Enterprise Azure Policy as Code (EPAC)

After generating the structure file, you must update it to match your environment. Key fields to modify include:

• Parameters: Update values within the parameters object (e.g., dcrResourceId).
• Management Group IDs: Update the value in the management section to your specific management group ID.
• Enforcement Mode: Change enforcementMode to either Default or DoNotEnforce.

Example JSON snippets:

// Updating a parameter
"ama_vm_insights_data_collection_rule_id": {
  "policy_assignment_name": [
    "Deploy-VM-Monitoring",
    "Deploy-VMSS-Monitoring",
    "Deploy-vmHybr-Monitoring"
  ],
  "description": "The data collection rule id that should be used for the VM Insights deployment.",
  "parameters": {
    "parameter_name": "dcrResourceId",
    "value": ""
  }
}

// Updating a management group ID
"management": {
  "management_group_function": "Management",
  "value": "/providers/Microsoft.Management/managementGroups/management"
}

// Modifying enforcement mode
"enforcementMode": "Default"

When you need to exclude a scope from a policyAssignment, choose a method based on your specific requirement:

• Periodic Review Required: Use Exemptions. This leverages Azure's native functionality to manage reviews and can include an ExpiresOn date.
• Descope specific items within a policySetDefinition: Use NotScope within the policyAssignment. This allows you to change the effect for specific policy definitions inside a set (e.g., exempting one specific service from a larger security initiative).
• Sweeping changes for all assignments: Use globalNotScopes in the Global Settings file. This is useful for blocking all inheritance for policies delivered by EPAC across a wide scope.
• Exclude from Desired State Enforcement: Use Desired State Adjustments in the Global Settings file. This allows assignments to be deployed in a scope without being affected by the "desiredState":{"strategy":"full"} configuration.
• Remove from EPAC management entirely: Define the scope in the Global Settings file to remove it from EPAC management.

When defining exemptions using Option A (Policy Definition IDs/Names), Option C (Policy Set IDs/Names), or when using scopes, EPAC automatically generates unique name, displayName, and description values to ensure they are readable and unique across different assignments.

Naming Logic

• name: Generated by concatenating the provided name with a dash - and the Assignment name (the last part of the policyAssignmentId).
• displayName and description: Generated by concatenating the provided displayName/description with a space-dash-space (-), followed by the last part of the scope or the human-readable name (if using the humanReadableName: prefix).

Example: Using policyDefinitionId and scopes

If you provide a definition file like this:

{
    "exemptions": [
        {
            "name": "short-name",
            "displayName": "Descriptive name",
            "description": "More details",
            "exemptionCategory": "Waiver",
            "scopes": [
                "/subscriptions/11111111-2222-3333-4444-555555555555",
                "/subscriptions/11111111-2222-3333-4444-555555555556/resourceGroups/resourceGroupName1"
            ],
            "policyDefinitionId": "/providers/microsoft.authorization/policyDefinitions/00000000-0000-0000-0000-000000000000"
        }
    ]
}

EPAC generates the following for the resource group scope:

• name: short-name-assignmentName
• displayName: Descriptive name - resourceGroupName1 - assignmentName
• description: More details - resourceGroupName1 - assignmentName

In EPAC v11, if your environment does not follow the standard Azure Landing Zones (ALZ) management group structure, you can use the overrides key in your policy structure file to define custom archetypes and map them to your specific management groups.

1. Define Custom Archetypes

Use the overrides.archetypes.custom key. Set type to "new" to create entirely new archetypes. Each archetype defines a list of policy_assignments.

2. Map Archetypes to Management Groups

Use the managementGroupNameMappings key to map your custom archetype names to actual Azure Management Group resource IDs. The value can be a single string or an array of strings.

3. Run the Sync

When running the sync command, you must include the -EnableOverrides parameter.

{
  "overrides":{
    "archetypes": {
      "custom": [
        {
          "name": "production",
          "type": "new",
          "policy_assignments": [
            "Audit-PeDnsZones",
            "Deny-HybridNetworking"
          ]
        }
      ]
    }
  },
  "managementGroupNameMappings": {
    "production": {
      "management_group_function": "Production",
      "value": "/providers/Microsoft.Management/managementGroups/prod"
    }
  }
}

Sync-ALZPolicyFromLibrary.ps1 -DefinitionsRootFolder .\Definitions\ -Type ALZ -PacEnvironmentSelector epac-dev -EnableOverrides

EPAC provides three ways to specify which policy or policy set to exempt. Choosing the right one depends on your goal.

Option A: Policy Definition IDs or Names (Recommended)

Best for new exemptions. It creates one exemption per Assignment containing the Policy definition.

• Use policyDefinitionId for built-in definitions.
• Use policyDefinitionName for custom definitions (In CSV, use policyDefinitions/{{policyDefinitionName}} in the assignmentReferenceId column).
• Note: policyDefinitionReferenceIds must be empty/omitted.

Option B: Policy Assignment ID

The traditional method. Creates one exemption for a specific assignment.

• Use policyAssignmentId (e.g., /providers/Microsoft.Management/managementGroups/.../providers/Microsoft.Authorization/policyAssignments/...).
• For Policy Set Assignments, you can use policyDefinitionReferenceIds to exempt specific policies within that set.

Option C: Policy Set Definition IDs or Names

Useful for exempting multiple policies within a Policy Set using a single exemption.

• Use policySetDefinitionId or policySetDefinitionName.
• For custom sets in CSV, use policySetDefinitions/{{policySetDefinitionName}} in the assignmentReferenceId column.
• Can be used with policyDefinitionReferenceIds to target a subset of the set.