You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Redirect general policy support to standard Azure support channels (#411)
* Add Known Issues section to readme
* Move code of conduct message to the end
* Whitespace
* Add PUT issues
* Apply feedback
* Wording changes
* Fix broken links
* Update readme and issue templates to shut down support options other than issues with the sample content.
* Pretty up a couple more links.
* Remove obsolete line from Known Issues.
Add support notice to issue template
Add additional keywords to stackoverflow link
* PR feedback
* PR feedback
* Add link to Microsoft Tech Community Azure channels
* Minor corrections
* PR feedback
* Updates to anomalous resource type information
Add link to Azure Governance tech community
Copy file name to clipboardexpand all lines: .github/ISSUE_TEMPLATE/Sample_issue.md
+7-5
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,14 @@
1
1
---
2
-
name: Problem with a policy
3
-
about: If you have a problem, bug, or enhancement with a policy.
2
+
name: Problem with a policy sample
3
+
about: If you discover a problem, bug, or enhancement with a policy sample in this repository.
4
4
---
5
5
<!--
6
-
Your feedback and support is greatly appreciated, thanks for contributing!
6
+
Your feedback and support of these samples is greatly appreciated, thanks for contributing!
7
+
8
+
**Note:** support for Azure Policy has transitioned to standard Azure support channels so this repository will no longer be monitored for support requests. Issues opened here are only to report specific problems with the samples published in this repository. Any other issues will be closed with a pointer to the README. Check [**here**](https://github.com/Azure/azure-policy#getting-support) for information about getting support for Azure Policy.
7
9
8
10
ISSUE TITLE:
9
-
Please prefix the issue title with the policy package name, e.g.
11
+
Please prefix the issue title with the policy sample name, e.g.
10
12
'PolicyName: Short description of my issue'
11
13
12
14
ISSUE DESCRIPTION (this template):
@@ -31,7 +33,7 @@ about: If you have a problem, bug, or enhancement with a policy.
31
33
<!--
32
34
Please provide as much as possible about the target node, for example
33
35
edition, version, build and language.
34
-
On OS with WMF 5.1 the following command can help get this information.
36
+
On OS with WMF 5.1 the following Powershell command can help get this information.
Check here for a current list of [**known issues**](#known-issues).
3
+
This repository contains samples of Azure Policies that can be used as reference for creating and assigning policies to your subscriptions and resource groups. For additional samples with descriptions, see [Policy samples](https://docs.microsoft.com/azure/governance/policy/samples/) on docs.microsoft.com.
4
4
5
-
## Alias Requests
5
+
## Contributing
6
+
7
+
To get started contributing to the samples, please visit our [**contribution guide**](./1-contribution-guide/README.md#contribution-guide).
8
+
9
+
## Reporting Samples Issues
10
+
11
+
If you discover a problem with any of the samples published here that isn't already reported in [**Issues**](https://github.com/Azure/azure-policy/issues), open a [**New issue**](https://github.com/Azure/azure-policy/issues/new/choose).
Support for Azure Policy has transitioned to standard Azure support channels so this repository will no longer be monitored for support requests. Issues opened here are only to report specific problems with the samples published in this repository. Any other issues will be closed with a pointer to this notice. Check [**here**](#getting-support) for information about getting support for Azure Policy.
10
16
11
-
This repository contains samples of Azure Policies that can be used as reference for creating and assigning policies to your subscriptions and resource groups. For a full list of samples with descriptions, see [Policy samples](https://docs.microsoft.com/azure/governance/policy/samples/) on docs.microsoft.com.
17
+
# Azure Policy Known Issues
12
18
13
-
### Articles
19
+
Check here for a current list of [**known issues**](#known-issues) for Azure Policy.
The general Azure Policy support role of this repository has transitioned to standard Azure support channels. See below for information about getting support help for Azure Policy.
59
+
60
+
### Alias Requests
61
+
62
+
An alias enables you to restrict what values or conditions are permitted for a *property* on a resource. Each alias maps to the paths in different API versions for a given resource type. During policy evaluation, the policy engine gets the property path for that API version.
63
+
See the documentation page on aliases [**here**](https://docs.microsoft.com/azure/governance/policy/concepts/definition-structure#aliases). For additional information about Azure Policy and aliases, visit this [**blog post**](https://azure.microsoft.com/blog/more-resource-policy-aliases/).
64
+
65
+
Previously, this repository was the official channel to open requests for new aliases. Since the full set of aliases for most namespaces have now been published, support for requesting aliases is now handled by Azure Customer Support. Open a new [**Azure Customer Support ticket**](https://azure.microsoft.com/support/create-ticket/) if you believe you need new aliases to be published.
66
+
67
+
[**This page**](https://docs.microsoft.com/azure/governance/policy/concepts/definition-structure#aliases) documents the commands for discovering existing aliases.
68
+
69
+
### General Questions
70
+
71
+
If you have questions you haven't been able to answer from the [**Azure Policy documentation**](https://docs.microsoft.com/azure/governance/policy), there are a few places that host discussions on Azure Policy:
- Join the Monthly Call on Azure Governance (register [here](https://aka.ms/joinazuregovernance))
75
+
- Search old [**issues in this repo**](https://github.com/Azure/azure-policy/issues)
76
+
- Search or add to Azure Policy discussions on [**StackOverflow**](https://stackoverflow.com/questions/tagged/azure-policy+or+azure+policy)
47
77
48
-
To contribute and get started, please visit our[**contribution guide**](./1-contribution-guide/README.md#contribution-guide).
78
+
If your questions are more in-depth or involve information that is not public, open a new[**Azure Customer Support ticket**](https://azure.microsoft.com/support/create-ticket/).
49
79
50
-
##Requesting Policy Aliases
80
+
### Documentation Corrections
51
81
52
-
To request a new alias, please open a new issue following the instructions [**here**](./1-contribution-guide/request-alias.md)
82
+
To report issues in the Azure Policy online documentation, look for a feedback area at the bottom of the page. If you don't see a place to enter feedback, you can also directly open a new issue at the [**Microsoft Docs GitHub**](https://github.com/MicrosoftDocs/feedback/issues).
83
+
84
+
### New built-in Policy Proposals
85
+
86
+
If you have ideas for new built-in policies you want to suggest to Microsoft, you can submit them to [**Azure Governance User Voice**](https://feedback.azure.com/forums/915958-azure-governance). These suggestions are actively reviewed and prioritized for implementation.
87
+
88
+
### Other Support for Azure Policy
89
+
90
+
If you are encountering livesite issues or difficulties in implementing new policies that may be due to problems in Azure Policy itself, open a support ticket at [**Azure Customer Support**](https://azure.microsoft.com/support/create-ticket/). If you want to submit an idea for consideration, add an idea or upvote an existing idea at [**Azure Governance User Voice**](https://feedback.azure.com/forums/915958-azure-governance).
53
91
54
92
## Known Issues
55
93
56
-
Azure Policy operates at a level above other Azure services by applying policy rules against PUT requests and GET responses of resource types going between Azure Resource Manager and the owning resource provider (RP). In a few cases, the behavior of a given RP is unexpected or incompatible in some way with Azure Policy. The Azure Policy team works with the RP teams to close these gaps as soon as possible after they are discovered. Issues of this nature will be listed here until closed. To get something added to this list that isn't already reported in [**Issues**](https://github.com/Azure/azure-policy/issues), open a [**New issue**](https://github.com/Azure/azure-policy/issues/new/choose).
94
+
Azure Policy operates at a level above other Azure services by applying policy rules against PUT requests and GET responses of resource types going between Azure Resource Manager and the owning resource provider (RP). In a few cases, the behavior of a given RP is unexpected or incompatible in some way with Azure Policy. The Azure Policy team works with the RP teams to close these gaps as soon as possible after they are discovered. Issues of this nature will be listed here until closed.
57
95
58
-
All cases of known resource types with anomalous policy behavior are listed here. Currently there is no way to make these resource types invisible at policy authoring time, so writing policies that attempt to manage these resource types cannot be prevented, despite the fact that the results of such policies will be either incomplete or incorrect.
96
+
All cases of known resource types with anomalous policy behavior are listed here. Currently there is no way to make these resource types invisible at policy authoring time, so writing policies that attempt to manage these resource types cannot be prevented, despite the fact that the results of such policies may be either incomplete or incorrect.
59
97
60
98
### Resource Type query results incomplete/missing
61
99
62
-
In some cases, certain RPs may return incomplete or otherwise limited or missing information about resources of a given type. The Azure Policy engine is unable to determine the compliance of any resources of such a type. Here are the known resource types with this problem.
100
+
In some cases, certain RPs may return incomplete or otherwise limited or missing information about resources of a given type. The Azure Policy engine is unable to determine the compliance of any resources of such a type. Below are listed the known resource types exhibiting this problem.
Currently, there is no plan to change this behavior. If this scenario is important to you, please open a support ticket with the Web team.
105
+
Currently, there is no plan to change this behavior for the above Microsoft.Web resource types. If this scenario is important to you, please [open a support ticket](https://azure.microsoft.com/support/create-ticket/) with the Web team.
The potential for fixing these resource types is still under investigation.
68
111
69
112
### Resource Type not correctly published by resource provider
70
113
71
114
In some cases, a resource provider may implement a resource type, but not correctly publish it to the Azure Resource Manager. The result of this is that Azure Policy is unable to discover the type in order to determine compliance. In some cases, this still allows deny policies to work, but compliance results will usually be incorrect. These resource types exhibit this behavior:
72
115
73
-
- Microsoft.EventHub/namespaces/networkRuleSet
74
-
- Microsoft.ServiceBus/namespaces/networkRuleSet
75
116
- Microsoft.Storage/storageAccounts/blobServices
76
117
77
-
In many of these cases the unpublished resource type is actually a subtype of a published type, which causes aliases to refer to a parent type instead of the unpublished type. Evaluation of such policies fails, causing the policy to never apply to any resource. Here are the known resource types with this problem:
118
+
These resource types previously exhibited this behavior, but are now removed:
119
+
120
+
- Microsoft.EventHub/namespaces/networkRuleSet (replaced by Microsoft.EventHub/namespaces/networkruleset**s**)
121
+
- Microsoft.ServiceBus/namespaces/networkRuleSet (replaced by Microsoft.ServiceBus/namespaces/networkruleset**s**)
122
+
123
+
In some cases the unpublished resource type is actually a subtype of a published type, which causes aliases to refer to a parent type instead of the unpublished type. Evaluation of such policies fails, causing the policy to never apply to any resource. Here are the known resource types with this problem:
### Resource management that bypasses Azure Resource Manager
87
136
88
-
Resource providers are free to implement their own resource management operations outside of Azure Resource Manager ("dataplane" operations). In almost every Azure resource type, the distinction between resource management and dataplane operations is clear and the resource provider only implements resource management one way. Occasionally, a resource provider may choose to implement a type that can be managed both ways. In this case, Azure Policy controls the standard Azure Resource Manager API normally, but operations on the direct resource provider API to create, modify and delete resources of that type bypass Azure Resource Manager so they are invisible to Azure Policy. Since policy enforcement is incomplete, we recommend that customers do not implement policies targeting such a resource type. Currently there is one such known resource type:
137
+
Resource providers are free to implement their own resource management operations outside of Azure Resource Manager ("dataplane" operations). In almost every Azure resource type, the distinction between resource management and dataplane operations is clear and the resource provider only implements resource management one way. Occasionally, a resource provider may choose to implement a type that can be managed both ways. In this case, Azure Policy controls the standard Azure Resource Manager API normally, but operations on the direct resource provider API to create, modify and delete resources of that type bypass Azure Resource Manager so they are invisible to Azure Policy. Since policy enforcement is incomplete, we recommend that customers do not implement policies targeting such a resource type. This is the list of known such resource types:
The storage team is working on implementing Azure Policy on its dataplane operations to address this scenario. This is expected to first be available later this year.
93
142
143
+
- Microsoft.Sql/firewallRules
144
+
145
+
Firewall rules can be created/deleted/modified via T-SQL commands, which bypasses Azure Policy. There is currently no plan to address this.
146
+
94
147
### Nonstandard creation pattern
95
148
96
-
In a few instances, the creation pattern of a resource type doesn't follow normal REST patterns. In these cases, deny policies may not work or may only work for some properties. For example, certain resource types may PUT only a subset of the properties of the resource type to create the entire resource. With such types the resource could be created with a non-compliant value even though a deny policy exists to prevent it. A similar result may occur if a set of resource types can be created using a collection PUT. Known resource types that exhibit this behavior:
149
+
In a few instances, the creation pattern of a resource type doesn't follow normal REST patterns. In these cases, deny policies may not work or may only work for some properties. For example, certain resource types may PUT only a subset of the properties of the resource type to create the entire resource. With such types the resource could be created with a non-compliant value even though a deny policy exists to prevent it. A similar result may occur if a set of resource types can be created using a collection PUT. Known resource types that exhibit this class of behavior:
97
150
98
151
- Microsoft.Sql/servers/firewallRules
99
152
100
-
The SQL team is working with the Azure Resource Manager team on changes that will implement firewall rule creation using a standard PUT method. This is expected to be available later this year.
153
+
There is currently no plan to change this behavior. If this scenario is important to you, please [open a support ticket](https://azure.microsoft.com/support/create-ticket/) with the Azure SQL team.
101
154
102
155
*This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.*
0 commit comments