plan-forge policy.instructions.md

Azure Policy & Initiative Compliance

Azure Policy is the enforcement layer — it makes Landing Zone standards compulsory, not optional.

---

Policy Effect Hierarchy

Effect	Behavior	Typical Use
Disabled	Policy off	Temporary suppression only
Audit	Log non-compliance; allow resource	Discovery, initial rollout
AuditIfNotExists	Audit if related resource is missing	Check for associated resources
Modify	Auto-correct tags or properties	Tag enforcement
Append	Add properties without replace	Adding tags
DeployIfNotExists	Auto-deploy missing resources	Diagnostic settings, agents
Deny	Block non-compliant resource creation	Enforce hard requirements

Progressive rollout: Start with Audit, validate coverage, then promote to Deny.

---

Core Policy Assignments (Landing Zone Level)

// Assignment at management group scope — applies to all child subscriptions
targetScope = 'managementGroup'

// ✅ Deploy diagnostic settings automatically (DeployIfNotExists)
resource diagPolicy 'Microsoft.Authorization/policyAssignments@2023-04-01' = {
  name: 'deploy-diagnostic-settings'
  location: 'eastus'
  identity: { type: 'SystemAssigned' }   // ← DINE policies require managed identity
  properties: {
    policyDefinitionId: '/providers/Microsoft.Authorization/policySetDefinitions/{initiative-id}'
    enforcementMode: 'Default'
    parameters: {
      logAnalyticsWorkspaceId: { value: logAnalyticsWorkspaceId }
    }
  }
}

// ✅ Deny public network access on storage accounts
resource denyPublicStorage 'Microsoft.Authorization/policyAssignments@2023-04-01' = {
  name: 'deny-public-storage'
  properties: {
    policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/b2982f36-99f2-4db5-8eff-19bf0ddc60be'
    enforcementMode: 'Default'
    displayName: 'Deny public network access on Storage Accounts'
  }
}

// ✅ Require mandatory tags (Deny effect)
resource requireTagsPolicy 'Microsoft.Authorization/policyAssignments@2023-04-01' = {
  name: 'require-mandatory-tags'
  properties: {
    policyDefinitionId: mandatoryTagsInitiativeId
    enforcementMode: 'Default'
  }
}