Azure Policy for Diagnostic Settings on Storage Accounts Not Affecting Table or Queue

Seekell, Roger 26 Reputation points
2024-08-30T13:13:17.4033333+00:00

I have an issue where I have set up these built-in policies to enable Diagnostic Settings on a storage account and its four subtypes.

unnamed (1)

However, consistently, when I create a new Storage Account, it does not apply diagnostic settings to the Table or Queue, only to the Blob, the File, and the top. 

unnamed

I can see some "deployIfNotExists" successful actions in the activity log, and no failures, but not enough to cover queue and table.

Strangely, after a day, the Table and Queue will show non-compliant, and I can then run remediation to add the diagnostic settings to them. 

I want all five diagnostic settings to be set up by policy from the beginning. Thanks.

Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
3,104 questions
Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
868 questions
0 comments
Accepted answer
  1. Prashant Kumar 775 Reputation points Microsoft Employee
    2024-09-02T13:32:18.61+00:00

    Hi Roger,

    This is an expected behavior as when a storage account is created with default configurations via portal or any other clients, the request payload does not contain anything related to queue or table.

    The request payload only contains storage account definition along with flieservices and blobservices.

    For deployifnotexists effect to work, these resource types need to present in the request payload during resource creation operation. so that policy can evaluate the policy conditions to match resource properties and act.

    You can test the same by creating a new storage account from the portal and in the last step of resource creation wizard, click on "download a template for automation" link. You will get to see only storage account, blobservices and fileservices definitions in the ARM template.

    table and queues are not created with storage account by default. But once they are created later, the policy identifies them non-compliant. Policy remediation tasks can be created to remediate them by adding diagnostics settings.

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nehruji R 7,306 Reputation points Microsoft Vendor
    2024-09-02T13:13:26.6166667+00:00

    Hello Seekell, Roger,

    Greetings! Welcome to Microsoft Q&A Platform.

    I understand that you are having trouble in set up these built- in policies to enable Diagnostic settings on a storage account for blob, file, table and queue.

    Policies and policy initiatives provide a simple method to enable logging at-scale via diagnostics settings for Azure Monitor. Using a policy initiative, you can turn on audit logging for all supported resources in your Azure environment.

    In order to monitor Azure resources, it's necessary to create  diagnostic settings  for each resource. This process can be difficult to manage when you have many resources. To simplify the process of creating and applying diagnostic settings at scale, use Azure Policy to automatically generate diagnostic settings for both new and existing resources.

    Each Azure resource type has a unique set of categories listed in the diagnostic settings. Each resource type therefore requires a separate policy definition. Some resource types have built-in policy definitions that you can assign without modification. For other resource types, you can create a custom definition.

     

    Assign the initiative to an Azure management group, subscription, or resource group, depending on the scope of your resources to monitor. A management group is useful for scoping policy, especially if your organization has multiple subscriptions.

                                             

    When you create the assignment by using the Azure portal, you have the option of creating a remediation task at the same time. See Remediate non-compliant resources with Azure Policy for details on the remediation.refer - https://video2.skills-academy.com/en-us/azure/azure-monitor/essentials/diagnostics-settings-policies-deployifnotexists?source=recommendations&tabs=portal.

    Hope this answer helps!

    Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.