VM back with deny effect

Question

Trying to implement a policy
while creating a VM backup should be enabled , else deny
After publish this it is not allowing to create any new VM.
Like to check if we can have this policy with deny effect .

Apppreciate your response.

Answer 1

Hello @Manickam ,

AFAIK, the outcome you described is expected since the deny effect prevents the 'create' request from ever getting to Compute Resource Provider.
I recommend using the DeployIfNotExist effect for your scenario. This effect will not block the creation but flag it as non-compliant and queues it up for remediation. Also, DeployIfNotExist allows you to enable the appropriate recovery/backyup setting once the newly created VM is marked as non complaint.
Below is a sample DINE policy that evaluates a SQL Server databases to determine if transparentDataEncryption is enabled. If not, then a deployment to enable is executed..
use this as a sample to build your VM policy. Ping if you have any followup questions.