Denying OpenAI Resource Creation with Abuse Monitoring Enabled using Azure Policy

Question

How can I create an Azure policy to deny the creation of OpenAI resources with abuse monitoring enabled, when my current policy only marks resources as non-compliant after creation?

PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community.

Answer 1

When attempting to create an Azure policy to deny the creation of OpenAI resources with abuse monitoring enabled, you might find that the resource is created but marked as non-compliant only after a policy scan. This occurs because the capabilities property, which includes the ContentLogging attribute, only appears after the resource is deployed. Thus, it cannot be used to block the resource creation during deployment.

As a workaround, you can consider implementing other policies or strategies. One approach is to create policies that identify non-compliant resources after they are deployed and take appropriate actions, such as remediation scripts or alerts. Alternatively, you can restrict the models that can be deployed within the OpenAI resources, which can indirectly prevent the creation of non-compliant resources.

For more detailed guidance on creating and managing Azure policies, refer to the following resources:

Resources:

• Azure Policy Overview
• Creating and Managing Policies

Please do not forget to "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.