How to restrict public IP to all Azure DevTest Labs by policy

Question

We currently have the built in policy to disallow public ips scoped at the management group level which works when creating regular VMs in our environment. This policy does not block the creation of VMs with public IPs in DevTest labs even though they are created within the management group that has a policy blocking IPs. Has anyone ran into this?

Answer 1

There are built-in policies working on Microsoft.Network/networkInterfaces level to block NICs have public IPs but VMs in DevTest Labs have different type of resources than regular VMs.

For example, you can restrict public IP on VMs in Azure DevTest Labs by policy like this:

    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.DevTestLab/labs/virtualmachines"
          },
          {
            "not": {
              "field": "Microsoft.DevTestLab/labs/virtualmachines/disallowPublicIpAddress",
              "equals": true
            }
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  },