Ambiguous policy condition

Question

          "existenceCondition": {  
  
            "field": "Microsoft.Security/assessments/status.code",  
  
            "in": [  
  
              "NotApplicable",  
  
              "Healthy"  
  
            ]  
  
          }  

I find this same existenceCondition in "All network ports should be restricted on network security groups associated to your virtual machine", "Non-internet-facing virtual machines should be protected with network security groups", and "Internet-facing virtual machines should be protected with network security groups". The details.name values differ but nevertheless I have a single VM with an NSG that is reported as non-compliant to all three policies. Can someone help me understand this behavior? Or is it just buggy?

Answer 1

Hi,
I have written about a similar thing in a blog post. The similarity is that basically the conditions you see are based on Defender for Cloud (Azure Security Center) assessments that are being made and after that the results of those assessments are published to ARM API so Azure Policy can evaluate on the results. As mentioned in the blog post this basically results in two separate evaluations happening and only one of them (the policy one) you can trigger manually. One option is to wait at least 2-3 days before you check the compliance. It is possible also that the assessment Defender for Cloud is making has bugs or reports false positives. In that case may be it is better to not trust the policy or try to open support case to Azure reporting your issues.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.