azureazure-policyazure-cdnazure-front-door

Azure Policy - restrict creation of Front Door to Standard SKU Only


I want to limit by Azure Policy the creation of Azure Front Door resources to Standard SKU only.

I'm struggling to figure this policy out. So far I have.

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Cdn/profiles"
        },
        {
          "field": "Microsoft.Cdn/profiles/sku.name",
          "notEquals": "Standard_AzureFrontDoor"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}

AND

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Network/frontDoors"
        },
        {
          "field": "Microsoft.Network/frontDoors/skuName",
          "notEquals": "Standard_AzureFrontDoor"
        }
      ]
    },
    "then": {
      "effect": "Deny"
    }
  }
}

Both have issues with the field

Microsoft.Cdn/profiles/sku.name

and

Microsoft.Network/frontDoors/skuName

(They don't exist according to the editor)

I've tried various combinations of mixed, upper, lower case, as well as adding dots between them.

How can I restrict the creation of Azure Front Door to Standard only?


Solution

  • I tested the below policy in my environment to deny all SKUs except Standard_AzureFrontDoor, and it successfully blocked the creation of Azure Front Door with other SKUs while allowing only the Standard SKU. If it’s still not working in your case, you may need to wait for the policy to start applying.

    {
      "mode": "All",
      "policyRule": {
        "if": {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Cdn/profiles"
            },
            {
              "field": "Microsoft.Cdn/profiles/sku.name",
              "notEquals": "Standard_AzureFrontDoor"
            }
          ]
        },
        "then": {
          "effect": "deny"
        }
      },
      "parameters": {}
    }
    

    Output:

    enter image description here

    enter image description here