Policy to prevent creation of app services without authentication

Question

I wish to create a policy that will prevent the creation of app services without authentication enabled (just auditing them is not enough).

The following policy can correctly identify existing resources that do not have authentication enabled:

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "Microsoft.Web/sites/config/siteAuthEnabled",
          "equals": "false"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

however it does not prevent them being created in the first place (either via ARM template or through the portal).

I suspect this is because the Microsoft.Web/sites/config resource isn't being explicitly created.

Does anyone know if this is possible?

Answer 1

@Richard Misiak Welcome to Microsoft Q & A Community Platform. Apologies for late response. Seems Azure Policy doesn't support auditing the authentication as per this Github thread and this is documented in known issues of Azure Policy.