Azure Policy target only windows

Question

Hello! :)

I am fairly new to Azure Policy, I am trying to create a policy to target windows servers that doesn't have AHUB enabled, however this policy keeps getting Linux machines in aswell.

Why is that, when I state it should be windowsserver or dynamics?

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "anyOf": [
            {
              "field": "type",
              "equals": "Microsoft.Compute/virtualMachines"
            }
          ]
        },
        {
          "anyOf": [
            {
              "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.publisher",
              "equals": "MicrosoftDynamicsAX"
            },
            {
              "field": "Microsoft.Compute/virtualMachines/storageProfile.imageReference.publisher",
              "equals": "MicrosoftWindowsServer"
            }
          ]
        },
        {
          "field": "Microsoft.Compute/virtualMachines/licenseType",
          "notEquals": "Windows_Server"
        }
      ]
    },
    "then": {
      "effect": "audit"
    }
  },
  "parameters": {}
}

Answer 1

The Audit effect policy works like this only. VMs(resource type in IF) matching all the policy conditions will be marked as non-compliant and remaining VMs(linux/windows) that do not match will be compliant.

To avoid this and only get Windows VM in compliance report, please use AuditIfnotexists effect.

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-audit-if-not-exists