{
  "properties": {
    "displayName": "Configure local Windows maximum password age to 60 days",
    "description": "Set maximum password age to 60 days.",
    "mode": "Indexed",
    "version": "1.3.0",
    "metadata": {
      "category": "Guest Configuration",
      "guestConfiguration": {
        "autoRemediationAssignmentType": "ApplyAndMonitor",
        "contentHash": "046E73FEFB832DE5DFAE33973F39AC31BE5592C9599F93C369B27C02713EEA8B",
        "contentManagedIdentity": "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<package-identity>",
        "contentType": "Custom",
        "contentUri": "https://<storage-account>.blob.core.windows.net/configuration-packages/LocalPasswordAge60_v1_0_0.zip",
        "enableAutoRemediation": "[parameters('EnableAutoRemediation')]",
        "name": "LocalPasswordAge60_v1_0_0",
        "version": "1.0.0"
      },
      "requiredProviders": [
        "Microsoft.GuestConfiguration"
      ],
      "version": "1.3.0"
    },
    "parameters": {
      "BenchmarkTagName": {
        "defaultValue": "vmsecurityBenchmarks",
        "metadata": {
          "displayName": "VM opt-in tag name"
        },
        "type": "String"
      },
      "EnableAutoRemediation": {
        "allowedValues": [
          "true",
          "false"
        ],
        "defaultValue": "false",
        "metadata": {
          "displayName": "Apply automatically"
        },
        "type": "String"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "equals": "true",
            "field": "[concat('tags[', parameters('BenchmarkTagName'), ']')]"
          },
          {
            "equals": "Microsoft.Compute/virtualMachines",
            "field": "type"
          },
          {
            "equals": "Windows",
            "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType"
          },
          {
            "field": "tags['aks-managed-orchestrator']",
            "exists": "false"
          },
          {
            "field": "tags['aks-managed-poolName']",
            "exists": "false"
          },
          {
            "anyOf": [
              {
                "field": "Microsoft.Compute/imageSKU",
                "exists": "false"
              },
              {
                "allOf": [
                  {
                    "field": "Microsoft.Compute/imageSKU",
                    "notLike": "2008*"
                  },
                  {
                    "field": "Microsoft.Compute/imageOffer",
                    "notLike": "SQL2008*"
                  }
                ]
              }
            ]
          }
        ]
      },
      "then": {
        "details": {
          "deployment": {
            "properties": {
              "mode": "incremental",
              "parameters": {
                "resourceName": {
                  "value": "[concat(field('name'), '/Microsoft.GuestConfiguration/LocalPasswordAge60_v1_0_0$pid', uniqueString(policy().assignmentId, policy().definitionReferenceId))]"
                },
                "location": {
                  "value": "[field('location')]"
                }
              },
              "template": {
                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "resourceName": {
                    "type": "string"
                  },
                  "location": {
                    "type": "string"
                  }
                },
                "resources": [
                  {
                    "apiVersion": "2024-04-05",
                    "location": "[parameters('location')]",
                    "name": "[parameters('resourceName')]",
                    "properties": {
                      "guestConfiguration": {
                        "assignmentType": "ApplyAndMonitor",
                        "contentHash": "046E73FEFB832DE5DFAE33973F39AC31BE5592C9599F93C369B27C02713EEA8B",
                        "contentManagedIdentity": "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<package-identity>",
                        "contentType": "Custom",
                        "contentUri": "https://<storage-account>.blob.core.windows.net/configuration-packages/LocalPasswordAge60_v1_0_0.zip",
                        "name": "LocalPasswordAge60_v1_0_0",
                        "version": "1.0.0"
                      }
                    },
                    "type": "Microsoft.Compute/virtualMachines/providers/guestConfigurationAssignments"
                  }
                ]
              }
            }
          },
          "existenceCondition": {
            "allOf": [
              {
                "equals": "Compliant",
                "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus"
              },
              {
                "in": [
                  "true",
                  "false"
                ],
                "value": "[parameters('EnableAutoRemediation')]"
              }
            ]
          },
          "name": "[concat('LocalPasswordAge60_v1_0_0$pid', uniqueString(policy().assignmentId, policy().definitionReferenceId))]",
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/088ab73d-1256-47ae-bea9-9de8e7131f31"
          ],
          "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments"
        },
        "effect": "deployIfNotExists"
      }
    }
  }
}