Azure Policy governance pack

DTM ships a governance pack for Azure Policy: 8 policy definitions, 1 initiative that groups them, and a subscription-scope deployment template. The pack (deploy/azure-policy/) is available from support. Use it to check, continuously and from the Azure Policy compliance view you already use, that your DTM estate stays deployed the way you intended.

Safe by default

The pack is built to observe, not to interfere:

Every control defaults to Audit (except encryption-at-host, which ships Disabled, opt-in). Effects are limited to Audit, Deny, and Disabled, and four controls are Audit/Disabled only. No policy in the pack has a deployIfNotExists or modify effect, so nothing in it ever deploys, changes, or appends anything in your subscription.
Assignment creation defaults to off in the deployment template, and when you do create the assignment it defaults to DoNotEnforce. Nothing blocks a deployment until an operator deliberately turns enforcement on.

The 8 controls

Control	Checks that	Effects
DNS adoption	VNets use DTM nodes as their DNS servers (parameter `dtmDnsServerIps`)	Audit/Disabled only
Managed identity	DTM VMs use a managed identity	Audit/Disabled only
No public IP	DTM VMs have no public IP address	Audit/Deny/Disabled (audits by default)
Approved regions	DTM resources are in your approved regions	Audit/Deny/Disabled
Data disk caching	DTM data disk host caching is set to None	Audit/Deny/Disabled
Required tags	Required tags are present on DTM resources	Audit/Deny/Disabled
Management ports	NSGs do not expose ports 22, 8080, or 8443 to the internet	Audit/Disabled only
Encryption at host	Encryption-at-host is enabled	Audit/Disabled only (default Disabled, opt-in)

The DNS-adoption control is Audit/Disabled by design: denying a VNet its DNS settings could break name resolution for workloads mid-change, so it can report drift but never block it.

Scoping

The pack matches DTM resources by tag, with a default tag name of dtm, so it evaluates only the resources you have tagged as part of the DTM estate. The DNS-adoption control evaluates only VNets tagged dtm-dns=enforced (tag name and value are assignment parameters); tag each VNet as you roll DNS governance out. An untagged VNet is never evaluated, so it produces no findings regardless of its DNS settings: absence of findings is not evidence of adoption.

Deploy the pack

Deploy everything in one shot at subscription scope:

az deployment sub create \
  --location westeurope \
  --template-file deploy.json

Or pass parameters, for example your node IPs and approved regions:

az deployment sub create \
  --location westeurope \
  --template-file deploy.json \
  --parameters dtmDnsServerIps='["10.10.0.4","10.10.0.5","10.10.0.6"]' \
               allowedLocations='["westeurope","northeurope"]'

If you prefer, create the policy definitions individually from their JSON files instead of using the template; each definition stands alone.

Assign and enforce

Assign the initiative at subscription or management-group scope. Start in DoNotEnforce so you get compliance data without any chance of blocking a deployment:

az policy assignment create \
  --name dtm-governance \
  --policy-set-definition dtm-governance \
  --scope /subscriptions/00000000-0000-0000-0000-000000000000 \
  --enforcement-mode DoNotEnforce \
  --params '{
    "dtmDnsServerIps": { "value": ["10.10.0.4", "10.10.0.5"] },
    "allowedLocations": { "value": ["westeurope", "northeurope"] }
  }'

dtmDnsServerIps and allowedLocations are the only initiative parameters without defaults, so the assignment is rejected if you omit them. Every other parameter (tag names, management ports, and the per-control effects) falls back to its shipped default.

Compliance results appear in the Azure Policy portal blade like any built-in policy. Once you have reviewed a full compliance cycle and the findings look right, switch individual controls to Deny (where supported) and set the assignment’s enforcement mode to Default.

Privacy policyTerms of use