Prevent DevTest Lab user from creating new Disks

Question

Hello,

Is there a way, (other than those suggested by ChatGPT), to prevent/disable the "attach new" disk option in lab virtual machine settings?

Edited: I modified the built-in DevTest Lab User role and added the lines below to the "notActions" but still the user can add new disk.

"Microsoft.DevTestLab/labs/virtualMachines/AddDataDisk/action" "Microsoft.DevTestLab/labs/users/disks/Attach/action"

Answer 1

Hello, @Mas023 ! Thank you for your patience while we confirmed the functionality of the custom policy.

How do I prevent a DevTest Labs user from add or modifying disks?

Lab users will automatically be assigned the Owner role on VMs that they create. This will grant permission to attach and add a data disk and is not overridden when assigning NotActions in a custom role.

The question then becomes, "Can we prevent Owners from adding or modifying disks?"

This can be done using Azure policy although we should note that this custom policy will affect all owners and not just Azure DevTest Lab users. Using this custom policy will require selective enabling/disabling to accomplish your goals:

    "if": {
        "allOf": [
            {
                "field": "type",
                "equals": "Microsoft.Compute/virtualMachines"
            },
            {
                "field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*]",
                "exists": "true"
            }
        ]
    },
    "then": {
    "effect": "deny"
    }
}

Attempts to attach a disk will result in a failed attempt due to the customer Azure Policy:

Creating the custom policy:

---

I hope this has been helpful! Your feedback is important so please take a moment to accept answers.

If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!