What's New

For the latest updates, visit the Releases page.

To update your deployment with the latest release, refer to the Update to new releases guide.

• Assignment of VM and Hybrid VM initiatives to Platform MG.
• Faster deployment thanks to both template and ARM engine improvements.

• Resolved [#400]: Fix for log alerts policy remediation not working when ALZMonitorDisableTagName parameter value contains dashes.

• Improved navigation for the ALZ pattern content by restructuring the menu.
• Improved spelling and grammar for the ALZ pattern content.
• Updated the Introduction to deploying the AMBA-ALZ Pattern page with the new Platform Management Group assignment for both VM initiative and Hybrid VM initiative.
• Updated broken links.

• Automation:
  • Created workflow to assign issues to the relevant owner based on labels.
  • Added GitHub action to validate yml schemas.

• Introduced a new policy definition to audit/update Recovery Vault ASR Health Alerting to Azure Monitor alerts.
• Script Consolidation: The scripts Remove-AMBADeployments.ps1, Remove-AMBANotificationAssets.ps1, Start-AMBACleanup.ps1, Start-AMBAOldArpCleanup.ps1, and Start-AMBAPolicyInitiativesAndAssignmentsCleanup.ps1 have been merged into a single script named Start-AMBA-ALZ-Maintenance.ps1 [#352: Consolidate maintenance scripts]. This enhancement allows the removal of alerts for deleted resources (orphaned alerts).

• Resolved [#323]: Ensured the -WhatIf parameter is honored by all script commands and fixed the hybrid disconnected alert bug.
• Resolved [#342]: Fixed GitHub issue link and Management Subscription ID.
• Resolved [#346]: Updated useCommonSchema to useCommonAlertSchema in Deploy_ServiceHealth_ActionGroups and Deploy_Suppression_AlertProcessing_Rule Policy Definitions.
• Resolved [#357]: Fixed the ExpressRoute QoS remediation issue.
• Resolved [#362]: Standardized parameter usage for failingPeriods and evaluationPeriods.
• Resolved [#381]: Fixed Connectivity policy initiative, tag name case consistency, and updated tag override documentation.

• Improved clarity on the ‘Update to new releases’ page.
• Added examples using the new consolidated maintenance script to the ‘Update to new releases’ page: Updating to release 2024-09-02, Updating to release 2024-03-01.
• Clarified identification of the pseudoRootManagementGroup as the parent of the Platform and Landing Zones management groups.
• Updated AMBA diagrams in the Introduction to deploying the ALZ Pattern section.
• Added remediation command for the Deploy Azure Monitor Baseline Alerts for Recovery Services policy initiative to the Remediate Policies list.

• Automation:
  • Removed the previous workflow that automated the creation of ARM templates for Azure Policies/PolicySets due to a security issue.
  • Introduced a new workflow to ensure policy updates and verify the Bicep build has been run by the contributor.

• AMBA Portal Accelerator: Launched the Azure Monitor Baseline Alerts Accelerator in preview, enabling quick and confident alert deployment through the Azure Portal UI. For detailed instructions, see Deploy via the Azure Portal (Preview).

• Modular Initiatives: Deprecated the former Landing Zone Initiative in favor of a modular approach with distinct components. For more details, visit Policy Initiatives.

  • Key Management
  • Load Balancing
  • Network Changes
  • Recovery Services
  • Storage
  • VM
  • Web

• Threshold Override: Allows adjustment of alert thresholds for specific resources using a tag. This feature is available for metrics and log alerts. Learn more: Alert Threshold Override.

• Custom Tags to Disable Monitoring: Specify a tag name and values to disable monitoring for certain resources.

• Added new alert rules for Azure Key Vault Managed HSM, included in Identity and Key Management initiatives.

• Added a new Daily Cap threshold alert for Log Analytics workspace, included in the Management initiative.

• Added a new Application Insight Throttling alert, included in the Web initiative.

• Added a new ActivityLog Alert for deleting Application Insight, included in the Web initiative.

• Enabled changing Application Gateway dynamic alert sensitivity.

• Deprecated the Landing Zone Initiative.

• Resolved [#280]: Fixed AGW Compute Units Alert and AGW Unhealthy Host Count Alert non-compliance after remediation.
• Resolved [#278]: Fixed Deploy VNetG ExpressRoute CPU Utilization Alert remediation failure.
• Resolved [#284]: Fixed missing AMBA policy ALZ_ServiceHealth_ActionGroups during remediation.
• Resolved [#253]: Updated older version used in documentation.
• Resolved [#261]: Corrected display name VMLowOSDisk(Write/Read)LatencyAlert to VMHighOSDisk(Write/Read)LatencyAlert.
• Resolved [#260]: Added threshold parameter for ALZ alerts ALZ_WSFMemoryPercentage, ALZ_WSFCPUPercentage.
• Fixed casing in metadata and policies.
• Fixed default values for multiple parameters in VM and Hybrid initiatives.

• Added new policies for ExpressRoute Ports to the Connectivity table. Policy Initiatives.
• Updated documentation on unsupported/unrecommended Tenant Root Group deployment. FAQ.
• Provided new guidance for bringing your own Managed Identity. Bring Your Own User Assigned Managed Identity.
• Updated Policy Initiatives documentation to include Policy Reference ID and display names. Policy Initiatives.

• Automation: Introduced a new workflow to automate ARM template creation for Azure Policies/PolicySets, triggered by pull request events.

• Added new PIDs for additional deployment methods. See Disable telemetry tracking for more information.
• Introduced a new initiative to monitor Azure Arc-enabled Virtual Machines. Alerting-HybridVM.

• Changed minFailingPeriodsToAlert and numberOfEvaluationPeriods in existenceCondition from 2 to 4 to fix compliance evaluation.
• Changed timeAggregation to Average for AGW BackendLastByteResponseTime and AGW ApplicationGatewayTotalTime policies. Issue #194.
• Fixed case-sensitive parameters Issue #185.

• Updated Deploy only Service Health Alert documentation for json-strings in cloud shell.

• Updated Existence Condition to detect and remediate configuration drift. The following parameters were added to the Existence Condition of the policies:

  • Static alerts: EvaluationFrequency, WindowSize, Threshold, Severity, Operator, autoMitigate

  • Dynamic alerts: alertSensitivity, numberOfEvaluationPeriods, minFailingPeriodsToAlert

• Added suppression Alert Processing Rule in notification Assets policy. See Temporarily disabling notifications for details.

• Email address for Action Group is no longer mandatory.

• Bring your own Action Group and/or Alert Processing Rules. See Bring Your Own Notifications (BYON) for details.

• Fixed operator for SNATPortUtilization for Azure Firewall.
• Corrected name for Deploy Activity Log Storage Account Delete Policy.

• Updated deployment documentation to use the latest release.
• Updated Deploy only Service Health Alert documentation.
• Updated AMBA-ALZ Diagrams to include new notification assets initiative and Action group options. AMBA-Diagram.

• Enhanced action group for more notification and action choices:
  • Email Azure Resource Manager Role
  • Azure Function
  • Event Hubs
  • Logic App
  • Webhook
• Service health initiative now has its own Action Group.
• Added Notification Assets initiative.
• Introduced a new policy for Storage Account Deletion. Issue #76.
• Updated remediation script for better experience with the new action group for Service Health.

• Resolved: unable to deploy via pipeline using ubuntu-latest. Issue #64.
• Fixed PIP VIP alert existence condition to check only for standard SKU. Issue #80.

• Updated Deploy with GitHub Actions addressing Issue #102.
• Updated guidance for AMA in Monitoring and Alerting.

• Service Health Policy Set Definition now includes parameters to set Policy Effect. Default value is “deployIfNotExists”.
• Added alert rules in Landing Zone Policy Set Definition:
  • Front door (Microsoft.Cdn/profiles)
  • Front door classic (Microsoft.Network/frontdoors)
  • Traffic Manager (Microsoft.Network/trafficmanagerprofiles)
  • App Service (Microsoft.Web/serverfarms)

• Updated path in sample-workflow Issue #30.
• Updated sample commands in Start-AMBARemediation.ps1 Pull #49.
• Fixed Role Assignment cleanup script Issue #42.
• Fixed VSCode template validation error Issue #43.

• How to modify individual policies - How to modify individual policies.
• Added guidance for Server Health alert rules - Deploy only Service Health Alerts.
• New documentation on updating to a new release - Update to new releases.
• FAQ Updates - Frequently Asked Questions.