The following set of built-in policies is recommended as initial basis for typical PaaS applications. Ideally this are applied to an appropriate Management Group being parent of these applications.
| Policy | Resource Type(s) | Configuration | Effect | Purpose |
|---|---|---|---|---|
| Enable Microsoft Defender for Cloud on your subscription | Subscription | None | DeployIfNotExists | Automatically enables free tier of Microsoft Defender |
| Require a tag on resource groups | Resource Group | Assigned for following tags according to [1] | Deny | Ensure that Resource Groups have the required tags applied and prevent creation otherwise |
| Inherit a tag from the resource group if missing | Resource Group | Assigned for following tags according to [1] | Modify | Automatically apply required tags from its parent Resource Group |
| Not allowed resource types | All | Forbidden resources see [2] | Deny | Avoid expenses and ensure guidelines |
| Allowed locations | All | Switzerland North & West Europe | Deny | Ensure guidelines |
| API App should only be accessible over HTTPS | App Service | None | Audit | Security |
| Function App should only be accessible over HTTPS | App Service | None | Audit | Security |
| Web Application should only be accessible over HTTPS | App Service | None | Audit | Security |
| Allowed storage account SKUs | Storage Account | Standard_LRS, Standard_ZRS, Standard_GRS, Standard_RAGRS | Deny | Avoid expenses |
| Secure transfer to storage accounts should be enabled | Storage Account | None | Audit | Security |
[1] According to tagging convention:
[2] (exkl. prefix “Microsoft.”):
Contributor and Security Admin on the Management Group. Use this identity in policy assignments, this prevents the generation of hardly identifiable Service Principals.Not allowed resource types) may be hardly manageable in the Azure Portal UI. Consider its definition with ARM/Bicep templates and an according deployment process.az policy assignment list --scope "/providers/Microsoft.Management/managementGroups/mg-applications"