Prevent users from Deploying Premium_SSD as os disk and data disk during Deployment in Portal (Validation phase should fail).

Question

Prevent users from Deploying Premium_SSD as os disk and data disk during Deployment in Portal (Validation phase should fail).

Dhawal Patel 20

The below does not work and passes the Validation Phase:

"parameters": {
      "allowedStorageTypes": {
        "type": "Array",
        "metadata": {
          "displayName": "allowedStorageTypes",
          "description": "Allowed storage types for OS disk"
        },
        "defaultValue": [
          "Premium_LRS"
        ]
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Compute/virtualMachines"
          },
          {
            "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.storageAccountType",
            "in": "[parameters('allowedStorageTypes')]"
          },
          {
            "field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*].managedDisk.storageAccountType",
            "in": [
              "Premium_LRS",
              "Premium_ZRS"
            ]
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  },
}


Also the below policy  passes the Validation phase:

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/disks"
        },
        {
          "field": "Microsoft.Compute/disks/sku.name",
          "equals": "Premium_LRS"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}

So i need something that Does not pass the "Validation Phase" in Portal.

Accepted answer

1 additional answer

Your answer

Answer 1

@Dhawal Patel Firstly, Apologies for the delay response!

Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

Try the below mentioned Custom Policy and let me know the status

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        {
          "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.storageAccountType",
          "equals": "Premium_LRS"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}

Policy to Prevent Premium_SSD as Data Disk:

Create a separate policy to prevent users from deploying Premium_SSD as data disks:

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        {
          "field": "Microsoft.Compute/virtualMachines/storageProfile.dataDisks[*].managedDisk.storageAccountType",
          "equals": "Premium_LRS"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}

This policy rule denies the deployment of virtual machines with Premium_LRS storage account type for both OS disk and data disks. Please note that this policy rule should be assigned to the appropriate scope and the policy assignment should be in effect before the deployment.

I wish to engage with you offline for a closer look and provide a quick and specialized assistance, please send an email with subject line “Attn:subm” to AzCommunity[at]Microsoft[dot]com referencing this thread and the Azure subscription ID, I will follow-up with you. Once again, apologies for any inconvenience with this issue.
Thanks for your patience and co-operation.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Dhawal Patel 20

Thanks @Sumarigo-MSFT for the answer.

Looks like the first one is working, but second one(Policy to Prevent Premium_SSD as Data Disk:) is still passing Validation Phase.

Can you help there.

Share via

Prevent users from Deploying Premium_SSD as os disk and data disk during Deployment in Portal (Validation phase should fail).

1 additional answer

Your answer