如何修改Azure Policy仅为VM添加锁而非Resource Group？

你的现有策略问题在于，使用auditIfNotExists时未明确指定锁的目标资源范围，导致锁默认创建在VM所属的资源组层级。要让锁直接绑定到VM资源，只需在details块中添加"scope": "[field('id')]"，指定锁的父资源为当前匹配到的VM。

修改后的完整Policy代码如下：

{
  "properties": {
    "displayName": "All Azure Vm's should be Delete Locked",
    "mode": "Indexed",
    "description": "This policy will add an CanNotDelete Resource Lock directly on Azure Virtual Machines.",
    "metadata": {
      "version": "1.2.0",
      "category": "Compute"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable a Delete Lock"
        },
        "allowedValues": [
          "CanNotDelete",
          "ReadOnly",
          "NotSpecified"
        ],
        "defaultValue": "CanNotDelete"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Compute/virtualMachines"
          }
        ]
      },
      "then": {
        "effect": "auditIfNotExists",
        "details": {
          "type": "Microsoft.Authorization/locks",
          "scope": "[field('id')]", // 关键：指定锁的父资源为当前VM
          "existenceCondition": {
            "field": "Microsoft.Authorization/locks/level",
            "equals": "[parameters('effect')]" // 引用参数，提升策略灵活性
          }
        }
      }
    }
  }
}

关键调整说明 #

• 添加"scope": "[field('id')]"：该表达式会获取当前匹配到的VM资源ID，将锁的创建范围限定在该VM资源下，而非默认的资源组。
• 将existenceCondition中的固定值改为[parameters('effect')]：让策略可根据你选择的参数值（CanNotDelete/ReadOnly）检查对应级别的锁，提升策略灵活性。

部署修改后的策略后，新的锁会直接绑定到VM资源本身，不会再影响整个资源组。

内容的提问来源于stack exchange，提问作者Billmc