liveBook · Manning

Custom policy

As explained in Azure Security

A custom policy definition is an Azure Policy rule authored by an organization to evaluate or enforce requirements not covered by built-in definitions.

A custom policy definition encodes an organization-specific business or security rule when no built-in Azure Policy definition fits. Assign it at a chosen scope to evaluate resource configurations and enforce requirements such as permitted deployment regions. section 10.2.3 section 10.3

A definition contains a rule that tests resource properties and an effect. Deny is evaluated when a resource is updated; DeployIfNotExists can remediate existing resources, for which gradual rollout is recommended. section 10.2.3

Restrict VM locations

Create a definition named allowedLocationsOnly with az policy definition create. Its rule checks virtual-machine location names and uses deny when the location is outside East US or East US 2. The resulting definition is identified as policyType Custom and has mode Indexed. section 10.3

Listing 10.3 Creating a custom policy definition
az policy definition create 
    --name allowedLocationsOnly                               #1
    --display-name 'Allowed Virtual Machine Locations Only'   #2
    --rules "{ \                                              #3
                \"if\": \
                {  \"not\": { \
                    \"field\": 
    \"Microsoft.Compute/virtualMachines/Locations[*].locationName\", \
                     \"in\": [ \
                        \"East US\", \
                        \"East US 2\" \
                        ] \
                    } \
                }, \
                \"then\": { \
                    \"effect\": \"deny\" \
                } \
            }"
#1 The actual name of the custom policy definition
#2 The display name of the custom policy definition
#3 The rule of the custom policy definition

Use the listing as a copyable pattern: supply a definition name, display name, and JSON if/then rule, then replace fields, allowed values, and effect for another business rule. section 10.3

Group related custom definitions in a policy initiative when they should be applied together. Use Azure Policy evaluation results to find noncompliant resources; custom security initiatives can also appear in the Microsoft Defender for Cloud Regulatory Compliance dashboard. Assign policies at the highest practical scope to reduce overlap; where policies overlap, the most restrictive policy takes precedence. section 10.3 section 10.4

How Azure Security covers it

How deep it goes
Walks through CLI creation, rule structure, assignment, initiative grouping, and compliance-result review without detailing all policy effects.
Examples
Uses denied virtual-machine deployments outside East US locations and auditing Azure Key Vault secrets without expiry dates.
What it assumes
Assumes familiarity with Azure resources, regions, scopes, and organizational business rules while demonstrating custom-policy creation.
What you can do after
Build it from scratch with Azure CLI, assign it at scope, group related definitions, and evaluate noncompliant resources.
How it connects
Connects Azure Policy with policy initiatives, resource compliance, Microsoft Defender for Cloud, Azure Key Vault, and policy effects.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.