Analyze/catalog/frameworks/alz.json
|
{
"key": "ALZ", "order": 4, "name": "Azure landing zones policy assignments", "shortName": "ALZ policies", "version": "ALZ library platform/alz/2026.08.1", "publisher": "Microsoft", "type": "reference implementation", "url": "https://azure.github.io/Azure-Landing-Zones/policy/policyassignments/", "download": "https://github.com/Azure/Azure-Landing-Zones-Library/releases/tag/platform/alz/2026.08.1", "retrieved": "2026-09-20", "mapping": "native", "note": "Each test checks a setting that a policy assignment enforces or audits. An assignment of a single policy is fully assessed; an initiative only when every policy in it has a test. Assignments without a test apply to management group archetypes or need data outside the subscription.", "controls": { "Audit-AppGW-WAF": {"title":"Web Application Firewall (WAF) should be enabled for Application Gateway","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Audit-AppGW-WAF.alz_policy_assignment.json","coverage":"full","tests":["AZ-NET-012"]}, "Audit-PeDnsZones": {"title":"Audit Private Link Private DNS Zone resources","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Audit-PeDnsZones.alz_policy_assignment.json","applicability":"manual"}, "Audit-ResourceRGLocation": {"title":"Resource Group and Resource locations should match","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Audit-ResourceRGLocation.alz_policy_assignment.json","coverage":"full","tests":["AZ-GOV-013"]}, "Audit-TrustedLaunch": {"title":"Audit virtual machines for Trusted Launch support","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Audit-TrustedLaunch.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-003"]}, "Audit-UnusedResources": {"title":"Unused resources driving cost should be avoided","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Audit-UnusedResources.alz_policy_assignment.json","coverage":"partial","tests":["AZ-GOV-006","AZ-GOV-007"]}, "Audit-ZoneResiliency": {"title":"Resources should be Zone Resilient","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Audit-ZoneResiliency.alz_policy_assignment.json","coverage":"partial","tests":["AZ-BCK-012"]}, "Deny-Classic-Resources": {"title":"Deny the deployment of classic resources","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-Classic-Resources.alz_policy_assignment.json","coverage":"full","tests":["AZ-GOV-008"]}, "Deny-HybridNetworking": {"title":"Deny the deployment of vWAN/ER/VPN gateway resources","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-HybridNetworking.alz_policy_assignment.json","applicability":"manual"}, "Deny-IP-forwarding": {"title":"Network interfaces should disable IP forwarding","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-IP-forwarding.alz_policy_assignment.json","coverage":"full","tests":["AZ-NET-009"]}, "Deny-MgmtPorts-Internet": {"title":"Management port access from the Internet should be blocked","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-MgmtPorts-Internet.alz_policy_assignment.json","coverage":"full","tests":["AZ-NET-001","AZ-NET-002"]}, "Deny-Priv-Esc-AKS": {"title":"Kubernetes clusters should not allow container privilege escalation","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-Priv-Esc-AKS.alz_policy_assignment.json","coverage":"full","tests":["AZ-AKS-004"]}, "Deny-Privileged-AKS": {"title":"Kubernetes cluster should not allow privileged containers","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-Privileged-AKS.alz_policy_assignment.json","coverage":"full","tests":["AZ-AKS-004"]}, "Deny-Public-Endpoints": {"title":"Public network access should be disabled for PaaS services","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-Public-Endpoints.alz_policy_assignment.json","coverage":"partial","tests":["AZ-ACR-003","AZ-AI-002","AZ-AI-005","AZ-APP-008","AZ-COS-002","AZ-DB-001","AZ-DBX-003","AZ-KV-003","AZ-PAAS-001","AZ-SQL-005","AZ-STG-006"]}, "Deny-Public-IP": {"title":"Deny the creation of public IP","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-Public-IP.alz_policy_assignment.json","coverage":"full","tests":["AZ-NET-008"]}, "Deny-Public-IP-On-NIC": {"title":"Deny network interfaces having a public IP associated","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-Public-IP-On-NIC.alz_policy_assignment.json","coverage":"full","tests":["AZ-NET-008"]}, "Deny-Storage-http": {"title":"Secure transfer to storage accounts should be enabled","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-Storage-http.alz_policy_assignment.json","coverage":"full","tests":["AZ-STG-001"]}, "Deny-Subnet-Without-Nsg": {"title":"Subnets should have a Network Security Group","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-Subnet-Without-Nsg.alz_policy_assignment.json","coverage":"full","tests":["AZ-NET-006"]}, "Deny-UnmanagedDisk": {"title":"Deny virtual machines and virtual machine scale sets that do not use managed disk","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deny-UnmanagedDisk.alz_policy_assignment.json","coverage":"full","tests":["AZ-VM-001"]}, "DenyAction-DeleteUAMIAMA": {"title":"Do not allow deletion of the User Assigned Managed Identity used by AMA","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/DenyAction-DeleteUAMIAMA.alz_policy_assignment.json","applicability":"manual"}, "Deploy-ASC-Monitoring": {"title":"Microsoft Cloud Security Benchmark","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-ASC-Monitoring.alz_policy_assignment.json","coverage":"partial","tests":["AZ-GOV-001"]}, "Deploy-AzActivity-Log": {"title":"Configure Azure Activity logs to stream to specified Log Analytics workspace","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-AzActivity-Log.alz_policy_assignment.json","coverage":"full","tests":["AZ-LOG-001"]}, "Deploy-AzSqlDb-Auditing": {"title":"Configure SQL servers to have auditing enabled to Log Analytics workspace","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-AzSqlDb-Auditing.alz_policy_assignment.json","coverage":"full","tests":["AZ-SQL-001"]}, "Deploy-Diag-LogsCat": {"title":"Enable category group resource logging for supported resources to Log Analytics","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-Diag-LogsCat.alz_policy_assignment.json","coverage":"partial","tests":["AZ-DBX-005","AZ-LOG-014","AZ-LOG-015"]}, "Deploy-GuestAttest": {"title":"Configure prerequisites to enable Guest Attestation on Trusted Launch enabled VMs","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-GuestAttest.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-003"]}, "Deploy-MCSB2-Monitoring": {"title":"Microsoft Cloud Security Benchmark v2","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-MCSB2-Monitoring.alz_policy_assignment.json","coverage":"partial","tests":["AZ-GOV-001"]}, "Deploy-MDEndpoints": {"title":"[Preview]: Deploy Microsoft Defender for Endpoint agent","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-MDEndpoints.alz_policy_assignment.json","coverage":"partial","tests":["AZ-DEF-014","AZ-VM-006"]}, "Deploy-MDEndpointsAMA": {"title":"Configure multiple Microsoft Defender for Endpoint integration settings with Microsoft Defender for Cloud","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-MDEndpointsAMA.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-006"]}, "Deploy-MDFC-Config-H224": {"title":"Deploy Microsoft Defender for Cloud configuration","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-MDFC-Config-H224.alz_policy_assignment.json","coverage":"partial","tests":["AZ-DEF-001","AZ-DEF-002","AZ-DEF-003","AZ-DEF-004","AZ-DEF-005","AZ-DEF-006","AZ-DEF-007","AZ-DEF-008","AZ-DEF-009","AZ-DEF-010","AZ-DEF-011","AZ-DEF-012","AZ-DEF-013","AZ-DEF-018"]}, "Deploy-MDFC-DefSQL-AMA": {"title":"Enable Defender for SQL on SQL VMs and Arc-enabled SQL Servers","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-MDFC-DefSQL-AMA.alz_policy_assignment.json","applicability":"manual"}, "Deploy-MDFC-OssDb": {"title":"Configure Advanced Threat Protection to be enabled on open-source relational databases","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-MDFC-OssDb.alz_policy_assignment.json","coverage":"partial","tests":["AZ-DEF-007"]}, "Deploy-MDFC-SqlAtp": {"title":"Configure Azure Defender to be enabled on SQL Servers and SQL Managed Instances","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-MDFC-SqlAtp.alz_policy_assignment.json","coverage":"partial","tests":["AZ-DEF-008"]}, "Deploy-Private-DNS-Zones": {"title":"Configure Azure PaaS services to use private DNS zones","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-Private-DNS-Zones.alz_policy_assignment.json","coverage":"partial","tests":["AZ-KV-004","AZ-PAAS-001","AZ-STG-008"]}, "Deploy-SQL-TDE": {"title":"Deploy TDE on SQL servers","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-SQL-TDE.alz_policy_assignment.json","coverage":"full","tests":["AZ-SQL-007"]}, "Deploy-SQL-Threat": {"title":"Deploy Threat Detection on SQL servers","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-SQL-Threat.alz_policy_assignment.json","coverage":"full","tests":["AZ-DEF-008"]}, "Deploy-SvcHealth-BuiltIn": {"title":"Configure subscriptions to enable service health alert monitoring rule","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-SvcHealth-BuiltIn.alz_policy_assignment.json","coverage":"full","tests":["AZ-LOG-013"]}, "Deploy-VM-Backup": {"title":"Configure backup on virtual machines without a given tag to a new recovery services vault with a default policy","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-VM-Backup.alz_policy_assignment.json","coverage":"full","tests":["AZ-VM-010"]}, "Deploy-VM-ChangeTrack": {"title":"Enable ChangeTracking and Inventory for virtual machines","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-VM-ChangeTrack.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-013"]}, "Deploy-VM-Monitoring": {"title":"Enable Azure Monitor for VMs","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-VM-Monitoring.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-008"]}, "Deploy-vmArc-ChangeTrack": {"title":"Enable ChangeTracking and Inventory for Arc-enabled virtual machines","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-vmArc-ChangeTrack.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-013"]}, "Deploy-vmHybr-Monitoring": {"title":"Enable Azure Monitor for Hybrid Virtual Machines","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-vmHybr-Monitoring.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-008"]}, "Deploy-VMSS-ChangeTrack": {"title":"Enable ChangeTracking and Inventory for virtual machine scale sets","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-VMSS-ChangeTrack.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-013"]}, "Deploy-VMSS-Monitoring": {"title":"Enable Azure Monitor for Virtual Machine Scale Sets","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Deploy-VMSS-Monitoring.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-008"]}, "Enable-AUM-CheckUpdates": {"title":"Configure periodic checking for missing system updates on azure virtual machines and Arc-enabled virtual machines.","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enable-AUM-CheckUpdates.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-005"]}, "Enable-DDoS-VNET": {"title":"Virtual networks should be protected by Azure DDoS Network Protection","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enable-DDoS-VNET.alz_policy_assignment.json","coverage":"full","tests":["AZ-NET-010"]}, "Enforce-ACSB": {"title":"Enforce Azure Compute Security Baseline compliance auditing","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-ACSB.alz_policy_assignment.json","coverage":"partial","tests":["AZ-DFA-004","AZ-VM-004","AZ-VM-007"]}, "Enforce-AKS-HTTPS": {"title":"Kubernetes clusters should be accessible only over HTTPS","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-AKS-HTTPS.alz_policy_assignment.json","applicability":"manual"}, "Enforce-ALDO-Services": {"title":"Audit resource types to Azure services supported in Azure Local disconnected operations","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-ALDO-Services.alz_policy_assignment.json","applicability":"manual"}, "Enforce-ALZ-Decomm": {"title":"Enforce ALZ Decommissioned Guardrails","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-ALZ-Decomm.alz_policy_assignment.json","applicability":"manual"}, "Enforce-ALZ-Sandbox": {"title":"Enforce ALZ Sandbox Guardrails","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-ALZ-Sandbox.alz_policy_assignment.json","applicability":"manual"}, "Enforce-ASR": {"title":"Enforce enhanced recovery and backup policies","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-ASR.alz_policy_assignment.json","coverage":"partial","tests":["AZ-BCK-001","AZ-BCK-002","AZ-BCK-003"]}, "Enforce-Encrypt-CMK0": {"title":"Enforce recommended guardrails for Customer Managed Keys","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-Encrypt-CMK0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-SQL-008","AZ-STG-021"]}, "Enforce-GR-APIM0": {"title":"Enforce recommended guardrails for API Management","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-APIM0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-APIM-001","AZ-APIM-002","AZ-APIM-003","AZ-APIM-004"]}, "Enforce-GR-AppServices0": {"title":"Enforce recommended guardrails for App Services","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-AppServices0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-APP-001","AZ-APP-002","AZ-APP-003","AZ-APP-004","AZ-APP-005"]}, "Enforce-GR-Automation0": {"title":"Enforce recommended guardrails for Automation Accounts","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-Automation0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-AUTO-001","AZ-PAAS-002"]}, "Enforce-GR-BotService0": {"title":"Enforce recommended guardrails for Bot Service","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-BotService0.alz_policy_assignment.json","coverage":"full","tests":["AZ-BOT-001","AZ-BOT-002","AZ-BOT-003"]}, "Enforce-GR-CogServ0": {"title":"Enforce recommended guardrails for Cognitive Services","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-CogServ0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-AI-001","AZ-AI-002"]}, "Enforce-GR-Compute0": {"title":"Enforce recommended guardrails for Compute","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-Compute0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-VM-002"]}, "Enforce-GR-ContApps0": {"title":"Enforce recommended guardrails for Container Apps","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-ContApps0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-CAPP-001"]}, "Enforce-GR-ContInst0": {"title":"Enforce recommended guardrails for Container Instance","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-ContInst0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-ACI-001"]}, "Enforce-GR-ContReg0": {"title":"Enforce recommended guardrails for Container Registry","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-ContReg0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-ACR-001","AZ-ACR-002","AZ-ACR-003"]}, "Enforce-GR-CosmosDb0": {"title":"Enforce recommended guardrails for Cosmos DB","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-CosmosDb0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-COS-001","AZ-COS-002"]}, "Enforce-GR-DataExpl0": {"title":"Enforce recommended guardrails for Data Explorer","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-DataExpl0.alz_policy_assignment.json","coverage":"full","tests":["AZ-ADX-001","AZ-ADX-002","AZ-ADX-003"]}, "Enforce-GR-DataFactory0": {"title":"Enforce recommended guardrails for Data Factory","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-DataFactory0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-ADF-001"]}, "Enforce-GR-EventGrid0": {"title":"Enforce recommended guardrails for Event Grid","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-EventGrid0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-PAAS-002"]}, "Enforce-GR-EventHub0": {"title":"Enforce recommended guardrails for Event Hub","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-EventHub0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-MSG-001","AZ-PAAS-002"]}, "Enforce-GR-KeyVault": {"title":"Enforce recommended guardrails for Azure Key Vault","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-KeyVault.alz_policy_assignment.json","coverage":"partial","tests":["AZ-KV-001","AZ-KV-002","AZ-KV-003","AZ-KV-005","AZ-KV-006","AZ-KV-008","AZ-KV-010","AZ-KV-011"]}, "Enforce-GR-KeyVaultSup0": {"title":"Enforce recommended guardrails for Key Vault Supplementary","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-KeyVaultSup0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-KV-003"]}, "Enforce-GR-Kubernetes0": {"title":"Enforce recommended guardrails for Kubernetes","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-Kubernetes0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-AKS-001","AZ-AKS-003","AZ-AKS-004"]}, "Enforce-GR-MachLearn0": {"title":"Enforce recommended guardrails for Machine Learning","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-MachLearn0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-AI-005","AZ-AI-006","AZ-AI-007"]}, "Enforce-GR-MySQL0": {"title":"Enforce recommended guardrails for MySQL","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-MySQL0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-MY-001","AZ-MY-003"]}, "Enforce-GR-Network0": {"title":"Enforce recommended guardrails for Network and Networking services","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-Network0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-NET-001","AZ-NET-002","AZ-NET-006","AZ-NET-008","AZ-NET-009","AZ-NET-010","AZ-NET-012","AZ-NET-015","AZ-NET-018","AZ-NET-021"]}, "Enforce-GR-OpenAI0": {"title":"Enforce recommended guardrails for OpenAI","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-OpenAI0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-AI-001","AZ-AI-002"]}, "Enforce-GR-PostgreSQL0": {"title":"Enforce recommended guardrails for PostgreSQL","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-PostgreSQL0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-PG-001","AZ-PG-004"]}, "Enforce-GR-ServiceBus0": {"title":"Enforce recommended guardrails for Service Bus","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-ServiceBus0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-MSG-001","AZ-PAAS-002"]}, "Enforce-GR-SQL0": {"title":"Enforce recommended guardrails for SQL","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-SQL0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-SQL-003","AZ-SQL-004","AZ-SQL-005"]}, "Enforce-GR-Storage0": {"title":"Enforce recommended guardrails for Storage","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-Storage0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-STG-003","AZ-STG-005","AZ-STG-006"]}, "Enforce-GR-Synapse0": {"title":"Enforce recommended guardrails for Synapse","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-Synapse0.alz_policy_assignment.json","coverage":"partial","tests":["AZ-SYN-001"]}, "Enforce-GR-VirtualDesk0": {"title":"Enforce recommended guardrails for Virtual Desktop","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-GR-VirtualDesk0.alz_policy_assignment.json","coverage":"full","tests":["AZ-AVD-001"]}, "Enforce-Subnet-Private": {"title":"Subnets should be private","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-Subnet-Private.alz_policy_assignment.json","coverage":"full","tests":["AZ-NET-007"]}, "Enforce-TLS-SSL-Q225": {"title":"Deny or Deploy and append TLS requirements and SSL enforcement on resources without Encryption in transit","url":"https://github.com/Azure/Azure-Landing-Zones-Library/blob/platform/alz/2026.08.1/platform/alz/policy_assignments/Enforce-TLS-SSL-Q225.alz_policy_assignment.json","coverage":"partial","tests":["AZ-APIM-006","AZ-APP-001","AZ-APP-002","AZ-MY-001","AZ-NET-013","AZ-PAAS-003","AZ-PG-001","AZ-RED-001","AZ-SQL-006","AZ-STG-001","AZ-STG-002"]} } } |