + "features": { |
| 173 | + "searchVersion": 1, |
| 174 | + "legacy": 0, |
| 175 | + "enableLogAccessUsingOnlyResourcePermissions": true |
| 176 | + } |
| 177 | + }, |
| 178 | + "resources": [ |
| 179 | + { |
| 180 | + "apiVersion": "2015-11-01-preview", |
| 181 | + "location": "[resourceGroup().location]", |
| 182 | + "name": "[variables('Updates').name]", |
| 183 | + "type": "Microsoft.OperationsManagement/solutions", |
| 184 | + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.OperationsManagement/solutions/', variables('Updates').name)]", |
| 185 | + "dependsOn": [ |
| 186 | + "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]" |
| 187 | + ], |
| 188 | + "properties": { |
| 189 | + "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]" |
| 190 | + }, |
| 191 | + "plan": { |
| 192 | + "name": "[variables('Updates').name]", |
| 193 | + "publisher": "Microsoft", |
| 194 | + "promotionCode": "", |
| 195 | + "product": "[concat('OMSGallery/', variables('Updates').galleryName)]" |
| 196 | + } |
| 197 | + } |
| 198 | + ] |
| 199 | + }, |
| 200 | + { |
| 201 | + "type": "Microsoft.Automation/automationAccounts", |
| 202 | + "apiVersion": "2015-01-01-preview", |
| 203 | + "name": "[parameters('automationAccountName')]", |
| 204 | + "location": "[parameters('automationAccountLocation')]", |
| 205 | + "dependsOn": [], |
| 206 | + "tags": {}, |
| 207 | + "properties": { |
| 208 | + "sku": { |
| 209 | + "name": "Basic" |
| 210 | + } |
| 211 | + }, |
| 212 | + }, |
| 213 | + { |
| 214 | + "apiVersion": "2015-11-01-preview", |
| 215 | + "type": "Microsoft.OperationalInsights/workspaces/linkedServices", |
| 216 | + "name": "[concat(parameters('workspaceName'), '/' , 'Automation')]", |
| 217 | + "location": "[resourceGroup().location]", |
| 218 | + "dependsOn": [ |
| 219 | + "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspaceName'))]", |
| 220 | + "[concat('Microsoft.Automation/automationAccounts/', parameters('automationAccountName'))]" |
| 221 | + ], |
| 222 | + "properties": { |
| 223 | + "resourceId": "[resourceId('Microsoft.Automation/automationAccounts/', parameters('automationAccountName'))]" |
| 224 | + } |
| 225 | + } |
| 226 | + ] |
| 227 | + } |
| 228 | + ``` |
| 229 | + |
| 230 | +2. Edit the template to meet your requirements. |
| 231 | + |
| 232 | +3. Save this file as deployUMSolutiontemplate.json to a local folder. |
| 233 | + |
| 234 | +4. You are ready to deploy this template. You can use either PowerShell or the Azure CLI. When you're prompted for a workspace and Automation account name, provide a name that is globally unique across all Azure subscriptions. |
| 235 | + |
| 236 | + **PowerShell** |
| 237 | + |
| 238 | + ```powershell |
| 239 | + New-AzResourceGroupDeployment -Name <deployment-name> -ResourceGroupName <resource-group-name> -TemplateFile deployUMSolutiontemplate.json |
| 240 | + ``` |
| 241 | + |
| 242 | + **Azure CLI** |
| 243 | + |
| 244 | + ```cli |
| 245 | + az group deployment create --resource-group <my-resource-group> --name <my-deployment-name> --template-file deployUMSolutiontemplate.json |
| 246 | + ``` |
| 247 | + |
| 248 | + The deployment can take a few minutes to complete. When it finishes, you see a message similar to the following that includes the result: |
| 249 | + |
| 250 | +  |
| 251 | + |
| 252 | +## Next steps |
| 253 | + |
| 254 | +Now that you have the Update Management solution deployed, you can enable VMs for management, review update assessments, and deploy updates to bring them into compliance. |
| 255 | + |
| 256 | +- From your [Azure Automation account](automation-onboard-solutions-from-automation-account.md) for one or more Azure machines and manually for non-Azure machines. |
| 257 | + |
| 258 | +- For a single Azure VM from the virtual machine page in the Azure portal. This scenario is available for [Linux](../virtual-machines/linux/tutorial-config-management.md#enable-update-management) and [Windows](../virtual-machines/windows/tutorial-config-management.md#enable-update-management) VMs. |
| 259 | + |
| 260 | +- For [multiple Azure VMs](manage-update-multi.md) by selecting them from the **Virtual machines** page in the Azure portal. |
0 commit comments