Azure Custom Policy no complience Data

Question

Azure Custom Policy no complience Data

mj 0

Hello Peoples,

I've got a little issue with the complience evaluation of my custom policy.

Let me give you a quick outline:

I deployed an initiative containing a lot of different policies which are deploying different alerts for me. Similar to the Monitor Basline Policies (https://azure.github.io/azure-monitor-baseline-alerts/welcome/) The Deployment/Policy Scope was a Subscription "over" lighthouse.

The Deployment works fine and so does the remediation, but i don't get any complience "respones".

On the lighthouse tennant i get the following message:

User's image

And if I log directly into the tennant i get the following:

User's image

And this is the existenceCondition Block.

User's image

Any ideas on what could be the issue?

BR,

Matthias

1 answer

Your answer

Answer 1

Luis Arias 8,621 Volunteer Moderator

Hi mj,

It seems like this could be an issue with existenceCondition block in your policy or the permissions. The existenceCondition block is used to specify conditions for compliance evaluations. If the conditions specified in this block are not met, the resource is marked as non-compliant.

Take in consideration that a new policy or initiative assignment takes about five minutes to be applied. New or updated resources within the scope of an existing assignment become available in about 15 minutes. A standard compliance scan occurs every 24 hours. So, you might want to wait for some time for the evaluation to finish and compliance results to become available.

More information

Let me know if this help or if you need further assisstance.

Luis

If the information helped address your question, please Accept the answer.

mj 0 Reputation points

2023-12-20T07:30:06.5433333+00:00
The thing is, this existence conditions worked in my first tests, there was also no complience data after 72h. I will have to do some more testing to narrow down where it stopped working.

Things that changed since it showed me the right results:

the deployifnotexist deployment changed from a "normal" deployment to a nested deployment (otherwise I could not specify a RG & Subscription for the Alert Resources

It was deployed from a lighthouse tenant with a user assigned managed identity in the target tennant for remediation (here the remediation works, but I see a Message telling me that the selected managed identity does not have the right permissions -> I assumed that it cant se the IAM Permissions of the Managed Identity in the target tenant. (It has contributor rights on the subscription)

My account has Contributor & User Access Admin for the Policy Deployments - which in theory should work.

It seems as if the use of such policies in a lighthouse environment still has some issues here and there.

Share via

Azure Custom Policy no complience Data

1 answer

Your answer