Azure Governance

Azure Governance is a portfolio of platform capabilities that helps customers address the need for control at scale without sacrificing developer agility. This includes services like Azure Policy, Azure Blueprints, Azure Resource Graph & Management Groups.

More details about the services are available in the Azure Governance documentation. If you have a technical issue, please open a post on the developer forums through Stack Overflow.

Products that we listen to in this space include: Azure Policy, Azure Blueprints, Azure Resource Graph, Azure Subscriptions and Azure Management Groups

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Azure Policy - Add friendly / custom error messages for deny policies

    When someone tries to create a resource that is blocked by policy, they get an ugly JSON output that doesn't really provide any details as to why they failed validation. The best that they can get (if they find it) is the name of the policy or initiative. It would be much nicer to be able to enter and error description when defining the policies / initiatives and provide links to internal KB articles for how they should remedy the problem.

    23 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    planned  ·  0 comments  ·  Azure Policy  ·  Flag idea as inappropriate…  ·  Admin →
  2. Allow Deny Assignments for Existing Resource Groups

    Allow Deny Assignments for Existing Resource Groups - Currently deny assignments with Blueprints is only allowed for new resources. It would be really helpful if the same feature can be applied to existing resource groups.

    22 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    3 comments  ·  Azure Blueprints  ·  Flag idea as inappropriate…  ·  Admin →
  3. Allow more rich symbols while using Match in Policy definition

    I am using Management groups and wanted to roll out multiple naming policy.
    I have various clients hence thought of a consistent manner to support and organize Resource groups/Resources in a consistent way. i.e <Cleint>-<Prod/Dev>-RGP-<Name>.
    So it would sort out like
    CL1-PROD-RGP-MyFirstRG
    CL1-PROD-RGP-AnotherOne
    CL2-DEV-RGP-NNNN
    CL3-PROD-RGP-aaa

    but unfortunately found that match could not support a symbol which would represent letter or number in same symbol. Details can be seen in the closed feedback thread on the following page.

    https://docs.microsoft.com/en-us/azure/azure-policy/scripts/allow-multiple-name-patterns

    It would really help enforce a consistent naming convention.
    Not sure how fast help can arrive from MS?

    20 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    3 comments  ·  Azure Policy  ·  Flag idea as inappropriate…  ·  Admin →
  4. Azure Policy Effect - DenyIfNotExist

    Scenario: If you want to prevent the modification (or creation) of an object unless it has a required property present. That way, instead of just auditing if the object is in compliance (by checking for the presence of the property), you're preventing the object from drifting out of compliance by the denyIfNotExists effect, and stopping the update operation before it can modify the object.

    19 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Azure Policy  ·  Flag idea as inappropriate…  ·  Admin →
  5. Support querying of deleted resources via the Azure Resource Graph

    It would be useful if you could query for deleted resources via the ARG. For example:

    where deleted == true

    18 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    2 comments  ·  Azure Resource Graph  ·  Flag idea as inappropriate…  ·  Admin →
  6. Resource Graph type for Management Groups

    Add Management Groups as a resource type for Resource Graph. This would allow for writing queries that target subscriptions that are in a specific Management Group. This is extremely helpful for enterprises that have a lot of subscriptions that are being organized with Management Groups.

    17 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    planned  ·  0 comments  ·  Azure Resource Graph  ·  Flag idea as inappropriate…  ·  Admin →
  7. Have Azure Blueprints that are published at the Management Group level visible at the Subscription Level

    In Azure Blueprints definitions, as a user, if I select an Azure Subscription I want to see any Blueprints that have been assigned at the Management Group levels above the subscription as well as the Subscription Blueprint definitions.

    This would provide a better view of the Blueprints that are available to be deployed in that Subscription.

    17 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Azure Blueprints  ·  Flag idea as inappropriate…  ·  Admin →
  8. See ARM templates in all blueprint published versions

    Right now, to see what an older version of a blueprint does, we rely solely on the comments created when the version is published. This set really high standards for those comments.
    It would be a great feature, if it was possible to see the ARM templates deployed in previous published versions, too determine what was actually deployed in that version.

    16 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Azure Blueprints  ·  Flag idea as inappropriate…  ·  Admin →
  9. Create AAD Groups

    Creating groups idempotently would be great as then you could have standardised group names and use those in the Role Assignments.

    15 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Azure Blueprints  ·  Flag idea as inappropriate…  ·  Admin →
  10. compliance results for policy with "AuditIfNotExists" on subscription are not written to activitylog

    Currently we cannot alert for the “AuditIfNotExists” on subscription level policy showing non-complaint. For AuditIfNotExists policy definition targeting on subscription level, there will not be scans triggered by PUT/PATCH, thus no activity logs due to that.

    please have this built in, so we can query activity log for any policy not compliant

    12 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Azure Policy  ·  Flag idea as inappropriate…  ·  Admin →
  11. Azure Policy initiatives - Remediate multiple policies within an initiative

    When assigning a new initiative the remediation task only evaluates a single policy rather than allowing multiple policies to be selected for remediation.

    The process at the moment is to remediate just one policy then the user must create multiple subsequent remediation tasks to evaluate the others one by one.

    What would be useful is the ability to ‘select all’ and/or select multiple policies to remediate as a single action while assigning a new initiative.

    12 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    2 comments  ·  Azure Policy  ·  Flag idea as inappropriate…  ·  Admin →
  12. Deploy Custom RBAC Role via Azure Blueprint

    It would be a nice feature to add Custom RBAC Role as a Azure Blueprint Artifact. Deploying custom RBAC roles currently is painful and packaging them in an Azure Blueprint would allow for a less painful and much more standarized way of deploying custom RBAC roles.

    12 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    2 comments  ·  Azure Blueprints  ·  Flag idea as inappropriate…  ·  Admin →
  13. Support blueprint parameters in the UI

    A feature where it would be possible to create "blueprint wide paramters" that can be set during the assignment would be really valuable . We create a lot of blueprints where the same parameter value is used multiple times in multiple ARM templates in a single blueprint.
    This is often used in naming conventions, to set a specific suffix or prefix during assignment.

    12 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Azure Blueprints  ·  Flag idea as inappropriate…  ·  Admin →
  14. Azure Policy template for all options available in the Azure portal

    Allow Azure Policies to be created by having a "generate policy" option available next to each option available in the Azure portal. Every configuration item should have the ability to be created as a policy and making this easy through the portal for each Azure component and option would make it easy to manage configuration compliance.

    11 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Azure Policy  ·  Flag idea as inappropriate…  ·  Admin →

    Thanks for the valid suggestion. Your feedback is now open for the user community to upvote & comment on. This allows us to effectively prioritize your request against our existing backlog and also gives us insight into the potential impact of implementing the suggested feature.

  15. Quota limit per Resource Group

    There is a quota limit only per the subscription but it would be helpful if you will give an option also to configure quota limit per resource group.

    Example, we have a single subscription with some quota limit but I created a resource group for developers and testing team.

    Developer's resource group should be 50 instances and Testing resource group should be 60 instances.

    The current feature is not having that option to control my resource group usages.

    11 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Flag idea as inappropriate…  ·  Admin →
  16. Enable append policies to leverage a specific service principal identity

    Enable append policies to leverage a specific service principal identity when for applying configuration on behalf of the user who made the request.

    Scenario: we require diagnostic logs for any Azure resource to send to a single Sentinel workspace in a remote subscription. The general population does not have visibility to this space. When testing the Logic Apps append diagnostic logs to Log Analytics policy, the configuration fails to set when the resource is deployed by a development team member and succeeds when one of our Azure Admins deploys the resource.
    This is due to the managed identity that is…

    10 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Azure Policy  ·  Flag idea as inappropriate…  ·  Admin →
  17. Azure Storage File share available in resource graph

    Right now, the file share information of a storage account is not available in the resource graph.
    ie. it would allow to list the file share of a subscription, compute the global storage size or simulate the pricing.

    10 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Azure Resource Graph  ·  Flag idea as inappropriate…  ·  Admin →
  18. Python SDK support

    Create a Python SDK for Azure Blueprints. Blueprints are an amazing service, and allow Azure to be directly competitive with AWS's services like Landing Zone, Control Tower, and their Account Vending Machine. Unfortunately, the lack of Python support will prevent many of the customers who are not traditional Microsoft shops from adopting this service.

    Please develop a Python, and Node, SDK!

    Thank you

    10 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Azure Blueprints  ·  Flag idea as inappropriate…  ·  Admin →
  19. Allow customer to use Terraform or ARM Templates with Blueprints

    Most of my customers are using Terraform to deploy resources to Azure. Extend Blueprints to accept a .tf script as an artifact.

    10 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Azure Blueprints  ·  Flag idea as inappropriate…  ·  Admin →
  20. PIM add support in the Graph API to query Azure resources roles audit logs.

    We can query Azure AD roles in PIM for our conformity report but have to log-in to the portal manually for PIM roles on Azure Resource.

    Works for PowerBI Admin Roles but not for "Contributor" role in Subscription X.

    10 votes
    Sign in
    (thinking…)
    Sign in with: Microsoft
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Azure Resource Graph  ·  Flag idea as inappropriate…  ·  Admin →
  • Don't see your idea?

Feedback and Knowledge Base