FY27-SQLMOD-Updates-2026-09-20

03-Azure/01-02 Data/02-SQL_Modernization/labautomation/infra/main-shared.bicep

@@ -90,6 +90,16 @@ module bastion 'modules/bastion.bicep' = {
   }
 }
 
+module logAnalytics 'modules/loganalytics.bicep' = {
+  name: 'loganalytics'
+  scope: resourceGroup
+  params: {
+    location: location
+    workspaceName: 'sqlhack-loganalytics'
+    retentionInDays: 30
+  }
+}
+
 module legacySqlVm 'modules/sql2016-vm.bicep' = {
   name: '${legacySQLName}-vm'
   scope: resourceGroup

03-Azure/01-02 Data/02-SQL_Modernization/labautomation/infra/modules/loganalytics.bicep

@@ -0,0 +1,28 @@
+@description('Name of the Log Analytics Workspace')
+param workspaceName string
+
+@description('Azure Region')
+param location string = resourceGroup().location
+
+@description('Retention in days')
+param retentionInDays int = 30
+
+resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
+  name: workspaceName
+  location: location
+
+  properties: {
+    retentionInDays: retentionInDays
+    features: {
+      searchVersion: 1
+      legacy: 0
+      enableLogAccessUsingOnlyResourcePermissions: true
+    }
+    sku: {
+      name: 'PerGB2018'
+    }
+  }
+}
+
+output workspaceId string = logAnalyticsWorkspace.id
+output workspaceCustomerId string = logAnalyticsWorkspace.properties.customerId

03-Azure/01-02 Data/02-SQL_Modernization/labautomation/infra/modules/team-vm-cse.bicep

@@ -39,6 +39,7 @@ resource ConfigureTeamMachine 'Microsoft.Compute/virtualMachines/extensions@2024
         '${repoBaseURL}/scripts/Download-Samples.ps1'
         '${repoBaseURL}/scripts/bootstrap-teamvm.ps1'
         '${repoBaseURL}/scripts/Configure-Teams-Shortcuts.ps1'
+        '${repoBaseURL}/scripts/Configure-TeamVM.ps1'
         '${repoBaseURL}/scripts/Restore-TeamDatabases.ps1'
         '${repoBaseURL}/scripts/Configure-legacySQL-DB.ps1'
         '${repoBaseURL}/scripts/Configure-SQLMI-Sysadmins.ps1'

03-Azure/01-02 Data/02-SQL_Modernization/labautomation/scripts/Configure-SQLMI-Sysadmins.ps1

@@ -27,26 +27,28 @@ END
 ALTER SERVER ROLE [sysadmin] ADD MEMBER [$sqlMiSysadminUser];
 "@
 
-[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.ConnectionInfo") | Out-Null
-[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.Smo") | Out-Null
-
 $connectionString = "Data Source=$ManagedInstanceServer;Initial Catalog=master;TrustServerCertificate=True;"
 $Connection = New-Object System.Data.SqlClient.SqlConnection($connectionString)
 [System.Security.SecureString]$SQLPwd = $sqlpassword | ConvertTo-SecureString -AsPlainText -Force
 $SQLPwd.MakeReadOnly()
 $cred = New-Object System.Data.SqlClient.SqlCredential($sqlusername,$SQLPwd)
 $Connection.credential = $cred
 
-# 5. SMO-Serververbindung initialisieren
-$serverConnection = New-Object Microsoft.SqlServer.Management.Common.ServerConnection($Connection)
-$server = New-Object Microsoft.SqlServer.Management.Smo.Server($serverConnection)
-
 try {
-    # Ausführung des Skripts inkl. GO-Trenner
-    [void]$server.ConnectionContext.ExecuteNonQuery($ConfigureSql)
-    #Write-Host "Skript erfolgreich auf SQL MI ausgeführt." -ForegroundColor Green
+    $Connection.open()
+
+    $command = New-Object system.Data.SqlClient.SqlCommand($Connection)
+    $command.Connection = $Connection
+    $command.CommandTimeout = $QueryTimeout
+
+    $command.CommandText = $ConfigureSql
+    $result = $command.ExecuteNonQuery()
+    #$result = $command.ExecuteReader()
+    #$table = New-Object System.Data.DataTable
+    #$table.Load($result)
 }
 catch {
+    Write-Host $result
     $ErrorString = $_ | format-list -force | Out-String
     Write-Error "ERR: $ErrorString"
 }

03-Azure/01-02 Data/02-SQL_Modernization/labautomation/scripts/Configure-TeamVM.ps1

@@ -0,0 +1,160 @@
+# Disable Privacy Experience / First Sign-In Experience
+# Run as Administrator
+
+$ErrorActionPreference = 'Stop'
+
+$logPath = 'C:\Windows\Temp\Configure-TeamVM.log'
+Start-Transcript -Path $logPath -Append
+
+$policies = @(
+    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE",
+    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent",
+    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection",
+    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE"
+)
+
+foreach ($path in $policies)
+{
+    if (-not (Test-Path $path))
+    {
+        New-Item -Path $path -Force | Out-Null
+    }
+}
+
+# Skip privacy experience
+New-ItemProperty `
+    -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OOBE" `
+    -Name "DisablePrivacyExperience" `
+    -Value 1 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+# Disable consumer experiences
+New-ItemProperty `
+    -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" `
+    -Name "DisableWindowsConsumerFeatures" `
+    -Value 1 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+# Required diagnostics only
+New-ItemProperty `
+    -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" `
+    -Name "AllowTelemetry" `
+    -Value 1 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+# Skip user privacy consent prompts
+New-ItemProperty `
+    -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" `
+    -Name "PrivacyConsentStatus" `
+    -Value 1 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+# Disable "Let's finish setting up your device"
+New-ItemProperty `
+    -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" `
+    -Name "DisableSoftLanding" `
+    -Value 1 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+# Disable welcome experience
+New-ItemProperty `
+    -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" `
+    -Name "DisableWindowsSpotlightWindowsWelcomeExperience" `
+    -Value 1 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+$cdmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent"
+
+New-ItemProperty -Path $cdmPath `
+    -Name "DisableTailoredExperiencesWithDiagnosticData" `
+    -Value 1 `
+    -PropertyType DWord `
+    -Force
+
+New-ItemProperty -Path $cdmPath `
+    -Name "DisableThirdPartySuggestions" `
+    -Value 1 `
+    -PropertyType DWord `
+    -Force
+
+New-ItemProperty -Path $cdmPath `
+    -Name "DisableConsumerAccountStateContent" `
+    -Value 1 `
+    -PropertyType DWord `
+    -Force
+
+Write-Output "Privacy Experience disabled."
+
+# Disable Microsoft Edge First Run Experience
+# Run as Administrator
+
+$edgePolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
+
+if (-not (Test-Path $edgePolicyPath))
+{
+    New-Item -Path $edgePolicyPath -Force | Out-Null
+}
+
+# Disable First Run Experience entirely
+New-ItemProperty `
+    -Path $edgePolicyPath `
+    -Name "HideFirstRunExperience" `
+    -Value 1 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+# Disable browser sign-in prompts
+New-ItemProperty `
+    -Path $edgePolicyPath `
+    -Name "BrowserSignin" `
+    -Value 0 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+# Disable importing browser data prompts
+New-ItemProperty `
+    -Path $edgePolicyPath `
+    -Name "ImportOnEachLaunch" `
+    -Value 0 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+# Disable profile creation prompts
+New-ItemProperty `
+    -Path $edgePolicyPath `
+    -Name "ImplicitSignInEnabled" `
+    -Value 0 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+# Optional: Disable Edge promotional dialogs
+New-ItemProperty `
+    -Path $edgePolicyPath `
+    -Name "ShowRecommendationsEnabled" `
+    -Value 0 `
+    -PropertyType DWord `
+    -Force | Out-Null
+
+Write-Output "Edge First Run Experience disabled."
+
+New-ItemProperty `
+    -Path $edgePolicyPath `
+    -Name "PromotionalTabsEnabled" `
+    -Value 0 `
+    -PropertyType DWord `
+    -Force
+
+New-ItemProperty `
+    -Path $edgePolicyPath `
+    -Name "EdgeWelcomePageEnabled" `
+    -Value 0 `
+    -PropertyType DWord `
+    -Force
+
+Stop-Transcript

03-Azure/01-02 Data/02-SQL_Modernization/labautomation/scripts/bootstrap-teamvm.ps1

@@ -21,6 +21,9 @@ Start-Transcript -Path $logPath -Append
 
 Write-Host "Configuring TEAM VM..."
 
+Write-Host "Configure Team VM (Privacy Experience / OOBE Privacy Consent Page) ..."
+& .\Configure-TeamVM.ps1
+
 ##Not working with Bastion, so we will not set wallpaper for now.  If you want to set wallpaper, you can run the following command after you RDP into the VM.
 Write-Host "Configure Team Wallpaper..."
 & .\Configure-TeamWallpaper.ps1 -WallpaperUri $WallpaperUri -TeamName $TeamName

03-Azure/01-02 Data/02-SQL_Modernization/labautomation/shared-deploy-lab.ps1

@@ -35,7 +35,9 @@ $requiredProviders = @(
     "Microsoft.Storage",
     "Microsoft.Sql",
     "Microsoft.SqlVirtualMachine",
-    "Microsoft.DevTestLab"
+    "Microsoft.DevTestLab",
+    "Microsoft.OperationalInsights",
+    "Microsoft.Insights"
 )
 foreach($provider in $requiredProviders) {
     $state = (Get-AzResourceProvider -ProviderNamespace $provider -ErrorAction SilentlyContinue | Select-Object -First 1).RegistrationState
@@ -240,6 +242,74 @@ if (-not $found)
     throw "Expected Entra ID Admin was not configured within 2 minutes."
 }
 
+#Configure Log Settings for SQLMI
+$ErrorOccurred = $false
+try {
+
+    $databaseName   = "TenantCRM"
+    $workspaceName  = "sqlhack-loganalytics"
+    $workspace = Get-AzOperationalInsightsWorkspace -ResourceGroupName $sharedResourceGroup -Name $WorkspaceName -ErrorAction Stop
+    $workspaceResourceId = $workspace.ResourceId
+
+    #----------------------------------------------------------
+    # Managed Instance
+    #----------------------------------------------------------
+    $miCategories = Get-AzDiagnosticSettingCategory -ResourceId $managedInstance.Id
+    $miLogs = @()
+    foreach ($category in $miCategories)
+    {
+        if ($category.CategoryType -eq "Logs")
+        {
+            $miLogs += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category $category.Name
+        }
+    }
+    $miMetrics = @()
+    foreach ($category in $miCategories)
+    {
+        if ($category.CategoryType -eq "Metrics")
+        {
+            $miMetrics += New-AzDiagnosticSettingMetricSettingsObject -Enabled $true -Category $category.Name
+        }
+    }
+    New-AzDiagnosticSetting -Name "sqlmi-alllogs" -ResourceId $managedInstance.Id -WorkspaceId $workspaceResourceId -Log $miLogs -Metric $miMetrics -ErrorAction Stop
+
+    #----------------------------------------------------------
+    # Datenbank TENANTCRM
+    #----------------------------------------------------------
+    $db = Get-AzResource -ResourceType "Microsoft.Sql/managedInstances/databases" | Where-Object { $_.Name -eq "$managedInstanceName/$databaseName" }
+    if (-not $db)
+    {
+        throw "Datenbank $databaseName wurde nicht gefunden."
+    }
+    $dbCategories = Get-AzDiagnosticSettingCategory -ResourceId $db.ResourceId
+    $dbLogs = @()
+    foreach ($category in $dbCategories)
+    {
+        if ($category.CategoryType -eq "Logs")
+        {
+            $dbLogs += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category $category.Name
+        }
+    }
+    $dbMetrics = @()
+    foreach ($category in $dbCategories)
+    {
+        if ($category.CategoryType -eq "Metrics")
+        {
+            $dbMetrics += New-AzDiagnosticSettingMetricSettingsObject -Enabled $true -Category $category.Name
+        }
+    }
+    New-AzDiagnosticSetting -Name "$databaseName-alllogs" -ResourceId $db.ResourceId -WorkspaceId $workspaceResourceId -Log $dbLogs -Metric $dbMetrics -ErrorAction Stop
+}
+catch {
+    Write-Host "Could not configure log settings."
+    $ErrorString = $_ | format-list -force | Out-String
+    Write-Error "ERR: $ErrorString"
+    $ErrorOccurred = $true
+}
+if ($ErrorOccurred) {
+    throw "Errors occurred during log settings configuration. Please check the logs for details."
+}
+
 $rg = Get-AzResourceGroup -Name $sharedResourceGroup -ErrorAction SilentlyContinue
 $tags = $rg.Tags
 $tags["microhack-shared-deployment"] = "Succeeded"

03-Azure/01-02 Data/02-SQL_Modernization/walkthrough/challenge-01/solution-01.md

@@ -24,17 +24,15 @@
 
 ![generated](../../Images/MigrationArchitecturev2.png)
 
-<a id="generic-migration-content"></a>
 # Generic Migration Content
-
 | **Narrative**  | **Notes**  |
 |:-----|:-------|
 | *Notes for outside of the workshop:*  *Familiarise yourself with the new Microsoft migration capabilities with SQL Server Management Studio and Migration options by using Arc* | Migrate SQL Server to Azure SQL (SSMS): [https://learn.microsoft.com/en-us/ssms/migrate/migrate-sql-server-azure-sql?tabs=sql-standard](https://learn.microsoft.com/en-us/ssms/migrate/migrate-sql-server-azure-sql?tabs=sql-standard) This article covers the migration from Arc-Enabled SQL Server instances and Non Arc-Enabled SQL Server instances. For Non Arc-Enabled SQL Server instances there will be no performance-based sizing recommendation. |
 
 # Connect to your Win11 VM
 |**Narrative**| **Screenshot**| **Notes**|
 |:------------|:--------------|:---------|
-|Connect to the Azure Portal with <secret group="Azure" name="Entra ID Username" show="true"></secret> and password <secret group="Azure" name="Entra ID TAP"></secret>. In the Azure Portal open your Win11 VM <secret group="Lab-General" name="Team VM Name" show="true"></secret>. Connect to the VM with Bastion with the following VM connection credentials Username <secret group="Lab-Credential" name="VM User Name" show="true"></secret> and password <secret group="Lab-Credential" name="VM User Password"></secret>. Please make sure to select the correct keyboard layout.|![Bastion Logon](../../Images/Bastion-VM11.png)| |
+|Connect to the Azure Portal with <secret group="Azure" name="Entra ID Username" show="true"></secret> and password <secret group="Azure" name="Entra ID TAP"></secret>.<br>In the Azure Portal open your Win11 VM <secret group="Lab-General" name="Team VM Name" show="true"></secret>.<br>Connect to the VM with Bastion with the following VM connection credentials Username <secret group="Lab-Credentials" name="VM User Name" show="true"></secret> and password <secret group="Lab-Credentials" name="VM User Password"></secret>.<br>Please make sure to select the correct keyboard language.|![Bastion Logon](../../Images/Bastion-VM11.png)| |