How to use VM imageID's in Azure Policy? - azure

Question

Azure has a number of built-in VM agent related policies. E.g. for installing the dependency agent, log analytics agent or the new Azure Monitoring Agent via a deployifnotexists effect.
Examples are:
Configure Linux machines to run Azure Monitor Agent and associate them to a Data Collection Rule
Configure Windows machines to run Azure Monitor Agent and associate them to a Data Collection Rule
Since we are only using CIS images from the marketplace our VM's are ignored in the policy evaluation.
Both these initatives contain a parameter for additional virtual machine image ID's. It accepts an array of image ID's something like: listOfWindowsImageIdToInclude or listOfLinuxImageIdToInclude.
However when I inspect the properties of my VM (ImageReference) the property ID is always empty:
cis image
windows image
If I query the marketplace it shows something like this:
cis images
I already included those Ids in the intiative parameter but without success.
All these built-in policies evaluate a custom image ID as follows:
"anyOf": [
{
"field": "Microsoft.Compute/imageId",
"in": "[parameters('listOfLinuxImageIdToInclude')]"
},
But like I said the image ID of these marketplace images is empty...

Answer 1

Following this documentation (Apply policies to Windows VMs with Azure Resource Manager and Apply policies to Linux VMs with Azure Resource Manager)
Could this policy be:
{
"if": {
"allOf": [
{
"field": "type",
"in": [
"Microsoft.Compute/virtualMachines",
"Microsoft.Compute/VirtualMachineScaleSets"
]
},
{
"not": {
"allOf": [
{
"field": "Microsoft.Compute/imagePublisher",
"in": [
"center-for-internet-security-inc"
]
},
{
"field": "Microsoft.Compute/imageOffer",
"in": [
"cis-ubuntu-linux-2004-11"
]
},
{
"field": "Microsoft.Compute/imageSku",
"in": [
"cis-ubuntu2004-11"
]
},
{
"field": "Microsoft.Compute/imageVersion",
"in": [
"latest"
]
}
]
}
}
]
},
"then": {
"effect": "deny"
}
}
If it doesn't work, please share your JSON policy
Hope this helps!