search

Azure / Community-Policy

This repo is for Microsoft Azure customers and Microsoft teams to collaborate in making custom policies.
MIT License
636 stars 327 forks source link

Policy does not remediate automatically on deployment of Windows VM #454

Closed jeircul closed 4 months ago

jeircul commented 5 months ago

Policy will not work when deploying a new VM, because of the "if" condition.

{
  "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
  "equals": "Windows"
}

Explanation

The issue is that the create payload for VMs does not include the property osType, which is evaluated in the "if" condition the Policy, which makes Policy see the resource as not applicable for a deployment until later.

Solution

The solution is to check on the image reference, and this PR shows 1 way of doing exactly that.

Other relevant info

The policy works fine "as is" for manually remediating and will also be triggered by any change to the VM (for example a resize).

jeircul commented 5 months ago

@microsoft-github-policy-service agree