Chapter 2 of 6
Architecture at a glance#
The repository deploys a subscription-scope policy initiative and assigns it to the exact approved scope. The initiative includes five guardrail areas:
| Guardrail | Policy path | First state | Promotion path |
|---|---|---|---|
| Disable local authentication | Built-in key-access policy | Audit | Deny after Entra access is ready |
| Restrict network access | Built-in network policy | Audit | Deny after private access is ready |
| Restrict deployment SKU | Custom policy definition | Audit | Deny after data-residency review |
| Content-filter minimums | Preview built-in, one reference per harm category | Audit | Stays Audit until the built-in supports blocking |
| Diagnostic logs | Built-in Log Analytics policy | AuditIfNotExists | DeployIfNotExists after role approval |
guardrail-decisions.json is the module's decision record. It names the target scope, owners, effects, Log Analytics destination, disallowed SKUs, content-filter minimums, and restore reference.
The assignment starts with enforcementMode = DoNotEnforce. That lets the owner review current Policy Insights data before a blocking effect or remediation effect is enabled.
Design choices and tradeoffs#
| Decision | Chosen approach | Benefits | Costs and limitations |
|---|---|---|---|
| Assignment rollout | One assignment staged in DoNotEnforce, then promoted in place | Keeps compliance history and avoids a second assignment | The team must wait for current policy states before promotion |
| Model approval | Excluded from this module | Keeps model allow-list ownership with Session 03 | This module cannot decide which models are approved |
| Network and local auth | Built-in Audit or Deny policies | Uses Microsoft-maintained aliases and effects | Deny can block tools that still need keys or public endpoints |
| Data residency | Custom SKU policy | Makes the residency choice explicit in source control | The SKU list must be reviewed when Foundry adds deployment types |
| Diagnostic logs | Audit first, then DINE with a managed identity | Shows missing logs before remediation writes settings | The assignment identity needs the approved Log Analytics role path |
Architecture guidance#
Use Built-in policy definitions for Foundry Tools for the current Microsoft-maintained policy names and effects.
Use Details of the policy assignment structure for assignment scope, parameters, identity, non-compliance messages, and enforcementMode.
Use Bicep What-If to preview the initiative and assignment before deployment.