Azure Policy for Diagnostic Settings on Storage Accounts Not Affecting Table or Queue

Question

I have an issue where I have set up these built-in policies to enable Diagnostic Settings on a storage account and its four subtypes.

However, consistently, when I create a new Storage Account, it does not apply diagnostic settings to the Table or Queue, only to the Blob, the File, and the top. 

I can see some "deployIfNotExists" successful actions in the activity log, and no failures, but not enough to cover queue and table.

Strangely, after a day, the Table and Queue will show non-compliant, and I can then run remediation to add the diagnostic settings to them. 

I want all five diagnostic settings to be set up by policy from the beginning. Thanks.

Answer 1

Hi Roger,

This is an expected behavior as when a storage account is created with default configurations via portal or any other clients, the request payload does not contain anything related to queue or table.

The request payload only contains storage account definition along with flieservices and blobservices.

For deployifnotexists effect to work, these resource types need to present in the request payload during resource creation operation. so that policy can evaluate the policy conditions to match resource properties and act.

You can test the same by creating a new storage account from the portal and in the last step of resource creation wizard, click on "download a template for automation" link. You will get to see only storage account, blobservices and fileservices definitions in the ARM template.

table and queues are not created with storage account by default. But once they are created later, the policy identifies them non-compliant. Policy remediation tasks can be created to remediate them by adding diagnostics settings.

Answer 2

Hello Seekell, Roger,

Greetings! Welcome to Microsoft Q&A Platform.

I understand that you are having trouble in set up these built- in policies to enable Diagnostic settings on a storage account for blob, file, table and queue.

Policies and policy initiatives provide a simple method to enable logging at-scale via diagnostics settings for Azure Monitor. Using a policy initiative, you can turn on audit logging for all supported resources in your Azure environment.

In order to monitor Azure resources, it's necessary to create  diagnostic settings  for each resource. This process can be difficult to manage when you have many resources. To simplify the process of creating and applying diagnostic settings at scale, use Azure Policy to automatically generate diagnostic settings for both new and existing resources.

Each Azure resource type has a unique set of categories listed in the diagnostic settings. Each resource type therefore requires a separate policy definition. Some resource types have built-in policy definitions that you can assign without modification. For other resource types, you can create a custom definition.

 

Assign the initiative to an Azure management group, subscription, or resource group, depending on the scope of your resources to monitor. A management group is useful for scoping policy, especially if your organization has multiple subscriptions.

                                         

When you create the assignment by using the Azure portal, you have the option of creating a remediation task at the same time. See Remediate non-compliant resources with Azure Policy for details on the remediation.refer - https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostics-settings-policies-deployifnotexists?source=recommendations&tabs=portal.

Hope this answer helps!

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.