Help! My Azure policy is not firing!

Lately, I was involved in auto-provisioning a complete Azure governance setup.  The automation was done through Azure CLI, as this offered the most flexible solution for my customer.  Policy definitions were created via the az policy definition create command.  While most of the policies just worked fine, I had issues with some of them.  I lost quite some time to find out why…

I figured out that the policies that did not fire, were scoped to resource groups.  This got me thinking of the different policy definition modes.  Stating the documentation:

The mode determines which resource types are evaluated for a policy definition. The supported modes are:

  • all: evaluate resource groups, subscriptions, and all resource types
  • indexed: only evaluate resource types that support tags and location

The reason why my Azure policy rule was not firing, was because Azure CLI uses the indexed mode by default.  This mode does not evaluate resource groups.  Explicitly adding the –mode All, solved my problem and all Azure policies behaved as expected.

Hopefully this can save you some troubleshooting time!



Your Azure Coach is specialized in organizing Azure trainings that are infused with real-life experience. All our coaches are active consultants, who are very passionate and who love to share their Azure expertise with you.