Is there a way to exclude resource groups that contain the word databricks from policy assignment ?

Question

Hi - We have a number of policies that check if diagnostic settings are created for resources. Since databricks uses a managed resource group, these policies always show non-compliant.
Is there a way i could use a '*' in the policy definition to exclude the resources groups that have databricks in the name ? This will help me a lot.

Answer 1

Yes thats a good point. I agree not a solution for all.

A this is being done mainly for deploying diagnostic settings across all resources and showing compliance primarily, we are not concerned with malicious intents ( at the moment)
But i hadn't thought about and great to see that pointed out.

Thank you very much!

Answer 2

My policy checks whether field "Microsoft.Compute/virtualMachines/storageProfile.imageReference.sku" equals value "DatabricksWorker". If so, they are excluded from the policy. This works for me, I have no non-compliant resources even though I have 10 Databrick VMs.