Azure policy does not work for resources created by Azure Databricks

Question

I'm working on using a policy to automatically assign the sku.name tag to virtual machines created by Databricks. These tags are important for my team's cost management analysis.

However, I discovered in another discussion that resources marked as "managedby" (such as those created by Azure Databricks or DevOps) bypass policy evaluation.

Is there a workaround to include those resources to follow created Policy?

Answer 1

Hi Michal,

When Azure Databricks gets created, it creates a Deny Assignment on the managed resource group created by Az Databricks. You can verify that by going to Access Control(IAM).

This Deny assignment does not allow users or even Azure policy to add/updated tags on the Azure resources which are inside that managed resource group. and not even on that managed resource as well.

The only tagging option available for Azure Databricks is mentioned here: https://learn.microsoft.com/en-us/azure/databricks/admin/account-settings/usage-detail-tags

Answer 2

Hello Michal Kalafarski,

Thank you for posting your query in the Microsoft Q&A Community.

Azure resources marked as "managed by" often bypass policy evaluation, which means that the Azure Policies you create might not apply to these resources. You can work around this limitation by applying tags at the resource group level or by leveraging automation to tag resources after creation.

Azure offers built-in policies like "Inherit a tag from the resource group if missing." These policies can automatically apply the desired tag to all resources within the resource group, including those managed by Databricks.

https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#tags

Also, you can create a Runbook or Logic App that triggers after the creation of new resources within a resource group by the databriks. The script can check if the resource has the "managed by" property and apply the necessary tags.

Let me know if further assistance is required.

Babafemi