azureazure-policy

Can you use Azure Policy to fail the validate stage of new VM creation?

I am new to Azure, and looking into Azure policies which seem really cool, and I can get a policy working which will stop a virtual machine getting created if it has a SKU that I do not allow, which is great. My issue is that some other resources are created before the VM fails, i.e. the vnet etc.

Is it possible to create a policy that fails at the validation stage in the portal and therefore won't even let you click on the create button?

I understand that this won't work for ARM templates, but I can use my current policy for that.

I was hoping that during creation there would be a way of either limiting the dropdowns that the user sees or erroring if they pick the wrong dropdown item for a particular resource group

Solution

  • Can you use Azure Policy to fail the validate stage of new VM creation?

    The policy will allow VM creation only if the VM SKUs match the specified ones. If the SKUs are not specified, it won't allow the next process in VM creation

    {
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        {
          "not": {
            "field": "Microsoft.Compute/virtualMachines/sku.name",
            "in": "[parameters('disallowedSKUs')]"
          }
        }
      ]
    },
    "then": {
      "effect": "Deny"
    }
  },
  "parameters": {
    "disallowedSKUs": {
      "type": "Array",
      "metadata": {
        "displayName": "Disallowed SKUs",
        "description": "List of SKUs that are not allowed for virtual machines."
      }
    }
  }
}

    The policy allows only specified SKUs; then, it proceeds to the next process.

    enter image description here

    Disallowed Sku's in Policy:

    enter image description here