I have a question and unfortunately I can’t find anything explicit in the MS documentation.
We would like to use the Azure Policies to determine the location of the resource etc. via the subscription tag. For example, we have a tag on the subscription:
Location = North Europe
We cannot currently do it via different Management Groups because we only have general mgm groups such as Spoke etc. In addition, we do not want to maintain/inherit the tags for each resource.
I am afraid that I have already described the solution.
Do you have any suggestions or documentation?
3
Assign Azure Policy’s depending on the subscription tag
Azure Policy cannot directly reference subscription-level tags; however, you can create a custom azure policy that enforces the location of resources based on a parameter.
The parameter can be set manually to match the subscription tag value (North Europe).
{
"mode": "All",
"policyRule": {
"if": {
"field": "location",
"notIn": [
"[parameters('location')]"
]
},
"then": {
"effect": "deny"
}
},
"parameters": {
"location": {
"type": "String",
"metadata": {
"displayName": "location",
"description": "Specify the allowed location for the resources."
},
"allowedValues": [
"North Europe",
"West Europe",
"East US",
"Southeast Asia"
],
"defaultValue": "North Europe"
}
}
}
Azure Policy assignment
The policy restricts the resource if the location does not match the specified policy location. If they do not match, an error will be thrown.
The policy allows resource creation if the location is North Europe.
3