Many different fields can used to form logical conditions in Azure policy rules. The fields ‘Type’ and ‘Name’ are special because they are not only used as a logical condition to evaluate whether a resource is compliant or non-compliant against the policy, they are also used to determine whether a resource should be evaluated or not, that is whether the resource is applicable or not for the policy evaluation. According to Microsoft document “Get compliance data of Azure resources” (https://docs.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data):
“Azure Policy uses the type and name fields in the definition to determine if a resource is a match. When the resource matches, it's considered applicable and has a status of either Compliant or Non-compliant. If either type or name is the only property in the definition, then all resources are considered applicable and are evaluated.”
Suppose that there is a resource group containing a few of VMs, storage accounts, VNETs and some subnets. If the following policy rule is assigned to the resource group,
{ "mode": "All", "policyRule": { "if": { "allOf": [ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" }, { "not": { "field": "tags[tag1]", "equals": "tag-value1" } } ] }, "then": { "effect": "audit" } }, "parameters": {} } |
Only will the VMs of the group be applicable, evaluated and marked as complaint or non-complaint. Other resources like storage accounts, VNETs and subnets will NOT be evaluated.
If there is only one ‘Type’ field in the rule,
{ "mode": "All", "policyRule": { "if": { "field": "type", "equals": "Microsoft.Compute/virtualMachines" }, "then": { "effect": "Audit" } }, "parameters": {} } |
then all resources in the resource group will be applicable and evaluated. The VMs will be marked as non-compliant, while all other resources like storage accounts, VNETs and subnets will be marked as complaint.
In fact, the situation that all resources are applicable because “Type” or “Name” field is only property in the rule is just a special case. As long as the “Type” or “Name” field is not a necessary condition, then all resources in the policy scope will be applicable. For example, the following policy has two fields and is very similar to the first rule above but with the logical operator “anyOf” instead of “allOf”.
{ "mode": "All", "policyRule": { "if": { "anyOf": [ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" }, { "not": { "field": "tags[tag1]", "equals": "tag-value1" } } ] }, "then": { "effect": "audit" } }, "parameters": {} } |
In this case, all resources in the resource group are applicable and will be evaluated.