Azure role, start,stop and restart Virtual Machine

Json file, replace “/subscriptions/11111111-1111-1111-1111-111111111111” with your own subscription ID.

Save the Json file and run: az role definition create –role-definition filename.json

 {
      "Name": "Virtual Machine Stop/Start/Restart",
      "IsCustom": true,
      "Description": "Can stop, start  and restart virtual machines.",
      "Actions": [
        "Microsoft.Compute/*/read",
        "Microsoft.Compute/virtualMachines/start/action",
        "Microsoft.Compute/virtualMachines/restart/action",
        "Microsoft.Compute/virtualMachines/deallocate/action"
      ],
      "NotActions": [


      ],
      "AssignableScopes": [
        "/subscriptions/11111111-1111-1111-1111-111111111111"
      ]
    }

Azure custom policy: Approved Costcenter Tag Values

Json for the rule. The tag could be something else. Just change the field: “tags.Costcenter”

{
  "mode": "All",
  "policyRule": {
    "if": {
      "not": {
        "field": "tags.Costcenter",
        "in": "[parameters('allowedTagValues')]"
      }
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {
    "allowedTagValues": {
      "type": "Array",
      "metadata": {
        "displayName": "Allowed tag values",
        "description": "The list of allowed Costcenter tag values"
      }
    }
  }
}

Parameters when assigning the policy

[
  "IT",
  "Risk",
  "Advisory",
  "Legal"
]