Azure Policy deny not worked as expected

Question

Hello,

I've created an azure policy to deny the creation of a VM by some conditions.

This is the policy:
{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Compute/virtualMachines"
},
{
"field": "tags[managed_by]",
"notEquals": "terraform"
},
{
"field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
"equals": "[parameters('operatingSystems')]"
},
{
"field": "[concat('tags[', parameters('requiredTagName'), ']')]",
"in": "[parameters('requiredTagValues')]"
}
]
},
"then": {
"effect": "deny"
}
},
"parameters": {
"tagName": {
"type": "String",
"metadata": {
"displayName": "Tag Name",
"description": "Name of the tag to tag if conditions apply"
}
},
"operatingSystems": {
"type": "String",
"metadata": {
"displayName": "Operating Systems",
"description": "The operating systems that the policy should apply on"
},
"allowedValues": [
"Windows",
"Linux"
]
},
"requiredTagName": {
"type": "String",
"metadata": {
"displayName": "Required Tag Name",
"description": "Name of the required tag to check on the resource"
}
},
"requiredTagValues": {
"type": "Array",
"metadata": {
"displayName": "Required Tags Values",
"description": "The required tag values to check if the required tag name also exist"
},
"defaultValue": []
}
}
}

When I try to create a VM that applies to the conditions of the policy above the VM is created and only then the policy starts to deny stuff like tag changes, size changes or identify activation and etc...

But when I use the following policy only to check for tag and then deny it works.

The policy:
{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Compute/virtualMachines"
},
{
"field": "[concat('tags[', parameters('tagName'), ']')]",
"equals": ""
}
]
},
"then": {
"effect": "deny"
}
},
"parameters": {
"tagName": {
"type": "String",
"metadata": {
"displayName": "Tag Name",
"description": "Name of the tag to check for policy compliance"
}
}
}
}

This policy indeed denied the creation of a VM when it does not have the specified tag or it is empty.

Can some help to explain why the second policy that only checks tags denies the creation of a VM (like expected), but the first policy (that also has the same tag check) with its conditions does not deny the creation of a VM but only changes after the creation of the VM?

Answer 1

Hi @Igor Levin

Welcome to Microsoft Q&A! Thanks for posting the question.

It usually takes about 30 minutes for the policy to be fully effective after its assignment. During this time, the policy may not function properly (it might function partially or may not be in effect at all). Could you retest the effect after about 30 minutes of policy assignment? You may refer to this Q&A thread for a similar issue.

---
Edit: 01/17/2022

The reason for "deny" effect not working with Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType is as below:

>. This property is not added when creating the VM creation request but is auto populated after the VM has been created. You can verify absence of this property in the request in Portal by clicking on "Download a template for automation" on the "Review + create" page. Therefore, when submitting the request, the policy does not deny the VM creation, as this property is not present in the request against which the evaluation is done (create mode). After the VM has been created, during the next policy evaluation, the VM is put in non-compliance state because the property is available now. Here are more details of this behavior: Optional or auto-generated resource property that bypasses policy evaluation.

Please let me know if you have any question.

---
Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.