Azure资源组强制双标签（Environment/Project）策略配置问题求助

你当前的策略用allOf同时判断「缺少Environment标签」和「缺少Project标签」，这意味着只有两个标签全缺时才会触发拦截。但你要的是缺任意一个标签就阻止创建、标记不合规，所以逻辑结构完全搞反了。

把两个标签缺失的判断放到anyOf里，表示只要满足其中一个条件（缺Environment或缺Project）就触发规则，再和「是资源组」的条件用allOf组合，确保只针对资源组生效：

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Resources/subscriptions/resourceGroups"
        },
        {
          "anyOf": [
            {
              "field": "tags['Environment']",
              "exists": "false"
            },
            {
              "field": "tags['Project']",
              "exists": "false"
            }
          ]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}

• 外层allOf：同时满足「是资源组」+「缺少任意一个必填标签」两个前提才触发规则
• 内层anyOf：只要缺Environment或者缺Project标签，就符合不合规条件
• deny效果：既拦新创建的不合规资源组，也会把已存在的缺标签资源组标记为不合规

如果后续想灵活修改必填标签名，可把标签名做成参数：

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Resources/subscriptions/resourceGroups"
        },
        {
          "anyOf": [
            {
              "field": "[concat('tags[', parameters('requiredTag1'), ']')]",
              "exists": "false"
            },
            {
              "field": "[concat('tags[', parameters('requiredTag2'), ']')]",
              "exists": "false"
            }
          ]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {
    "requiredTag1": {
      "type": "String",
      "metadata": {
        "description": "第一个必填标签的名称",
        "displayName": "必填标签1"
      },
      "defaultValue": "Environment"
    },
    "requiredTag2": {
      "type": "String",
      "metadata": {
        "description": "第二个必填标签的名称",
        "displayName": "必填标签2"
      },
      "defaultValue": "Project"
    }
  }
}

内容的提问来源于stack exchange，提问作者Ivan Mirchev