We have a deployment of a VNET with bicep which works fine. Moving to Terraform and there are issues with Azure policy. We have a policy which denies the creation of subnets with no NSGs. This is fine with Bicep…
A current challenge in a Subscription Vending environment, is that we rely on Tags on Subscriptions for certain data to be fed back in to other systems, for instance for CMDB entries or cost calculation. What we are trying to…
I'm simply trying to take the default deny template and add a few more tags that I want to get added to the resources. I get an error that says "tagName1" is not allowed. What am I missing? { "mode":…
I have a simple Azure Policy that should check if all API-management URL's are lowercase (Display Name and API Url Suffix), but violations still pass the check, so obviously the policy is incorrect. I am new to writing my own…
I have an Azure policy with a "Modify" effect: { "mode": "All", "policyRule": { "if": { "allOf": [ { "field": "type", "equals": "Microsoft.Web/sites" }, { "field": "Microsoft.Web/sites/publicNetworkAccess", "exists": "false" } ] }, "then": { "effect": "[parameters('effect')]", "details": { "roleDefinitionIds": […
Having read the question on the link here , I would like to get a list of all the names of Azure policies assigned to the tenant irrespective of the scope (subscription, management group etc). I ran the snippet Get-AzPolicyAssignment…
I have come across the post here and I have found it extremely useful as a first start. What am I trying to do ? when I look at Azure policies, I am trying to extract a report showing policy…
I'm looking to Audit VM Security Compliance given a policy definition with the chosen compliance "rules". I currently have a VM with AzureMonitorWindowsAgent and AzurePolicyforWindows extensions installed. I receive the following error message after assigning a custom policy definition derived…
I need to enable Network Policy (Route Table) for private endpoints in Azure. I've got a working Azure policy (shown below for reference), however this targets all subnets. Whilst this isn't really an issue (as the setting only applies to…
I am trying to stop users that arent global admins from creating new public ips and assigning them to vms or nics. But I dont want to affect the existing assigned ips. I think the best way to do it…