Chapter 3 of 6
Confirm these prerequisites:
- The approved target scope is the subscription that contains the Foundry and Azure AI services resources governed by this module.
- The deployment operator has time-bound Resource Policy Contributor on the subscription where the initiative and assignment are deployed.
- The operator can run subscription-scope Bicep what-if.
- A Log Analytics workspace exists, and its owner can approve the assignment identity's access before diagnostic remediation moves to
DeployIfNotExists. - The platform policy owner, compliance review owner, data-residency owner, and promotion authority can review current policy states together.
- The team knows which controls are owned by the related sessions named in the boundaries.
Implementation files#
| Type | File | Consumer |
|---|---|---|
| Deployment | artifacts/policy/definitions/restrict-foundry-deployment-sku.json | The subscription policy deployment pipeline |
| Record | artifacts/policy/guardrail-decisions.json | The policy deployment pipeline, preflight scripts, and compliance review owner |
| Deployment | artifacts/policy/initiative.bicep | The subscription policy deployment pipeline |
| Deployment | artifacts/policy/assignment.bicep | The subscription policy deployment pipeline |
| Deployment | artifacts/environments/initiative.bicepparam | The subscription policy deployment pipeline |
| Deployment | artifacts/environments/assignment.bicepparam | The subscription policy deployment pipeline |
Resolve every __REQUIRED_*__ value before running a live preview. Keep tenant IDs, subscription IDs, policy-state exports, resource IDs beyond the approved scope, and customer data in customer systems.