Skip to main content

Azure Policy - An excellent tool for resource governance inside Azure

The number of Azure Regions increases every day. Just a few days ago two new locations were announced. All the things that are now happing related to the cloud are not only crazy but also scarry.

Scarry from the government and legal perspective. For example inside an Azure Subscription, a user can create storages in any location around the globe. What happens if you based in the UK, you have customer information that is not allowed to leave the country.
You might say that you would train the team that has the rights to create new resources only in Azure Regions that are based in the UK. This solution is not enough because from government perspective you don't have a mechanism that would enforce this.

To enforce something like this, Microsoft Azure is offering Azure Policies. This service is allowing us to define a specific list of rules and actions that are applying automatically to resources that are created under particular Azure Subscription or Azure Resource Group (or even Management Group).

For the above example, you can use one of the default policies that are already defined inside Azure Policies - "Allowed Location". This policy enables us to restrict the locations where users can create new resources. In this way, we can control the locations where resources are created. The users would be allowed to create new resources only in the UK.

Additional to the location policy, some other predefined policies are beneficial like:

  • "Not allowed resource types" - This policy restrict users to create specific resources (Eg.: users cannot create Azure SQL Databases).
  • "Allowed Resource Type" - Allow users to create only specific resources that are defined in the policy
  • "Enforce tag and its value" & "Apply tag and its default value" - These two policies enable us to enforce users to specify specific tags to resources and set particular values in certain conditions.

Another essential feature of policies is so-called "Effect". It represents the action that takes place when a specific policy applies to a resource. There are five effects that you can use:

  1. Deny - Fails the request and generate an audit log
  2. Audit - Accept the request and create an audit log
  3. Append - Add additional fields to the request (Eg. add additional tags)
  4. AuditIfNotExist - When the resource does not exist, enable auditing
  5. DeployIfNotExist - When the resource does not exist, create that specific resource (Eg. each Web App shall have an Application Insight created).

You can read more about Azure Policies on the official documentation ( But before starting to use them keep in mind the following recommendations:

  • Apply policies at the highest level possible. This policy can be assigned at the next level without any issues.
  • You should reuse policies as much as possible. Features like parameters allow us to reuse policies definition as much as possible. 
  • Don't restrict access from second 1. Try to do a small audit and only after that to define policies that deny specific actions. 
  • For exising environments, start with Audit and only after that Deny specific actions. 


Popular posts from this blog

ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded

Today blog post will be started with the following error when running DB tests on the CI machine:
threw exception: System.InvalidOperationException: The Entity Framework provider type 'System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer' registered in the application config file for the ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded. Make sure that the assembly-qualified name is used and that the assembly is available to the running application. See for more information. at System.Data.Entity.Infrastructure.DependencyResolution.ProviderServicesFactory.GetInstance(String providerTypeName, String providerInvariantName) This error happened only on the Continuous Integration machine. On the devs machines, everything has fine. The classic problem – on my machine it’s working. The CI has the following configuration:

TeamCity.NET 4.51EF 6.0.2VS2013
It seems that there …

Entity Framework (EF) TransactionScope vs Database.BeginTransaction

In today blog post we will talk a little about a new feature that is available on EF6+ related to Transactions.
Until now, when we had to use transaction we used ‘TransactionScope’. It works great and I would say that is something that is now in our blood.
using (var scope = new TransactionScope(TransactionScopeOption.Required)) { using (SqlConnection conn = new SqlConnection("...")) { conn.Open(); SqlCommand sqlCommand = new SqlCommand(); sqlCommand.Connection = conn; sqlCommand.CommandText = ... sqlCommand.ExecuteNonQuery(); ... } scope.Complete(); } Starting with EF6.0 we have a new way to work with transactions. The new approach is based on Database.BeginTransaction(), Database.Rollback(), Database.Commit(). Yes, no more TransactionScope.
In the followi…

GET call of REST API that contains '/'-slash character in the value of a parameter

Let’s assume that we have the following scenario: I have a public HTTP endpoint and I need to post some content using GET command. One of the parameters contains special characters like “\” and “/”. If the endpoint is an ApiController than you may have problems if you encode the parameter using the http encoder.
using (var httpClient = new HttpClient()) { httpClient.BaseAddress = baseUrl; Task<HttpResponseMessage> response = httpClient.GetAsync(string.Format("api/foo/{0}", "qwert/qwerqwer"))); response.Wait(); response.Result.EnsureSuccessStatusCode(); } One possible solution would be to encode the query parameter using UrlTokenEncode method of HttpServerUtility class and GetBytes method ofUTF8. In this way you would get the array of bytes of the parameter and encode them as a url token.
The following code show to you how you could write the encode and decode methods.