plan-forge policy.instructions.md

Azure Policy & Initiative Compliance

Azure Policy is the enforcement layer — it makes Landing Zone standards compulsory, not optional.

Policy Effect Hierarchy

Progressive rollout: Start with Audit, validate coverage, then promote to Deny.

Core Policy Assignments (Landing Zone Level)

// Assignment at management group scope — applies to all child subscriptions
targetScope = 'managementGroup'

// ✅ Deploy diagnostic settings automatically (DeployIfNotExists)
resource diagPolicy 'Microsoft.Authorization/policyAssignments@2026-06-01' = {
  name: 'deploy-diagnostic-settings'
  location: 'eastus'
  identity: { type: 'SystemAssigned' }   // ← DINE policies require managed identity
  properties: {
    policyDefinitionId: '/providers/Microsoft.Authorization/policySetDefinitions/{initiative-id}'
    enforcementMode: 'Default'
    parameters: {
      logAnalyticsWorkspaceId: { value: logAnalyticsWorkspaceId }
    }
  }
}

// ✅ Deny public network access on storage accounts
resource denyPublicStorage 'Microsoft.Authorization/policyAssignments@2026-06-01' = {
  name: 'deny-public-storage'
  properties: {
    policyDefinitionId: '/providers/Microsoft.Authorization/policyDefinitions/b2982f36-99f2-4db5-8eff-19bf0ddc60be'
    enforcementMode: 'Default'
    displayName: 'Deny public network access on Storage Accounts'
  }
}

// ✅ Require mandatory tags (Deny effect)
resource requireTagsPolicy 'Microsoft.Authorization/policyAssignments@2026-06-01' = {
  name: 'require-mandatory-tags'
  properties: {
    policyDefinitionId: mandatoryTagsInitiativeId
    enforcementMode: 'Default'
  }
}