How to block a creation of new public ips in azure

Question

I am trying to stop users that arent global admins from creating new public ips and assigning them to vms or nics. But I dont want to affect the existing assigned ips. I think the best way to do it is with a policy.

I found this policy that block public ips in all resource groups that arent specified but I dont know if it will affect the existing ones

"policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/networkInterfaces"
          },
          {
            "field": "Microsoft.Network/networkInterfaces/ipconfigurations[*].publicIpAddress.id",
            "exists": true
          },
          {
            "value": "[resourceGroup().name]",
            "notEquals": "resource-group-name"
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }

• A related article: https://blog.nillsf.com/index.php/2019/11/02/using-azure-policy-to-deny-public-ips-on-specific-vnets/

Someone know if it will affect the existing or know a better way to write a policy that can help me

Answer 1

The policy you mentioned will block Public IPs in all resource groups that are not specified in Policy, but it will not affect the existing ones.

However, it will block the creation of new public IPs and the assignment to Network resources in the resource groups that are not specified. If you want to block the creation of new public IPs but allow the assignment of existing Public IP, you can use the below policy.

    {
      "mode": "All",
      "policyRule": {
        "if": {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Network/publicIPAddresses"
            },
            {
              "field": "Microsoft.Network/publicIPAddresses/ipConfiguration.id",
              "exists": false
            },
            {
              "value": "[resourceGroup().name]",
              "notEquals": "v-venkat-mindtree"
            }
          ]
        },
        "then": {
          "effect": "deny"
        }
      },
      "parameters": {}
    }

Output:

Public IP creation with other Resource Group

Public IP creation with specified Resource Group

Successfully assigned existing Public IP to Network Interface.