Help with creating Azure policy to deny storage account creation if no private link is configured

Question

I have trying to create an Azure enforcement policy which will deny storage account to be created if a private endpoint is not configured for the account. I have the following policy rule:

    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Storage/storageAccounts"
          },
          {
            "field": "Microsoft.Storage/storageAccounts/privateEndpointConnections",
            "exists": "false"
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]"
      }
    },

Note: the effect is set to "deny".

However, when I configured the private endpoint during the storage account creation, the policy prevents the account creation.

I have also tried the following condition instead of using "exists", the policy still denies the creation of the storage account.

{

"field": "Microsoft.Storage/storageAccounts/privateEndpointConnections",

"equals": ""

}

Any idea how should I modify my policy?

Thanks

Answer 1

@Guo, Jianning

Please use this policy definition, this should work.

{
  "properties": {
    "displayName": "Deny Storage Accounts without private access",
    "policyType": "Custom",
    "mode": "All",
    "description": "Deny creation of storage accounts if public network access is not disabled (i.e., only private endpoint access is allowed).",
    "metadata": {
      "version": "1.0.0",
      "category": "Storage"
    },
    "parameters": {},
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Storage/storageAccounts"
          },
          {
            "field": "Microsoft.Storage/storageAccounts/publicNetworkAccess",
            "notequals": "Disabled"
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}
 

Artifact:

Hope this helps!

let us know if any help, we will always help as you needed.!

Please do not forget to "Accept the answer” and upvote it wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Answer 2

I do have disable publicnetworkaccess policy in place. I was trying to see if I could also make sure private endpoint is configured during storage account creation.