Azure Policy for enabling diagnostic settings for WebApp/Function App - No resources remediated

Question

I am working in an existing Azure environment where there is no governance and I am in the process of creating Azure Policies. Currently I am working on creating Azure Policy to enable Diagnostic settings for Azure Web App, Azure Function App and Web API. Initially I had one Azure Policy for all type of Web Apps. Later I split into two.

1. Web App & Web API
2. Function App

I thought to address the Function App with the below Policy Rule. But no resources where remediated.

We have about 60+ web apps without any governance and now when I want to implement Diagnostic settings to most of the azure services I find it difficult to debug why the azure policies are not remediated. Because when you remediate a policy it tries to perform the DeployIfNotExists action for azure web apps which is not an efficient way. How do we validate the policy rule conditions from a Cloud engineer point of view? Use Kusto Queries or Powershell/Azure CLI on the policyrule.

I tried with the built-in policy for function app - Enable logging by category group for Function App (microsoft.web/sites) to Log Analytics, but it didn't work as well.

Below is the policy rule:

  "if": {
                "allOf": [
                    {
                        "field": "type",
                        "equals": "Microsoft.Web/sites"
                    },
                    {
                        "not": {
                            "anyof": [
                                {
                                    "field": "kind",
                                    "like": "app"
                                },
                                {
                                    "field": "kind",
                                    "like": "api"
                                },
                                {
                                    "field": "kind",
                                    "like": "app,linux"
                                },
                                {
                                    "field": "kind",
                                    "like": "app,windows"
                                }
                            ]
                        }
                    },
                    {
                        "field": "kind",
                        "like": "functionapp"
                    },
                    {
                        "field": "kind",
                        "like": "functionapp,linux"
                    }
                ]
            },
            "then": {
                "effect": "[parameters('effect')]",
                "details": {
                    "type": "Microsoft.Insights/diagnosticSettings",
                    "name": "[parameters('profileName')]",
                    "existenceCondition": {
                        "allOf": [
                            {
                                "field": "Microsoft.Insights/diagnosticSettings/workspaceId",
                                "equals": "[parameters('logAnalytics')]"
                            }
                        ]
                    },
                    "roleDefinitionIds": [
                        "/providers/microsoft.authorization/roleDefinitions/",

                    ],
                    "deployment": {
                        "properties": {
                            "mode": "incremental",
                            "template": {
                                "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                                "contentVersion": "1.0.0.0",
                                "parameters": {
                                    "resourceName": {
                                        "type": "string"
                                    },
                                    "logAnalytics": {
                                        "type": "string"
                                    },
                                    "location": {
                                        "type": "string"
                                    },
                                    "profileName": {
                                        "type": "string"
                                    },
                                    "functionAppLogs": {
                                        "type": "string"
                                    },
                                    "appServiceAuthenticationLogs": {
                                        "type": "string"
                                    }
                                },
                                "variables": {},
                                "resources": [
                                    {
                                        "type": "Microsoft.Web/sites/providers/diagnosticSettings",
                                        "apiVersion": "2017-05-01-preview",
                                        "name": "[concat(parameters('resourceName'), '/', 'Microsoft.Insights/', parameters('profileName'))]",
                                        "location": "[parameters('location')]",
                                        "dependsOn": [],
                                        "properties": {
                                            "workspaceId": "[parameters('logAnalytics')]",
                                            "logs": [
                                                {
                                                    "category": "FunctionAppLogs",
                                                    "enabled": "[parameters('functionAppLogs')]"
                                                },
                                                {
                                                    "category": "AppServiceAuthenticationLogs",
                                                    "enabled": "[parameters('appServiceAuthenticationLogs')]"
                                                }
                                            ]
                                        }
                                    }
                                ],
                                "outputs": {}
                            },
                            "parameters": {
                                "logAnalytics": {
                                    "value": "[parameters('logAnalytics')]"
                                },
                                "resourceName": {
                                    "value": "[field('name')]"
                                },
                                "location": {
                                    "value": "[field('location')]"
                                },
                                "profileName": {
                                    "value": "[parameters('profileName')]"
                                },
                                "functionAppLogs": {
                                    "value": "[parameters('functionAppLogs')]"
                                },
                                "appServiceAuthenticationLogs": {
                                    "value": "[parameters('appServiceAuthenticationLogs')]"
                                }
                            }
                        }
                    }
                }
            }
        }
    }```

Answer 1

Hello @Senthil Ramadoss

To validate the policy rule conditions from a Cloud engineer point of view, you can use Kusto Queries or PowerShell/Azure CLI on the policy rule.

You can also check the compliance state of the policy rule to see if it is being applied correctly. Regarding the issue with the policy rule not remediating any resources, it could be due to a number of reasons. One possibility is that the resources are not meeting the conditions specified in the policy rule. Another possibility is that there may be an issue with the policy rule itself.

To troubleshoot this issue, you can try the following steps:

• Check the compliance state of the policy rule to see if it is being applied correctly.
• Check the Azure Policy compliance logs to see if there are any errors or warnings related to the policy rule.
• Check the Azure Resource Manager logs to see if there are any errors or warnings related to the policy rule.
• Check the Azure Portal to see if there are any errors or warnings related to the policy rule.

---

I hope that this response has addressed your query and helped you overcome your challenges. If so, please mark this response as Answered. This will not only acknowledge our efforts, but also assist other community members who may be looking for similar solutions.