I want to limit by Azure Policy the creation of Azure Front Door resources to Standard SKU only.
I'm struggling to figure this policy out. So far I have.
{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Cdn/profiles"
},
{
"field": "Microsoft.Cdn/profiles/sku.name",
"notEquals": "Standard_AzureFrontDoor"
}
]
},
"then": {
"effect": "deny"
}
},
"parameters": {}
}
AND
{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Network/frontDoors"
},
{
"field": "Microsoft.Network/frontDoors/skuName",
"notEquals": "Standard_AzureFrontDoor"
}
]
},
"then": {
"effect": "Deny"
}
}
}
Both have issues with the field
Microsoft.Cdn/profiles/sku.name
and
Microsoft.Network/frontDoors/skuName
(They don't exist according to the editor)
I've tried various combinations of mixed, upper, lower case, as well as adding dots between them.
How can I restrict the creation of Azure Front Door to Standard only?
I tested the below policy in my environment to deny all SKUs except Standard_AzureFrontDoor, and it successfully blocked the creation of Azure Front Door with other SKUs while allowing only the Standard SKU. If it’s still not working in your case, you may need to wait for the policy to start applying.
{
"mode": "All",
"policyRule": {
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Cdn/profiles"
},
{
"field": "Microsoft.Cdn/profiles/sku.name",
"notEquals": "Standard_AzureFrontDoor"
}
]
},
"then": {
"effect": "deny"
}
},
"parameters": {}
}
Output: