Azure/azure-policy

Repository for Azure Resource Policy built-in definitions and samples

Stars: 1.7k
Forks: 1.2k
Open beginner issues: 15
Indexed issues: 310
Avg merge: 2d 20h
Merged PRs (30d): 2

Dominant language: Open Policy Agent
License: MIT
Last GitHub push: Sep 16, 2026
Latest indexed: Sep 14, 2026
Contributing guide: No contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

310 open issues indexed

Built-in policy "Enable logging by category group for Bastions... to Log Analytics" fails when categoryGroup=allLogs in Belgium Central Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

Azure/azure-policy#1608 · Opened Sep 11, 2026
Built-in Policy 2465583e-4e78-4c15-b6be-a36cbc7c8b0f does not support configurable diagnostic setting name Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

Azure/azure-policy#1603 · Opened Sep 1, 2026
Allowed-locations: Exclude Microsoft.AzureActiveDirectory/guestusages Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

Azure/azure-policy#1602 · Opened Sep 1, 2026
Policy:PolicyName: "Configure Microsoft Defender CSPM plan" references isEntraPermissionsManagementEnabled which is defunct product Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

Azure/azure-policy#1600 · Opened Aug 25, 2026
DORA Azure Policy Initiative – Implementation in Azure Landing Zones Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

Azure/azure-policy#1599 · Opened Aug 24, 2026
policy requests Privileged Owner RBAC role, update to granular RBAC inline with least privilege principle Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

Azure/azure-policy#1598 · Opened Aug 21, 2026
RemoveBlockedAccountsWithOwnerPermissions - Security Assessment ID update Open

Difficulty 2/5 1-3 hours Newbie friendliness 64/100

Azure/azure-policy#1595 · Opened Aug 10, 2026
PublicEndpoint_AINE and PublicEndpoint_DINE: APIM configuration endpoint policies incorrectly apply to unsupported v2 SKUs Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

Azure/azure-policy#1593 · Opened Jul 31, 2026
AMA Windows policies miss new 'windowsserver2022' Marketplace offer — WS2022 VMs from migrated images out of scope Open

Difficulty 3/5 1-2 days Newbie friendliness 76/100

Azure/azure-policy#1591 · Opened Jul 30, 2026
AllowedLocations_Deny: Azure External ID tenant creation is blocked due to missing ciamDirectories resource type exclusion Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

Azure/azure-policy#1589 · 1 reaction · Opened Jul 10, 2026
Add `microsoft.web/sites` to the "Enable category group resource logging for supported resources to Log Analytics" initiative Open

Difficulty 2/5 1-2 days Newbie friendliness 68/100

Azure/azure-policy#1587 · 1 reaction · Opened Jun 24, 2026
Built-in policy "API Management service should use a SKU that supports virtual networks" (73ef9241) missing V2 SKUs in allowedValues Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

Azure/azure-policy#1582 · 2 reactions · Opened Jun 3, 2026
Built-in policy "Adds a tag to Network Virtual Appliances (NVAs) VMs and VMSS for MANA support" fails assignment with TooManyCountExpressions Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

Azure/azure-policy#1578 · 2 reactions · Opened May 28, 2026
uilt-in Policy DeployAzureMonitoringAgentLinuxVMWithUAI (ae8a10e6) does not include austriaeast in the location allowlist — AMA cannot be deployed via policy in Austria East Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

Azure/azure-policy#1577 · Opened May 28, 2026
Policy name has an extra trailing space Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

Azure/azure-policy#1572 · Opened May 15, 2026
Azure Policy to audit and get all Unknown/Orphraned RBACs: Microsoft.Authorization/roleAssignments/Name Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

Azure/azure-policy#1570 · Opened May 6, 2026
DataConnectorsAzureActivity: Limit scope for MI roles Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

Azure/azure-policy#1568 · Opened Apr 27, 2026
Azure Firewall built-in diagnostic policy missing support for resource-specific tables (logAnalyticsDestinationType) Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

Azure/azure-policy#1567 · 2 reactions · Opened Apr 21, 2026
StorageAccountAllowCrossTenantReplication reports violations on complaint Storage Accounts when allowCrossTenantReplication not explicitly set Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

Azure/azure-policy#1566 · Opened Apr 20, 2026
Supports Open

Difficulty 1/5 Under an hour Newbie friendliness 15/100

Azure/azure-policy#1563 · Opened Mar 27, 2026
Built in policy "Deploy export to Log Analytics workspace for Microsoft Defender for Cloud data" cannot be disabled by parameter Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

Azure/azure-policy#1561 · Opened Mar 25, 2026
Built in policy "Security Center/Configure Microsoft Defender for Servers plan" never reports compliant when plan "P1" is configured Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

Azure/azure-policy#1560 · Opened Mar 24, 2026
Spaincentral is not allowed on the list of Azure regions that are approved for usage Open

Difficulty 2/5 1-3 hours Newbie friendliness 64/100

Azure/azure-policy#1559 · 1 comment · Opened Mar 23, 2026
[Microsoft Security Copilot] Add resource type alias for Microsoft.SecurityCopilot/capacities Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

Azure/azure-policy#1554 · Opened Mar 12, 2026
Azure Government requires 6 DNS zones for "Configure Azure Monitor Private Link Scope to use private DNS zones" Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

Azure/azure-policy#1550 · Opened Feb 24, 2026
Configure Windows Machines to be associated with a Data Collection Rule or a Data Collection Endpoint: Missing Image Offer - Office-365 Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

Azure/azure-policy#1548 · Opened Feb 23, 2026
https://github.com/Azure/azure-policy/issues/new/chooseZack Verizon wireless devices Open

Difficulty 5/5 Over a week Newbie friendliness 5/100

Azure/azure-policy#1547 · Opened Feb 22, 2026
deployIfNotExists policy not triggering automatically for Azure Static Apps Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

Azure/azure-policy#1545 · 1 comment · Opened Feb 17, 2026
Built-in policy fails to detect App Service resources without VNet integration when virtualNetworkSubnetId property is absent Open

Difficulty 2/5 1-3 hours Newbie friendliness 38/100

Azure/azure-policy#1541 · Opened Jan 29, 2026
Built-in policy does not recognize API Management backend authentication via Managed Identity Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

Azure/azure-policy#1539 · 3 comments · 5 reactions · Opened Jan 23, 2026
AKS ContainerEnforceProbes: Policy text says readiness OR liveness probe is sufficient, but template enforces both Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

Azure/azure-policy#1537 · Opened Jan 20, 2026
The syntax of the NetworkWatcherRG resource group name is inconsistent between policies Open

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

Azure/azure-policy#1536 · Opened Jan 14, 2026
Add built-in policy to audit Key Vault certificates where issuerParameters.certificateTransparency is false or missing Open

Difficulty 3/5 1-2 days Newbie friendliness 38/100

Azure/azure-policy#1531 · 1 comment · Opened Nov 19, 2025
Spelling: builtinpolicies/PolicyDefinitions/MachineLearning/ComputeInstanceUpdates_Audit.json Open

Difficulty 1/5 Under an hour Newbie friendliness 35/100

Azure/azure-policy#1526 · 1 comment · Opened Nov 3, 2025
No policy aliases for Topics in ServiceBus Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

Azure/azure-policy#1523 · Opened Oct 21, 2025
BuiltIn Policy for virtual network flow log missing constraints Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

Azure/azure-policy#1522 · Opened Oct 15, 2025
BuiltIn Policy for App Service should enable vnet routing fails for newer api-version Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

Azure/azure-policy#1521 · 2 comments · 1 reaction · Opened Oct 15, 2025
Configure Microsoft Defender For Cloud Plans set to West Europe Open

Difficulty 2/5 1-2 days Newbie friendliness 48/100

Azure/azure-policy#1519 · Opened Oct 14, 2025
Include Attack Paths in DINE Policy: Deploy export to Event Hub for Microsoft Defender for Cloud data Open

Difficulty 1/5 Under an hour Newbie friendliness 55/100

Azure/azure-policy#1517 · 1 comment · 2 reactions · Opened Oct 8, 2025
Alias request for Microsoft.ServiceNetworking/TrafficControllers Open

Difficulty 3/5 1-2 days Newbie friendliness 38/100

Azure/azure-policy#1513 · 1 reaction · Opened Sep 30, 2025
"Microsoft.Insights/logprofiles" deprecated 1a4e592a-6a6e-44a5-9814-e36264ca96e7 Open

Difficulty 4/5 3-5 days Newbie friendliness 30/100

Azure/azure-policy#1511 · Opened Sep 24, 2025
Request to add "Commfides" to allowedCAs in built-in policy 8e826246-c976-48f6-b03e-619bb92b3d82 Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

Azure/azure-policy#1508 · Opened Sep 17, 2025
I want to help implementing NIS2 Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

Azure/azure-policy#1507 · Opened Sep 15, 2025
Update Vaults_Immutability_Audit.json Open

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

Azure/azure-policy#1502 · Opened Sep 5, 2025
Please fix built-in Initiative Issue: Audit Public Network Access Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

Azure/azure-policy#1497 · Opened Aug 21, 2025
Keys_KeyRotationPolicy_MaximumDaysToRotate | Does not detect any keys as applicable resources. Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

Azure/azure-policy#1492 · Opened Aug 12, 2025
Azure Policy does not support Network Isolation on Log Analytics Workspaces and App Insights Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

Azure/azure-policy#1491 · Opened Aug 7, 2025
Private DNS Configuration not created for WebApp slots Open

Difficulty 2/5 1-3 hours Newbie friendliness 52/100

Azure/azure-policy#1490 · Opened Aug 6, 2025
NIST_SP_800-171_R3 policy initiative with DINE policies causes deployment issues Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

Azure/azure-policy#1485 · 1 comment · Opened Jul 16, 2025
"Alias Request: Microsoft.DBforMySQL/flexibleServers/configurations/aad_auth_only" Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

Azure/azure-policy#1481 · Opened Jul 4, 2025

A short digest of beginner-friendly GitHub issues.