output/20260723_081532/govviz/ALZ_20260723_081601/Enterprise-Scale/src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-OpenAI.json

{
    "name": "Enforce-Guardrails-OpenAI",
    "type": "Microsoft.Authorization/policySetDefinitions",
    "apiVersion": "2023-04-01",
    "scope": null,
    "properties": {
        "policyType": "Custom",
        "displayName": "Enforce recommended guardrails for Open AI (Cognitive Service)",
        "description": "This policy initiative is a group of policies that ensures Open AI (Cognitive Service) is compliant per regulated Landing Zones.",
        "metadata": {
            "version": "1.2.0",
            "category": "Cognitive Services",
            "source": "https://github.com/Azure/Enterprise-Scale/",
            "alzCloudEnvironments": [
                "AzureCloud",
                "AzureChinaCloud",
                "AzureUSGovernment"
            ]
        },
        "parameters": {
            "cognitiveServicesOutboundNetworkAccess": {
                "type": "string",
                "defaultValue": "Deny",
                "allowedValues": [
                    "Audit",
                    "Deny",
                    "Disabled"
                ]
            },
            "cognitiveServicesNetworkAcls": {
                "type": "string",
                "defaultValue": "Deny",
                "allowedValues": [
                    "Audit",
                    "Deny",
                    "Disabled"
                ]
            },
            "cognitiveServicesModifyDisableLocalAuth": {
                "type": "string",
                "defaultValue": "Modify",
                "allowedValues": [
                    "Modify",
                    "Disabled"
                ]
            },
            "cognitiveServicesDisableLocalAuth": {
                "type": "string",
                "defaultValue": "Deny",
                "allowedValues": [
                    "Audit",
                    "Deny",
                    "Disabled"
                ]
            },
            "cognitiveServicesCustomerStorage": {
                "type": "string",
                "defaultValue": "Deny",
                "allowedValues": [
                    "Audit",
                    "Deny",
                    "Disabled"
                ]
            },
            "cognitiveServicesManagedIdentity": {
                "type": "string",
                "defaultValue": "Deny",
                "allowedValues": [
                    "Audit",
                    "Deny",
                    "Disabled"
                ]
            },
            "azureAiNetworkAccess": {
                "type": "string",
                "defaultValue": "Deny",
                "allowedValues": [
                    "Audit",
                    "Deny",
                    "Disabled"
                ]
            },
            "azureAiPrivateLink": {
                "type": "string",
                "defaultValue": "Audit",
                "allowedValues": [
                    "Audit",
                    "Disabled"
                ]
            },
            "azureAiDisableLocalKey": {
                "type": "string",
                "defaultValue": "DeployIfNotExists",
                "allowedValues": [
                    "DeployIfNotExists",
                    "Disabled"
                ]
            },
            "azureAiDisableLocalKey2": {
                "type": "string",
                "defaultValue": "DeployIfNotExists",
                "allowedValues": [
                    "DeployIfNotExists",
                    "Disabled"
                ]
            },
            "azureAiDiagSettings": {
                "type": "string",
                "defaultValue": "AuditIfNotExists",
                "allowedValues": [
                    "AuditIfNotExists",
                    "Disabled"
                ]
            }
        },
        "policyDefinitions": [
            {
                "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-CognitiveServices-RestrictOutboundNetworkAccess",
                "policyDefinitionReferenceId": "Deny-OpenAi-OutboundNetworkAccess",
                "definitionVersion": "1.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('cognitiveServicesOutboundNetworkAccess')]"
                    }
                }
            },
            {
                "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deny-CognitiveServices-NetworkAcls",
                "policyDefinitionReferenceId": "Deny-OpenAi-NetworkAcls",
                "definitionVersion": "1.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('cognitiveServicesNetworkAcls')]"
                    }
                }
            },
            {
                "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fe3fd216-4f83-4fc1-8984-2bbec80a3418",
                "policyDefinitionReferenceId": "Deny-Cognitive-Services-Managed-Identity",
                "definitionVersion": "1.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('cognitiveServicesManagedIdentity')]"
                    }
                }
            },
            {
                "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/71ef260a-8f18-47b7-abcb-62d0673d94dc",
                "policyDefinitionReferenceId": "Deny-Cognitive-Services-Local-Auth",
                "definitionVersion": "1.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('cognitiveServicesDisableLocalAuth')]"
                    }
                }
            },
            {
                "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/46aa9b05-0e60-4eae-a88b-1e9d374fa515",
                "policyDefinitionReferenceId": "Deny-Cognitive-Services-Cust-Storage",
                "definitionVersion": "2.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('cognitiveServicesCustomerStorage')]"
                    }
                }
            },
            {
                "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/14de9e63-1b31-492e-a5a3-c3f7fd57f555",
                "policyDefinitionReferenceId": "Modify-Cognitive-Services-Local-Auth",
                "definitionVersion": "1.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('cognitiveServicesModifyDisableLocalAuth')]"
                    }
                }
            },
            {
                "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/037eea7a-bd0a-46c5-9a66-03aea78705d3",
                "policyDefinitionReferenceId": "Deny-AzureAI-Network-Access",
                "definitionVersion": "3.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('azureAiNetworkAccess')]"
                    }
                }
            },
            {
                "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d6759c02-b87f-42b7-892e-71b3f471d782",
                "policyDefinitionReferenceId": "Audit-AzureAI-Private-Link",
                "definitionVersion": "1.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('azureAiPrivateLink')]"
                    }
                }
            },
            {
                "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d45520cb-31ca-44ba-8da2-fcf914608544",
                "policyDefinitionReferenceId": "Dine-AzureAI-Local-Key",
                "definitionVersion": "1.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('azureAiDisableLocalKey')]"
                    }
                }
            },
            {
                "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/55eff01b-f2bd-4c32-9203-db285f709d30",
                "policyDefinitionReferenceId": "Dine-AzureAI-Local-Key2",
                "definitionVersion": "1.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('azureAiDisableLocalKey2')]"
                    }
                }
            },
            {
                "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1b4d1c4e-934c-4703-944c-27c82c06bebb",
                "policyDefinitionReferenceId": "Aine-AzureAI-Diag-Settings",
                "definitionVersion": "1.*.*",
                "groupNames": [],
                "parameters": {
                    "effect": {
                        "value": "[[parameters('azureAiDiagSettings')]"
                    }
                }
            }
        ],
        "policyDefinitionGroups": null
    }
}