what is Az Policy effect in a Resource Move and in an Edit of a Virtual Network ?

Shridhar Srinivasan 220

You have an Azure subscription that contains the resources shown in the following table:

Name    Туре                Resource group
VNET1   Virtual network     RG1
VNET2   Virtual network     RG2
VM1     Virtual machine     RG2

The status of VM1 is Running.

You assign an Azure policy to RG2 with "Not allowed Resource types" parameters set for

Microsoft.ClassicNetwork/virtualNetworks
Microsoft.Network/virtualNetworks
Microsoft.Compute/virtualMachines

Q1. Can An administrator move VNET1 to RG2.

Q2. Can An administrator modify the address space of VNet2.

2 answers

Tech-Hyd-1989 5,796 Reputation points

2023-07-18T07:17:03.3433333+00:00

Hello Srinivasan, Shridhar (Shridhar)
Good Day!

Q1. Can an administrator move VNET1 to RG2?

No, an administrator cannot move VNET1 to RG2 because the target resource group RG2 has an Azure policy assigned with "Not allowed Resource types" parameters set for Microsoft.Network/virtualNetworks. This policy restricts the creation or movement of virtual networks (VNETs) within RG2.

Q2. Can an administrator modify the address space of VNet2?

Yes, an administrator can modify the address space of VNet2. The Azure policy that has been assigned to RG2 does not include any restrictions related to modifying the address space of virtual networks (VNETs). Therefore, the administrator should have the necessary permissions to make changes to the address space of VNet2.

-Please accept answer and upvote if the above information is helpful for the benefit of the community.
Please sign in to rate this answer.
Shridhar Srinivasan 220 Reputation points

2023-07-20T11:44:26.9466667+00:00

I understand, "Microsoft.Network/virtualNetworks" includes updates to the Virtual Network.

Given that, won't address space modification also not be Blocked ?

Shridhar Srinivasan 220 Reputation points

2023-07-21T15:15:21.14+00:00

Can someone please clarify on the above ?

Shridhar Srinivasan 220 Reputation points

2023-07-21T20:25:52.6166667+00:00

Thanks @SadiqhAhmed-MSFT for the FAQ link, very useful.

Please help me with answer to my 2nd question.

SadiqhAhmed-MSFT 45,181 Reputation points Microsoft Employee

2023-07-24T20:09:37.5233333+00:00

@Srinivasan, Shridhar (Shridhar) Reg: 2nd question: How does Modify come into the picture here? What is meant by modify the address space?

If the resource is being moved across RGs, and RG2 has a deny of that resource type, a modify policy will not take effect since the type is disallowed by the scope.

Hope this answers your question!

Shridhar Srinivasan 220 Reputation points

2023-07-26T10:40:45.95+00:00

Thanks @SadiqhAhmed-MSFT Yes, the 2nd question is not related to the Move scenario. It was an additional ask to understand the effect of the Policy.

And to add more clarity

VNet2 was created before Policy was assigned to RG2

Policy with restrictions was assigned later

We try to edit the address space after Policy is assigned

It basically, is trying to ask, if I can carry out, what is outlined here - https://video2.skills-academy.com/en-us/azure/virtual-network/manage-virtual-network#add-or-remove-an-address-range-using-the-azure-portal

To reconfirm, I won't be able to carry out the steps outlined there, Right ?

SadiqhAhmed-MSFT 45,181 Reputation points Microsoft Employee

2023-07-26T11:14:31.99+00:00

@Srinivasan, Shridhar (Shridhar) Q2: This doesn’t involve any move operation. I think what you are trying to figure out is, is it possible to update (or modify) a non-compliant resource already in RG2?

Thank you for clarifying. Yes, it is possible to add a modify policy into RG2 so that it can modify non-compliant resources within RG2.

Hope this answers your question. If yes, please don't forget to "Accept Answer" and "Up-vote" the post.

SadiqhAhmed-MSFT 45,181 Reputation points Microsoft Employee

2023-07-28T06:44:17.27+00:00

@Srinivasan, Shridhar (Shridhar) Just checking in to see if you got a chance to see the previous response and if it helped, I would request you to "Accept Answer and Upvote" so that the relevancy of this post will improve when anyone in the community search for a similar query.

Shridhar Srinivasan 220 Reputation points

2023-07-29T05:01:40.68+00:00

Apologies @SadiqhAhmed-MSFT for the delay.

Please check my comment from Jul 26. I am not talking about adding any new modify policy. I am just looking to change the Address space added to VNet2 when it was created.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
SadiqhAhmed-MSFT 45,181 Reputation points Microsoft Employee

2023-07-21T20:12:01.7833333+00:00

@Srinivasan, Shridhar (Shridhar) Thank you for asking your question on Microsoft Q&A platform. Happy to answer any question you may have!

We only validate that the move doesn’t cause a policy violation in the target resource group, so in your example – RG2

RG 1 is currently non-compliant, and policy should already be flagging it that since the VM is violating the policy defined for RG1, but that’s not something we would evaluate during resource move since the resource is already in a non-complaint state.

Please see our public docs FAQ section here: Move resources to a new subscription or resource group - Azure Resource Manager | Microsoft Learn

Question: What does the error code "RequestDisallowedByPolicy" mean?

Resource Manager validates your move request before attempting the move. This validation includes checking policies defined on the resources involved in the move. For example, if you're attempting to move a key vault but your organization has a policy to deny the creation of a key vault in the target resource group, validation fails and the move is blocked. The returned error code is RequestDisallowedByPolicy.

For more information about policies, see What is Azure Policy?.
Reg: 2nd question: How does Modify come into the picture here? What is meant by modify the address space?

If the resource is being moved across RGs, and RG2 has a deny of that resource type, a modify policy will not take effect since the type is disallowed by the scope.

If the response helped, do "Accept Answer" and up-vote it
Please sign in to rate this answer.
Shridhar Srinivasan 220 Reputation points

2023-07-26T10:52:51.4466667+00:00

Thanks Yes, the 2nd question is not related to the Move scenario. It was an additional ask to understand the effect of the Policy.

It basically, is trying to ask, if I can carry out, what is outlined here - https://video2.skills-academy.com/en-us/azure/virtual-network/manage-virtual-network#add-or-remove-an-address-range-using-the-azure-portal

To reconfirm, I won't be able to carry out the steps outlined there, Right ?

SadiqhAhmed-MSFT 45,181 Reputation points Microsoft Employee

2023-08-21T10:01:29.0033333+00:00

@Shridhar Srinivasan Sorry for the delayed response.

Looking at the property, it seems that the alias would be one of the following:

Microsoft.Network/virtualNetworks/addressSpace.addressPrefixes[*]

Microsoft.Network/virtualNetworks/addressSpace.addressPrefixes

Microsoft.Network/virtualNetworks/addressSpace

To check if an alias is modifiable, you need to run this command: Get-AzPolicyAlias | Select-Object -ExpandProperty 'Aliases' | Where-Object { $_.DefaultMetadata.Attributes -eq 'Modifiable' } and validate that one of the above aliases is on the list. If it is, then you are able to use the modify effect to change the addressSpace of virtual networks.

SadiqhAhmed-MSFT 45,181 Reputation points Microsoft Employee

2023-08-22T10:41:42.72+00:00

@Shridhar Srinivasan Have you had a chance to see the previous response? If the suggestions were helpful, click “Accept Answer” and Up-Vote. Feel free to reach out to us if you've additional questions in this regard.

SadiqhAhmed-MSFT 45,181 Reputation points Microsoft Employee

2023-08-24T06:27:24.7233333+00:00

@Shridhar Srinivasan We haven't heard back from you. Please reply if you have any questions in this matter and we will gladly continue the discussion.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

what is Az Policy effect in a Resource Move and in an Edit of a Virtual Network ?

2 answers

Your answer