An Azure Policy definition is a JSON business rule that evaluates a specific configuration on a resource. It maps one business rule to one controlled configuration, such as permitted VM SKUs, allowed regions, required tags, monitoring agents, or public endpoints. section 10.2 section 10.2.1
Use built-in definitions for common controls, or create a custom definition when a business rule is not covered. Definitions can be parameterized, then assigned directly at a management group, subscription, resource group, or resource scope. Assigning at the highest applicable scope evaluates existing resources and future deployments for compliance. section 10.2.1 section 10.2.2 section 10.3
A definition contains a rule and exactly one effect that determines the response to evaluation:
- Audit permits creation while marking resources compliant or noncompliant. section 10.2.3
- Deny prevents a noncompliant resource from being created; use Audit first to understand what would be blocked. section 10.2.3
- Modify supports auto-remediation, such as adding missing configuration during deployment. section 10.2.3
Restrict virtual machine sizes
Find the built-in Allowed virtual machine size SKUs definition, supply an allowed-SKU array as assignment parameters, and assign it to a subscription. The policy evaluates deployment requests against that list, supporting cost control through a consistent guardrail. section 10.2.1 section 10.2.2
Group related definitions into a policy initiative when they support one overarching objective. For example, separate definitions can require Azure Monitor Agent deployment on Windows and Linux VMs, alongside related managed-identity configuration. Custom definitions can similarly enforce a regional deployment rule when no built-in definition fits. section 10.2.1 section 10.3
{ "properties": { "displayName": "Allowed virtual machine size SKUs", "policyType": "BuiltIn", "mode": "Indexed", "description": "This policy enables you to specify a set of virtual machine size SKUs that your organization can deploy.", "metadata": { "version": "1.0.1", "category": "Compute" }, "parameters": { "listOfAllowedSKUs": { "type": "Array", "metadata": { "description": "The list of size SKUs that can be specified for virtual machines.", "displayName": "Allowed Size SKUs", "strongType": "VMSKUs" } } }, "policyRule": { ...
Inspect a built-in definition’s JSON shape: display metadata, an array parameter for allowed SKUs, and the policy rule that evaluates the resource configuration. section 10.2.1
