Azure Policy: allowed regions, tags, remediation

1Break it: a deployment to the wrong region

A colleague copies a script written for a US project:

az network nsg create --resource-group rg-saat-l54 --name nsg-us --location eastus

You’ll get an error like this:

(RequestDisallowedByPolicy) Resource 'nsg-us' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Allowed locations (L54)","id":"/subscriptions/.../resourceGroups/rg-saat-l54/providers/Microsoft.Authorization/policyAssignments/allowed-loc-l54"},"policyDefinition":{"name":"Allowed locations","id":"/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c"}}]'.
Code: RequestDisallowedByPolicy

Read it from the inside out: the assignment name tells you which rule and at which scope, the definition tells you what it checks. You don’t need to guess or open a ticket with the cloud team to find out why.

Fix it: deploy to an allowed region, and check what the assignment allows if you’re unsure:

az policy assignment show --name allowed-loc-l54 --scope $rgId --query parameters
az network nsg create --resource-group rg-saat-l54 --name nsg-us --location southindia -o none

The NSG is created in South India and inherits the costcenter tag.

If a resource truly must live elsewhere, the right path is an exemption with a reason and an expiry date (az policy exemption create), not deleting the assignment.

2Break it: the old resource is still wrong

nsg-old was created before the policies. Force a compliance scan and list what isn’t compliant (the scan takes a few minutes):

az policy state trigger-scan --resource-group rg-saat-l54
az policy state list --resource-group rg-saat-l54 --filter "complianceState eq 'NonCompliant'" --query "[].{resource:resourceId, assignment:policyAssignmentName}" -o table

You should see something like this:

Resource                                                                                   Assignment
---------------------------------------------------------------------------------------  --------------
/subscriptions/.../resourceGroups/rg-saat-l54/providers/Microsoft.Network/networkSecurityGroups/nsg-old  inherit-cc-l54

The policy only acts on new or updated resources. nsg-old has been sitting there without a tag, and the cost report puts its spending under “untagged”.

Fix it: run a remediation task for the Modify assignment, then check the result:

az policy remediation create --resource-group rg-saat-l54 --name fix-cc-tags --policy-assignment inherit-cc-l54 -o none
az policy remediation show --resource-group rg-saat-l54 --name fix-cc-tags --query "{state:provisioningState, ok:deploymentStatus.successfulDeployments, failed:deploymentStatus.failedDeployments}" -o table
az network nsg show --resource-group rg-saat-l54 --name nsg-old --query tags

After a few minutes you should see something like this:

State      Ok    Failed
---------  ----  --------
Succeeded  1     0
{
  "costcenter": "cc-1001"
}

The remediation used the assignment’s managed identity and its Contributor role on the group. Without that role, remediation fails with an authorization error, which is the most common reason remediation tasks show failed deployments.

3Clean up

Delete the assignments, then the resource group:

az policy assignment delete --name allowed-loc-l54 --scope $rgId
az policy assignment delete --name inherit-cc-l54 --scope $rgId
az group delete --name rg-saat-l54 --yes

✅ Checkpoint: You read a policy denial, fixed a deployment, remediated an old resource, and removed everything from this lesson.