Exclude Windows Server from VM Shutdown Azure Policy

Question

Hi,

I currently have a custom built Azure policy to mark any VM as non-compliant if the auto-shutdown feature is not enabled (There is no remediation task currently).

We do not want this policy applied to Windows server 2019 VMs, is there anyway to exclude resources in the policy via tags or operating systems at all?

So for example if tags i would assign a tag to all the windows servers and then the policy would exclude them if the tag has been placed against the resource. Or if better the OS, for example if a VM has the OS Windows Server 2019 then exclude from the policy.

Any help would be greatly appreciated.

Kind regards,

Ben

Answer 1

Hi, yes you can.

You should be able to add a if not true to the police for the image Offer:

   "not": {
          "allOf": [
            {
              "field": "Microsoft.Compute/virtualmachines/imageOffer",
              "in": [
                "2019*"
              ]
            },

Answer 2

Hi @Ben Woodman

Another option is leveraging New-AzPolicyExemption cmdlet to exclude by operating system. An example of creating a policy using Azure PowerShell

$exemption = New-AzPolicyExemption `
    -Name "Exclude Windows Server 2019 VMs from auto-shutdown policy" `
    -PolicyAssignmentId "/subscriptions/{subscriptionId}/providers/Microsoft.Management/managementGroups/{managementGroupId}/providers/Microsoft.Authorization/policyAssignments/{policyAssignmentId}" `
    -DisplayName "Exclude Windows Server 2019 VMs from auto-shutdown policy" `
    -Description "Excludes Windows Server 2019 VMs from the auto-shutdown policy" `
    -Metadata @{"category"="Auto-shutdown policy";"notes"="Excludes Windows Server 2019 VMs from the auto-shutdown policy"} `
    -TargetResourceId "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}" `
    -ExemptionCategory "Mitigated" `
    -ExpirationDate (Get-Date).AddDays(30) `
    -PolicyDefinitionReferenceId "/providers/Microsoft.Authorization/policyDefinitions/{policyDefinitionId}" `
    -Properties @{"osType"="Windows";"osVersion"="2019"} `
    -Reason "Excluding Windows Server 2019 VMs from the auto-shutdown policy" `
    -CreatedBy "John Doe" `
    -CreatedOn (Get-Date)

Once created, you can use Set-AzPolicyAssignment cmdlet to assign the policy.

$vms = Get-AzVM -ResourceGroupName "myResourceGroup" | ForEach-Object { $_.Id }
$exemption = Get-AzPolicyExemption -Name "Exclude Windows Server 2019 VMs from auto-shutdown policy"
$exemption.Parameters.ExcludeResourceIds.Value = $vms
Set-AzPolicyAssignment -PolicyAssignment $exemption -Id $exemption.Id