Storage files - validation rules - have they changed?

Hi marouf,

Azure's policies and validation rules can sometimes change, but as of the latest updates, there hasn't been a significant change to the requirement for tags on storage accounts, few things to consider:

Ensure that the policy requiring tags is correctly assigned to the right scope (e.g., subscription, resource group). If the policy isn't assigned correctly, it won't enforce the tag requirement.

Sometimes, policy evaluations can take a bit of time to reflect changes. Ensure that the policy is active and has had enough time to propagate.

check the policy definition to ensure it is set up to deny the creation of storage accounts without tags. You can review built-in policy definitions for Azure Storage.

Deleting a management group might not immediately affect the policies applied to resources. Ensure that the policy is not inherited from a higher-level management group.

Check the compliance state of your resources in the Azure Policy section. This can give you insights into whether the policy is being enforced correctly.

For more information:

https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure?tabs=azure-portal

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members. 

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be glad to assist you.

Hello,

Thanks for your help. Please accept my apologies.

I followed the steps again in Lab 01, as I am preparing for AZ 104. The mistake I was doing was "require tag for resource groups' rather than 'require tag for resources'. So, it was validating this without the tags. Now, it's fine - it doesn't validate the storage account because the policy for request is 'deny' for resources.

Ok, if I define the same policy twice, will that make an issue? For instance, if I define 'request a tag for resources' 2 times. Is this considered as one? What happens if this is done?

Thanks

Hi marouf,

Good to see that you figured out the issue with the policy scope.

Regarding defining the same policy twice, Azure Policy handles duplicate definitions in a specific way

If you assign the same policy definition to the same scope multiple times, Azure Policy will treat each assignment separately. This means that each assignment will be evaluated independently, and the policy effects will be applied as defined.

If you create duplicate policy definitions (i.e., two policies with the same rules and parameters but different names), Azure Policy will treat them as separate policies. Each policy will be evaluated independently, and both will enforce their rules.

If the policies have conflicting rules or effects, Azure Policy will evaluate them based on the order of assignment and the specific conditions defined in each policy. This can lead to unexpected behavior if not managed carefully.

In general, it's best to avoid duplicating policy definitions or assignments unless there is a specific need for it. If you need to enforce the same rule across multiple scopes, consider using policy initiatives, which allow you to group multiple policies together and manage them as a single unit.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members. 

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be glad to assist you.