Azure Policy to deploy VM application is success when run on our Resource group, but app is not installed

Hi rajesh.john,
Thanks for replying back,
To install an application on Azure Virtual Machines (VMs) when it is not found, you can utilize Azure Policy, specifically the DeployIfNotExists policy effect. This approach automates the installation process and ensures compliance across your VMs. Here’s a structured guide on how to achieve this:

Steps to Install Applications via Azure Policy

1.Create an Azure Policy Definition

You need to define a policy that checks for the existence of the application on your VMs. The policy should specify the application you want to ensure is installed.

Policy Type: Use DeployIfNotExists, which deploys the application if it is not already present.

Target Resource Type: Specify Microsoft.Compute/virtualMachines as the resource type.

Here’s an example of what your policy definition might look like in JSON format:

json

{

"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json",

"contentVersion": "1.0.0.0",

"parameters": {

"vmName": {

  "type": "string"

}

},

"resources": [

{

  "type": "Microsoft.Compute/virtualMachines/VMapplications",

  "name": "[concat(parameters('vmName'), '/YourApplicationName')]",

  "properties": {

    // Application properties here

  }

}

],

"effect": "DeployIfNotExists"

}

2. Assign the Policy

Once your policy is defined, you need to assign it to the appropriate scope, such as a resource group or subscription. During assignment, ensure that the managed identity used has sufficient permissions to deploy applications.

3. Use Guest Configuration

To audit compliance and trigger installations, leverage Azure’s Guest Configuration feature. This allows you to check if specific software is installed on your VMs:

Create a Guest Configuration policy that audits for the application.

Set up an Event Grid subscription to listen for state change events related to compliance.

4. Automation with Azure Automation Runbooks

To automate the installation process when a VM is found non-compliant:

Create an Azure Automation runbook that will execute a script to install the application.

Use PowerShell commands within the runbook to perform the installation.

For instance, you can use:

powershell

Invoke-AzVMRunCommand -ResourceGroupName 'YourResourceGroup' -VMName 'YourVM' -CommandId 'RunPowerShellScript' -ScriptPath 'path/to/your/install-script.ps1'

5. Remediation Task

For existing VMs that may not have the application installed, create a remediation task:

Navigate to your policy assignment in Azure Policy.

Select Create Remediation Task and choose the relevant policy.

This task will evaluate existing VMs and trigger the installation of the application where necessary.

6. Monitoring Compliance

After implementing these steps, monitor compliance through the Azure portal. The Guest Configuration service will report back on whether each VM is compliant with the policy.

For better understand please go through attached referral link: https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/software-installation-using-azure-policy-state-change-events/2420515

If you required anything, please let us know. Thank you.