What happens to existing resource if it violates Azure policy? - azure

Question

I have question with respect to resource violating Azure Policy. Suppose in my subscription I have one VM in UK west and another VM in UK South. IF I create policy to restrict VM to only UK south , what happens to the VM in UK West? Does it becomes non functional or will be forced tp move to UK South or just reported as non compliant? Also what will happen to new requests for UK west , will those get denied?

Answer 1

If you assign a policy while existing resources are present nothing should happen to them by default, if you are using built in policy's.
If you're assigning a policy from the portal you should see the following statement:
By default, this assignment will only take effect on newly created resources. Existing resources can be updated via a remediation task after the policy is assigned. For deployIfNotExists policies, the remediation task will deploy the specified template. For modify policies, the remediation task will edit tags on the existing resources.
In short the existing VMs in UK West should be marked as non-compliant and future deployments outside of UK south will be blocked by the policy.
You can see this in the built in "Allow Locations" policy:
{
"properties": {
"displayName": "Allowed locations",
"policyType": "BuiltIn",
"mode": "Indexed",
"description": "This policy enables you to restrict the locations your organization can specify when deploying resources. Use to enforce your geo-compliance requirements. Excludes resource groups, Microsoft.AzureActiveDirectory/b2cDirectories, and resources that use the 'global' region.",
"metadata": {
"version": "1.0.0",
"category": "General"
},
"parameters": {
"listOfAllowedLocations": {
"type": "Array",
"metadata": {
"description": "The list of locations that can be specified when deploying resources.",
"strongType": "location",
"displayName": "Allowed locations"
}
}
},
"policyRule": {
"if": {
"allOf": [
{
"field": "location",
"notIn": "[parameters('listOfAllowedLocations')]"
},
{
"field": "location",
"notEquals": "global"
},
{
"field": "type",
"notEquals": "Microsoft.AzureActiveDirectory/b2cDirectories"
}
]
},
"then": {
"effect": "deny"
}
}
},
"id": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c",
"type": "Microsoft.Authorization/policyDefinitions",
"name": "e56962a6-4747-49cd-b67b-bf8b01975c4c"
}
It simply performs a Deny if the conditions are not met. Of course if you are using custom policys it's possible other actions might also be performed.