SQL Database Security Alert Policies API (2014-04-01) In-Idempotent Behavior of userServerDefault

[magodo]

SQL Database Security Alert Policies API version 2014-04-01 has property called useServerDefault in the DatabaseSecurityAlertPolicyProperties. From swagger definition, this property accepts either "Enabled" or "Disabled". So if I define the security alert policy in SQL Server, invoke the following request, which specifies this property as Enabled:

PUT HTTP/2.0 https://management.azure.com/subscriptions/67a9759d-d099-4aa8-8675-e6cfd669c3f4/resourceGroups/acceptanceTestRG-magodo2/providers/Microsoft.Sql/servers/sqlserver-magodo/databases/sqldatabase-magodo/securityAlertPolicies/default?api-version=2014-04-01

REQUEST

{
    "location": "eastus",
    "properties": {
        "disabledAlerts": "",
        "emailAccountAdmins": "Disabled",
        "emailAddresses": "",
        "retentionDays": 0,
        "state": "Disabled",
        "storageAccountAccessKey": "",
        "storageEndpoint": "",
        "useServerDefault": "Enabled"
    }
}

RESPONSE

{
    "id": "/subscriptions/67a9759d-d099-4aa8-8675-e6cfd669c3f4/resourceGroups/acceptanceTestRG-magodo2/providers/Microsoft.Sql/servers/sqlserver-magodo/databases/sqldatabase-magodo/securityAlertPolicies/default",
    "kind": null,
    "location": "eastus",
    "name": "default",
    "properties": {
        "disabledAlerts": "",
        "emailAccountAdmins": "Disabled",
        "emailAddresses": "",
        "retentionDays": 0,
        "state": "Disabled",
        "storageAccountAccessKey": "",
        "storageEndpoint": "",
        "useServerDefault": "Enabled"
    },
    "type": "Microsoft.Sql/servers/databases/securityAlertPolicies"
}

Then if I invoke a GET right after, the useServerDefault is changed into Disabled.

GET HTTP/2.0  https://management.azure.com/subscriptions/67a9759d-d099-4aa8-8675-e6cfd669c3f4/resourceGroups/acceptanceTestRG-magodo2/providers/Microsoft.Sql/servers/sqlserver-magodo/databases/sqldatabase-magodo/securityAlertPolicies/default?api-version=2014-04-01

RESPONSE

{
    "id": "/subscriptions/67a9759d-d099-4aa8-8675-e6cfd669c3f4/resourceGroups/acceptanceTestRG-magodo2/providers/Microsoft.Sql/servers/sqlserver-magodo/databases/sqldatabase-magodo/securityAlertPolicies/default",
    "kind": null,
    "location": "East US",
    "name": "default",
    "properties": {
        "disabledAlerts": "",
        "emailAccountAdmins": "Disabled",
        "emailAddresses": "",
        "retentionDays": 0,
        "state": "Disabled",
        "storageAccountAccessKey": "",
        "storageEndpoint": "",
        "useServerDefault": "Disabled"
    },
    "type": "Microsoft.Sql/servers/databases/securityAlertPolicies"
}

This behavior makes IaC tools that depend on the idempotency of API hard to implement.

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @azureSQLGitHub.

[magodo]

Any progress on this one?

[GrooveGod]

Just confirmed this problem still exists, any progress yet?

[magodo]

@weidongxu-microsoft Please take a look at this issue, it breaks for a long time..

[weidongxu-microsoft]

@azureSQLGitHub any update?

[ayeletshpigelman]

useServerDefault is a deprecated property. please ignore it. Moreover, we recommend using API version 2018-06-01-preview for QL Database Security Alert Policies

[ericshape]

@magodo Thanks for your feedback!
for MSFT internal user, please raise one IcM sev 3 CRI ticket to unblock if necessary.
I will close this issue because the expert @ayeletshpigelman has provided the answer.