Question 103732 in Azure Question posted in
The official documentation to get you started can be found here.

Is it possible to create an Azure Policy Exemption at the same as as the resource being exempted?

Azure Policy can be used to define conventions that, when Policy Enforcement is enabled, will prevent non-compliant resources from being created.

In scenarios where non-compliant resources need to be exempted this leads to having to coordinate several steps:

  1. Disable policy Enforcement
  2. Create the non-compliant resource
  3. Add the exemption for the non-compliant resource to the Policy Assignment
  4. Re-enable Enforcement
  5. Review if any unexpected changes occurred during the period of time Enforcement was disabled — and how to bring things back to compliance

While the above is acceptable, I’m curious if there is an ability to simultaneously create the non-compliant resource and the exemption without the need to coordinate other steps and create the chance for other issues to be introduced.

Is there a way to create a resource and an policy assignment exemption for it simultaneously? Is this potentially in a preview or private preview feature?

Tags:

2

Answers


  1. 0

    From my experience a resource needs to exist before it can be included in an exemption. However, these docs confirm that exemptions do work on the hierarchy in Azure. This means that you could in steps create a resourcegroup to hold your non-compliant resources, then create the exemption with the scope of that resourcegroup and then create the non-compliant resources.

    Login or Signup to reply.
  2. 0

    It sounds like you are looking for an automated solution.
    I have not done this or seen anyone else do this – still unsure of your use case. Why deploy a resource that needs to be exempted automatically?
    Anyway, you might have a chance of achieving this with:

    1. Blueprints: https://learn.microsoft.com/en-us/azure/governance/blueprints/overview
    2. Manually executing a PowerShell script: https://learn.microsoft.com/en-us/cli/azure/policy/exemption?view=azure-cli-latest#az-policy-exemption-create (or API).
    3. IaC adding this to your ARM template https://learn.microsoft.com/en-us/azure/templates/microsoft.authorization/policyexemptions?pivots=deployment-language-arm-template
    4. Policy using Modify or DeployIfNotExists using https://learn.microsoft.com/en-us/azure/templates/microsoft.authorization/policyexemptions?pivots=deployment-language-arm-template
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search