Vnext#551
Merged
Merged
Conversation
…> 4.80.0 (#541) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#540) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#539) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#538) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#537) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#536) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#534) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#533) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#532) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#531) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#530) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#529) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…> 4.80.0 (#528) Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version. Updates `hashicorp/azurerm` to 4.80.0 - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v4.79.0...v4.80.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-version: 4.80.0 dependency-type: direct:production dependency-group: terraform-all ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Retire ai-foundry module and remove from dependabot Move extras/modules/ai-foundry to extras/modules/retired/ai-foundry, remove its dependabot terraform entry, and update the commented-out module source path in main.tf. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Exclude retired boneyard from lychee and fix ai-foundry link Add exclude_path = ["retired"] to lychee.toml so retired modules are skipped by the link checker, and update the ai-foundry link in extras/README.md to its new retired location. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…wn C:\Scripts (#543) Co-authored-by: David Pless <dplessMSFT@users.noreply.github.com> Co-authored-by: Roger Doherty (MSFT) <rdoherty@microsoft.com>
The AtStartup scheduled task 'Set-MssqlStartupConfiguration' (rebuilds the ephemeral temp-disk stripe, recreates tempdb folders, fixes the pagefile and starts SQL Server after a stop/deallocate) was registered to run as the domain admin with a stored password. On the post-deallocate boot this failed to launch (TaskScheduler Event 104, ERROR_LOGON_FAILURE 0x8007052E): an AtStartup batch logon with a stored domain password races the domain controller secure channel at boot and is blocked by Credential Guard (default-on in Windows Server 2025). The task never ran, so T: was never rebuilt and SQL Server stayed stopped. Changes (vm-mssql-win only): - Set-MssqlConfiguration.ps1: register 'Set-MssqlStartupConfiguration' with a 'NT AUTHORITY\SYSTEM' principal (no stored password, no DC dependency, Credential-Guard-immune). The task does only local work, so it needs no domain admin / SQL sysadmin identity. - Set-MssqlStartupConfiguration.ps1: update header to document it runs as SYSTEM and why. - Invoke-MssqlConfiguration.ps1: harden the one-time 'Set-MssqlConfiguration-Reboot' task (Restart-Computer only) to SYSTEM; document that 'Set-MssqlConfiguration' intentionally stays domain admin (on-demand, trusted-auth SQL sysadmin work, not boot-triggered). - Test-VmMssqlWin.ps1: harden Startup Check 1 to also assert LastRunTime is after the last OS boot, catching the false PASS where a boot task fails to launch and leaves a stale success result. - README.md: reflect that the startup/reboot tasks run as SYSTEM while first-boot config is unchanged (still domain admin). End state preserved: domain-joined VM with SQL Server administered by the domain admin (SQL sysadmin). Swept all provisioning automation in compute.tf (join_domain, run commands, CustomScriptExtension, ama) and confirmed no other stored-domain-credential-at-boot pattern exists. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…#550) Grant-SqlFullControl queried the MSSQLSERVER service's logon account (Get-CimInstance ... StartName) and granted that account FullControl on the freshly created SQL data and errorlog directories. Backport the ACL-identity hardening from PR #543: grant FullControl to the Database Engine per-service SID 'NT SERVICE\MSSQLSERVER' instead. The per-service SID is present in the service process token regardless of the configured logon account, survives service-account changes, and matches the permissions the SQL Server installer applies to its data directories. The grant remains non-destructive (SetAccessRule, inheritance preserved), so this is a low-risk change on the already freshly-created target directories. Only theme A from PR #543 is backported. Themes B (inheritance disable + clean-slate ACEs on data/errorlog dirs), C (C:\Scripts lockdown), D (encoding), and E (README) are out of scope: B needs deploy+integration testing before adoption, C has no analog (CustomScriptExtension delivery, no user-writable C:\Scripts), D is N/A (module scripts already ASCII-clean), and E is unneeded (README does not document the folder-ACL service account). Closes #549 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Does this introduce a breaking change?
Pull Request Type
What kind of change does this Pull Request introduce?
How to Test
What to Check
Verify that the following are valid
Other Information