I'm currently configuring a Azure Policy that only allows some values to one of my tags. Here is the policy as of right now:

    "policyRule": {
    "if": {
      "allof": [
        {
          "field": "type",
          "equals": "Microsoft.Resources/subscriptions/resourceGroups"
        },
        {
          "not": {
            "field": "[concat('tags[', parameters('tagName'), ']')]",
            "match": "IT-####"
          }
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }

However, right now only the values started with "IT-" and followed by 4 numbers is accepted. Is there a way to change the policy to accept 4 or more numbers? Would I be able to use the wildcard (*)?

Let me know if you need more information.

Best regards,

I'm currently configuring a Azure Policy that only allows some values to one of my tags. Here is the policy as of right now:

    "policyRule": {
    "if": {
      "allof": [
        {
          "field": "type",
          "equals": "Microsoft.Resources/subscriptions/resourceGroups"
        },
        {
          "not": {
            "field": "[concat('tags[', parameters('tagName'), ']')]",
            "match": "IT-####"
          }
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }

However, right now only the values started with "IT-" and followed by 4 numbers is accepted. Is there a way to change the policy to accept 4 or more numbers? Would I be able to use the wildcard (*)?

Let me know if you need more information.

Best regards,

• azure
• azure-rm-template
• azure-policy

• Thank you for your response, but I belive the match condition does not accept regex – Helena Raia Commented Feb 6 at 10:49

1 Answer 1

what about use split first to get the number section of the tag. then use int to parse the value and see if value is greater than 0?

something like below. sorry, did not get change to test it out. but probably you can use split and last and int to do it.

{
 "value": "[int(last(split(field(concat('tags[', 'tagName', ']')))))]",
 "greater": 0
},

refer to:

How do you policy enforce integer number of tag value in Azure

How to enforce naming pattern such as "*-*-asp" using Azure policy?