Issue enforcing Azure Policy on Azure OpenAI Model Deployments

Hi semod92

Your alias is fine. The problem is the mode. Indexed only evaluates resource types that support tags and location, and Microsoft's own sample for denying a deployment type on Microsoft.CognitiveServices/accounts/deployments uses All. Change that one line and the rule should start denying.

Two SKU names in your list are also off. The codes are ProvisionedManaged and DataZoneProvisionedManaged, so as written you'd block regional provisioned deployments too. If you use batch, DataZoneBatch needs to be on the list as well. Here's the rule with those fixed:

{ "mode": "All", "policyRule": { "if": { "allOf": [ { "field": "type", "equals": "Microsoft.CognitiveServices/accounts/deployments" }, { "field": "Microsoft.CognitiveServices/accounts/deployments/sku.name", "notIn": [ "Standard", "DataZoneStandard", "ProvisionedManaged", "DataZoneProvisionedManaged", "DataZoneBatch" ] } ] }, "then": { "effect": "deny" } } }

Give a new assignment at least 15 minutes before you test it. Microsoft's sample is here: https://learn.microsoft.com/en-us/azure/foundry-classic/foundry-models/how-to/configure-deployment-policies