Azure policy rule with condition of contains from a params array

Hi DanaR
I have reached out to you in a private message.
Just to clarify, Since the specific IP address will fall within the provided CIDR range (e.g., /16, /32, /64), you should define the address range in the policy instead of the individual IP address to ensure the policy functions correctly.

Example: 1.2.3.4 will fall under 1.2.3.0/16

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Network/networkSecurityGroups/securityRules"
        },
        {
          "field": "Microsoft.Network/networkSecurityGroups/securityRules/direction",
          "equals": "Inbound"
        },
        {
          "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix",
          "in": [
            "1.2.3.0/32",
            "5.6.7.0/32",
            "10.0.0.0/32"
          ]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Thankyou

Dear DanaR,

Thank you for your question on the Q&A portal! I appreciate you taking the time to reach out and share your scenario.

Regarding your question about creating an Azure Policy rule that uses the contains function with an array parameter—yes, it is possible. You can define a parameter of type array in your policy and then use the contains function to check if a specific value (like an IP address) exists within that array. Here’s a simplified example of how you might structure it in your policy rule:

"policyRule": {  
  "if": {  
    "allOf": [  
      {  
        "field": "type",  
        "equals": "Microsoft.Network/networkSecurityGroups/securityRules"  
      },  
      {  
        "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix",  
        "in": "[parameters('blockedIPs')]"  
      }  
    ]  
  },  
  "then": {  
    "effect": "deny"  
  }  
}  

In this example, blockedIPs would be your array parameter containing IPs like ["1.1.1.1", "2.2.22"].

For more details, you might find these Microsoft articles helpful:

Azure Policy definition structure

Let me know if you need further clarification.

Best regards,

Alex

P.S. If my answer helped you, please Accept my answer.