Implement exemption in Azure Policies via using Tags and its value.

Question

We have different sets of resources in our environment and need to implement some policies for audit and deny. However, we are not able to figure out how to exclude resources based on their tags and its value. We cannot just exclude whole RGs or subs. Need assistance.

Answer 1

Hi Rakesh,

You can use logical operators to exclude the tags under all resources:

https://learn.microsoft.com/en-us/azure/governance/policy/samples/pattern-logical-operators

Example:

"policyRule": {
   "if": {
      "allOf": [
         {
            "field": "tags['tagName']",
            "notEquals": "tagValue"
         }
      ]
   },
   "then": {
      "effect": "deny" // Or "audit" depending on your needs
   }
}

Please click "Accept as Answer" if it helps.