Allowed-locations: Exclude Microsoft.AzureActiveDirectory/guestusages
- Dominant language
- Open Policy Agent
- Stars
- 1.7k
- Forks
- 1.2k
- Avg merge
- 2d 54m
- Merged PRs (30d)
- 3
Description
#### Details of the scenario you tried and the problem that is occurring
Assigned the policy definition "/providers/microsoft.authorization/policydefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c" to our intermediate root tenant group and reviewed compliance. Resource of type Microsoft.AzureActiveDirectory/guestusages (Microsoft Entra External ID MAU) shows as non-compliant because it has the region 'Europe' which can't be selected as a value of the parameter 'listOfAllowedLocations' because it is not included in the 'strongType: location'.
Policy definition: /providers/microsoft.authorization/policydefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c
#### Verbose logs showing the problem
N/A
#### Suggested solution to the issue
Exclude Microsoft.AzureActiveDirectory/guestusages by adding the following lines to the policyRule block:
`{
"field": "type",
"notEquals": "Microsoft.AzureActiveDirectory/guestusages"
}`
#### If policy is Guest Configuration - details about target node
N/A
Contributor guide
No contributing guide indexed for this repository
Research direction
Locate policy definition e56962a6-4747-49cd-b67b-bf8b01975c4c in the repository and inspect its policyRule block. Add the type exclusion for Microsoft.AzureActiveDirectory/guestusages, then verify that this resource is no longer evaluated against listOfAllowedLocations while other resources still are.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100