modules/shared/Policy/finding-to-policy-map.json

{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "_comment": "Track C policy mapping table. Curated finding-type to AzAdvertizer/ALZ policy suggestions.",
  "schemaVersion": "1.0.0",
  "catalogVintage": {
    "azAdvertizer": { "date": "2026-04-23", "sha": "ea952a6e70811ee2d6568b92fee5db0e4e9aa02d" },
    "alz": { "date": "2026-04-23", "sha": "6773a7b9c9aef6c2c13a3d33996fa7d32a9268dc" }
  },
  "entries": [
    {
      "findingType": "storage.publicNetworkAccess.enabled",
      "suggestions": [
        {
          "source": "AzAdvertizer",
          "policyId": "/providers/Microsoft.Authorization/policyDefinitions/b2982f36-99f2-4db5-8eff-283140c09693",
          "displayName": "Storage accounts should disable public network access",
          "scopeHint": "subscription",
          "priority": 1
        },
        {
          "source": "ALZ",
          "policyId": "Deny-Storage-PublicAccess",
          "displayName": "ALZ: Deny storage accounts with public access",
          "scopeHint": "Corp",
          "priority": 1
        }
      ]
    },
    {
      "findingType": "keyvault.softDelete.disabled",
      "suggestions": [
        {
          "source": "AzAdvertizer",
          "policyId": "/providers/Microsoft.Authorization/policyDefinitions/0b60c0b2-2dc2-4e1c-b5c9-abbed971de53",
          "displayName": "Key vaults should have soft delete enabled",
          "scopeHint": "subscription",
          "priority": 1
        }
      ]
    },
    {
      "findingType": "sql.transparentDataEncryption.disabled",
      "suggestions": [
        {
          "source": "AzAdvertizer",
          "policyId": "/providers/Microsoft.Authorization/policyDefinitions/17k78e20-9358-41c9-923c-fb736d382a4d",
          "displayName": "Transparent Data Encryption on SQL databases should be enabled",
          "scopeHint": "subscription",
          "priority": 1
        },
        {
          "source": "ALZ",
          "policyId": "Deploy-Sql-TDE",
          "displayName": "ALZ: Deploy TDE on SQL databases",
          "scopeHint": "Landing Zones",
          "priority": 2
        }
      ]
    },
    {
      "findingType": "vm.diskEncryption.disabled",
      "suggestions": [
        {
          "source": "ALZ",
          "policyId": "Deploy-VM-DiskEncryption",
          "displayName": "ALZ: Deploy disk encryption on VMs",
          "scopeHint": "Landing Zones",
          "priority": 1
        }
      ]
    },
    {
      "findingType": "network.nsg.openToInternet",
      "suggestions": [
        {
          "source": "AzAdvertizer",
          "policyId": "/providers/Microsoft.Authorization/policyDefinitions/9daedab3-fb2d-461e-b861-71790eead4f6",
          "displayName": "All network ports should be restricted on NSGs associated to your VM",
          "scopeHint": "subscription",
          "priority": 1
        },
        {
          "source": "ALZ",
          "policyId": "Deny-MgmtPorts-From-Internet",
          "displayName": "ALZ: Deny management ports open from the internet",
          "scopeHint": "Corp",
          "priority": 1
        }
      ]
    },
    {
      "findingType": "identity.guestUsers.unrestricted",
      "suggestions": [
        {
          "source": "ALZ",
          "policyId": "Deny-Guest-Users",
          "displayName": "ALZ: Restrict guest user invitations",
          "scopeHint": "Identity",
          "priority": 1
        }
      ]
    },
    {
      "findingType": "resource.locations.unrestricted",
      "suggestions": [
        {
          "source": "ALZ",
          "policyId": "Deny-Resource-Locations",
          "displayName": "ALZ: Allowed locations initiative",
          "scopeHint": "Sandbox",
          "priority": 1
        },
        {
          "source": "AzAdvertizer",
          "policyId": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c",
          "displayName": "Allowed locations",
          "scopeHint": "managementGroup",
          "priority": 2
        }
      ]
    }
  ]
}