razorspoint / azure-devops-azure-policy-extension

Extension for deploying Azure Governance topcis (Policies, Initiatives) with Azure DevOps (formerly VSTS)

Azure Policy and Governance Pipeline Tasks

This extension is hosted on the Visual Studio Marketplace for Azure DevOps and helps you to deploy Azure Policies into your Azure tenant. Detailed documentation can be found on the GitHub Pages.

Pipeline Status

Stage	Status	History
Overall
Build
Marketplace Test Release
Marketplace Live Release

Contributing

Contributions are very much welcome no matter how small they are!

Just go ahead and fork the repo and raise a pull request. Additionally you can also

1. Check the Issues page and start contributing to one of the suggested issues.
2. If you have an new suggestion then raise an issue or comment on an existing issue with what you want to contribute.
3. Just align shortly with me on the issue. If you want you can go right ahead but to not make unnecessary commit it would be easier to align before coding.
4. Include a link to the issue in your pull request.
5. If it is a bug or an error, then you can create the pull request right away.

Coding Guidelines

1. Follow the general best practice PowerShell coding guidelines
2. This repo uses PSScriptAnalyzer with the default ruleset. I would like to have no warnings and errors within the build!
3. Write unit tests with Pester for you code that you contribute.

azure-devops-azure-policy-extension's Issues

Execute Azure Blueprints

More a feature request than an issue.

Az MS have released (in Preview at this time) Azure Blueprints to allow a governed definition of "stuff", it would be great to be able to have a nice integration into DevOps whereby the pipeline can execute a Blueprint as a release step.

Whilst it is currently possible to fire off a REST call, this is neither elegant nor desired but a "user friendly" plugin would be much better.

Not using mode when redeploying

Describe the bug
When re-deploying policies spliited deployment, mode is not used.
When policy initially is deployed mode is set to all, this setting is not used when redeployed.

In the DeploySplittedPolicyDefinition.ps1 i found the following contruct:
if($policy){
Write-Output "Policy '$Name' exists and will be updated."
$policy = Set-AzureRmPolicyDefinition @scope @policyParameter

}else{
Write-Output "Policy '$Name' does not exist and will be created."
$policyParameter.Mode = $Mode
$policy = New-AzureRmPolicyDefinition @scope @policyParameter

}

I think mode is not set, when policy exists?

Allow to deploy multiple Azure Policies by path

On the marketplace the following has been requested:

Can I deploy multiple policies by defining just one task? E.g. Giving path to the folder that contains all the policies definition?

This can be added probably in an easy way.

Deployment Error 'Missing SubscriptionId'

I'm trying to deploy a Policy Definition by using the "Splitted Deployment", but receiving the following error message:

Settings of the DevOps Task:
Definition Location: Management Group
Type of Deployment: Splitted Deployment
Mode: all
Name, Displayname, Description, Category: --> All Containing a value
Parameters / Policy Rule: --> Files are published from CI Pipeline

These are the two files I'm trying to deploy (originally JSON files - converted to txt in order to upload here):
Policy_AuditPIP_Parameters copy.txt
Policy_AuditPIP_Rule copy.txt

A Service Connection to a Subscription within the scope of the target management group has been configured and works also (SPN Role: Resource Policy Contributor).

Any ideas if I'm doing something wrong?

No Advanced options set, so cannot change service connection...

Only see a button called "Authorize" there is no drop down or any advanced options and since I.

1. Do not want to use my personal account to login to Azure.
2. Do not have access with my personal account as its not the same I use for Azure.

How come you say there is an advanced options and manage connections but I cannot see this in my deployment task?