Tag Archives: policy

Trigger Azure Policy to evaluate compliance

Posted on by
Reply

Can now be done with either Azure CLI

az policy state trigger-scan --resource-group !!!resource-group-name!!!

Or powershell

Start-AzPolicyComplianceScan -ResourceGroupName !!!resource-group-name!!!

Old school with API rest call

$subscriptionId = "!!!SUBSCRIPTION ID!!!"

$uri = "https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.PolicyInsights/policyStates/latest/triggerEvaluation?api-version=2018-07-01-preview"
$azContext = Get-AzContext
$azProfile = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile
$profileClient = New-Object -TypeName Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient -ArgumentList ($azProfile)
$token = $profileClient.AcquireAccessToken($azContext.Tenant.Id)
$authHeader = @{
    'Content-Type'='application/json'
    'Authorization'='Bearer ' + $token.AccessToken
}
Invoke-RestMethod -Method Post -Uri $uri -UseBasicParsing -Headers $authHeader

Azure custom policy: Approved Costcenter Tag Values

Posted on by
Reply

Json for the rule. The tag could be something else. Just change the field: “tags.Costcenter”

{
  "mode": "All",
  "policyRule": {
    "if": {
      "not": {
        "field": "tags.Costcenter",
        "in": "[parameters('allowedTagValues')]"
      }
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {
    "allowedTagValues": {
      "type": "Array",
      "metadata": {
        "displayName": "Allowed tag values",
        "description": "The list of allowed Costcenter tag values"
      }
    }
  }
}

Parameters when assigning the policy

[
  "IT",
  "Risk",
  "Advisory",
  "Legal"
]