Azure / Azure/azure-policy

Allowed-locations: Exclude Microsoft.AzureActiveDirectory/guestusages

Open Beginner friendly
#1,602 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Open Policy Agent
Stars
1.7k
Forks
1.2k
Avg merge
2d 54m
Merged PRs (30d)
3

Description

#### Details of the scenario you tried and the problem that is occurring
Assigned the policy definition "/providers/microsoft.authorization/policydefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c" to our intermediate root tenant group and reviewed compliance. Resource of type Microsoft.AzureActiveDirectory/guestusages (Microsoft Entra External ID MAU) shows as non-compliant because it has the region 'Europe' which can't be selected as a value of the parameter 'listOfAllowedLocations' because it is not included in the 'strongType: location'.

Policy definition: /providers/microsoft.authorization/policydefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c

#### Verbose logs showing the problem
N/A

#### Suggested solution to the issue
Exclude Microsoft.AzureActiveDirectory/guestusages by adding the following lines to the policyRule block:
`{
"field": "type",
"notEquals": "Microsoft.AzureActiveDirectory/guestusages"
}`

#### If policy is Guest Configuration - details about target node
N/A

Contributor guide

No contributing guide indexed for this repository

Research direction

Locate policy definition e56962a6-4747-49cd-b67b-bf8b01975c4c in the repository and inspect its policyRule block. Add the type exclusion for Microsoft.AzureActiveDirectory/guestusages, then verify that this resource is no longer evaluated against listOfAllowedLocations while other resources still are.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.