Integrating EPAC with the Azure Landing Zones Library documentation missing

[stefanstranger]

I've installed EPAC and want to use the Azure Landing Zones (ALZ) best practices and looked at the integration option for EPAC with the Azure Landing Zones Library documentation

There is described which pre-requisites are required to get this working.

• Log Analytics workspace
• DCR rules to support monitoring - data collection rule templates
• User Assigned Managed Identity to support Azure Monitor Agent - sample template

There is a reference to the Data Collection Rules that need to be configured in advance before the synchronization process can be started. I cannot find any clear documentation on the installation steps before these Data Collection Rules can be created. E.g. The Data Collection Rule(DCR) for Defender for SQL seems to have a pre-requisite on Microsoft Cloud for Defender so that the Azure SQL Databases Defender Plan is enabled. But this nowhere documented.

Where can I find clear documentation about these requirements?

Regards,
Stefan Stranger [MSFT]

[anwather]

So if you have previously deployed the ALZ using either Bicep/Terraform/Portal - it should create these DCRs for you.

If not - the link goes to a repo containing the templates to deploy these rules.

Not having them won't prevent the sync of policy via EPAC - but those DCR resource Ids are required as parameter inputs to some of the ALZ policies.

Of course if you don't have them and don't add the resource Id's into the parameters the monitoring policies won't work.

Let me know if this makes sense or if you need further info!

[stefanstranger]

Hi @anwather thanks for your response.

For the deployment of our platform environment we have not used ALZ. We have deployed an ALZ MG-structure and now we want to use EPAC as Policy Engine and start with the default ALZ Policies using the described integration process.

We have deployed a Log Analytics Workspace and now we want to follow the pre-reqs instructions so can use this in the EPAC configuration file(s).

When we try to deploy the DCR dataCollectionRule-DefenderSQL it fails with the error message that the following tables are missing in our Log Analytics workspace.

(InvalidOutputTable) Table for output stream 'Microsoft-DefenderForSqlScanEvents' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule.
				Code: InvalidOutputTable
				Message: Table for output stream 'Microsoft-DefenderForSqlScanEvents' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule.
				Target: properties.dataFlows[0]	(InvalidOutputTable) Table for output stream 'Microsoft-DefenderForSqlScanResults' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule.
				Code: InvalidOutputTable
				Message: Table for output stream 'Microsoft-DefenderForSqlScanResults' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule.
				Target: properties.dataFlows[0]	(InvalidOutputTable) Table for output stream 'Microsoft-SqlAtpStatus-DefenderForSql' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule.
				Code: InvalidOutputTable
				Message: Table for output stream 'Microsoft-SqlAtpStatus-DefenderForSql' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule.
				Target: properties.dataFlows[0]

I'm trying to understand which process will create these tables? Does the Azure SQL Databases Defender Plan needs to be enabled? Or is there something else that needs to be done so that these tables are being created and we can deploy the DCR dataCollectionRule-DefenderSQL?

/Stefan

[anwather]

Good question let me try and find out for you Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: Stefan Stranger ***@***.***> Sent: Wednesday, September 24, 2025 5:11:31 PM To: Azure/enterprise-azure-policy-as-code ***@***.***> Cc: Mention ***@***.***>; Comment ***@***.***>; Subscribed ***@***.***> Subject: Re: [Azure/enterprise-azure-policy-as-code] Integrating EPAC with the Azure Landing Zones Library documentation missing (Issue #1050) Hi @anwather<https://github.com/anwather> thanks for your response. For the deployment of our platform environment we have not used ALZ. We have deployed an ALZ MG-structure and now we want to use EPAC as Policy Engine and start with the default ALZ Policies using the described integration process. We have deployed a Log Analytics Workspace and now we want to follow the pre-reqs instructions so can use this in the EPAC configuration file(s). When we try to deploy the DCR dataCollectionRule-DefenderSQL it fails with the error message that the following tables are missing in our Log Analytics workspace. (InvalidOutputTable) Table for output stream 'Microsoft-DefenderForSqlScanEvents' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule. Code: InvalidOutputTable Message: Table for output stream 'Microsoft-DefenderForSqlScanEvents' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule. Target: properties.dataFlows[0] (InvalidOutputTable) Table for output stream 'Microsoft-DefenderForSqlScanResults' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule. Code: InvalidOutputTable Message: Table for output stream 'Microsoft-DefenderForSqlScanResults' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule. Target: properties.dataFlows[0] (InvalidOutputTable) Table for output stream 'Microsoft-SqlAtpStatus-DefenderForSql' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule. Code: InvalidOutputTable Message: Table for output stream 'Microsoft-SqlAtpStatus-DefenderForSql' is not available for destination 'LogAnalyticsDest'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule. Target: properties.dataFlows[0] I'm trying to understand which process will create these tables? Does the Azure SQL Databases Defender Plan needs to be enabled? Or is there something else that needs to be done so that these tables are being created and we can deploy the DCR dataCollectionRule-DefenderSQL? /Stefan — Reply to this email directly, view it on GitHub<#1050 (comment)> or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACWCJVTCBDSLVVHJ4ROO4R33UI72HBFHORZGSZ3HMVZKMY3SMVQXIZNMON2WE2TFMN2F65DZOBS2YSLTON2WKQ3PNVWWK3TUUZ2G64DJMNZZFAVEOR4XAZNKOJSXA33TNF2G64TZUV3GC3DVMWUTGMZXGE3DEOBTHCBKI5DZOBS2K2LTON2WLJLWMFWHKZNKGM2DINJRG44TEMJQVJQXI5DSNFRHK5DFOOKIFJLWMFWHKZNEORZHKZNENZQW2ZN3ORUHEZLBMRPXAYLSORUWG2LQMFXHIX3BMN2GS5TJOR4YFJLWMFWHKZNEORZHKZNENZQW2ZNOO5QXIY3IL5QWG5DJOZUXI6MCUV3GC3DVMWSWS43TOVS2I3TBNVS2W5DIOJSWCZC7OR4XAZMCUV3GC3DVMWTTEMJSGUZTQNNENZQW2ZNIMFRXI33SL5UWI>. You are receiving this email because you were mentioned. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[anwather]

I can't see that table being created by the ALZ templates, I'm not actually sure where it comes from. You could try creating manually and then create the DCR? I need some more time to work out what is happening.

[anwather]

It might also be worth asking on the enterprise scale Github repo as well.