azure-quickstart-templates VS azure-policy

I found a quick start template for this in Arm, I’m sure if you just decompile the ARM json it will give you a good heads start on how it should work.

There is a GitHub issue regarding this topic - https://github.com/Azure/azure-quickstart-templates/issues/2786

I'm using this video (https://www.youtube.com/watch?v=J4NCvIMuzVE) as a guide to start building out Windows VM's, and running into some questions. I'm trying to use the template located here ( azure-quickstart-templates/quickstarts/microsoft.compute/vm-simple-windows at master · Azure/azure-quickstart-templates (github.com)).

You can use quick start templates (https://github.com/Azure/azure-quickstart-templates/) as a starting point, but not all examples are bicep ready yet. But those can be easily converted to bicep.

I think it was this one https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.containerinstance/aci-sftp-files-existing-storage and this https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.containerinstance/aci-sftp-files

Reference: https://github.com/Azure/azure-policy

I just came across this post over in the Azure subreddit and it gave me a good idea on one way to deal with rogue Azure subscriptions - just have them default into a Management Group where a policy is in-place that basically denies use of any and all services.

Oooo, that's a nice trick for the use of the root management group which usually has best practice to leave empty. I like that a lot! Could maybe pair that with the "deny all resource types" policy sample, and then even if someone does create a new subscription it's pretty much 100% neutered until someone pulls it out of the root management group and places it somewhere else.

Found a 2018 Github article - https://github.com/Azure/azure-policy/issues/102

MS Repo https://github.com/Azure/azure-policy/tree/master/built-in-policies/policyDefinitions

I can see here that is expecting azure-policy/AzureWindowsBaseline.mof at master · Azure/azure-policy · GitHub: "LOCAL SERVICE, NETWORK SERVICE". However, that would exclude the web app pools.

Azure shared with us a GitHub repository contains built-in samples of Azure Policies that can be used as reference for creating and assigning policies to your subscriptions and resource groups.

The only real way you'll be able to do this is via an Azure Policy, alongside a deny effect - where your policy would restrict based on the type field, with the values passed in via an array parameter (example)