Azure Policy如何判断字段为null？需配置拒绝空邮箱的策略

Hey Russ, I’ve run into this exact Azure Policy quirk before when working with SQL Vulnerability Assessment settings—let’s get this sorted out for you!

The problem with your original rule is that Azure Resource Manager (ARM) handles empty or unconfigured fields in a few different ways: it might omit the emails property entirely, set it to null, or use an empty array ([]) instead of an empty string. Your check for equals: "" only covers one narrow edge case, so it misses most scenarios where no emails are set.

Here are two reliable, robust solutions to enforce non-empty email configurations:

Option 1: Block All Empty/Missing Email Scenarios (Combined Condition) #

This rule covers every case where no valid emails are configured—whether the field is missing, set to null, an empty array, or an empty string:

{
  "or": [
    {
      "not": {
        "field": "Microsoft.Sql/servers/vulnerabilityAssessments/default.recurringScans.emails",
        "exists": true
      }
    },
    {
      "field": "Microsoft.Sql/servers/vulnerabilityAssessments/default.recurringScans.emails",
      "equals": ""
    },
    {
      "field": "Microsoft.Sql/servers/vulnerabilityAssessments/default.recurringScans.emails",
      "equals": "[]"
    },
    {
      "field": "Microsoft.Sql/servers/vulnerabilityAssessments/default.recurringScans.emails",
      "equals": null
    }
  ]
}

Option 2: Validate At Least One Email Exists (Recommended) #

Instead of hunting for empty states, we can check that the emails array has at least one valid entry. This is cleaner and more future-proof:

{
  "not": {
    "field": "Microsoft.Sql/servers/vulnerabilityAssessments/default.recurringScans.emails[*]",
    "exists": true
  }
}

The emails[*] syntax targets all elements in the array. If no elements exist (empty array or missing field), the exists check returns false, and the not wrapper triggers the deny effect.

Quick Tips: #

• Make sure your policy uses the Deny effect to block non-compliant resources.
• Test the policy with a few test resources first: create a SQL server with an empty vulnerability assessment email setting to confirm it gets blocked, then add a valid email to verify it passes.

内容的提问来源于stack exchange，提问作者Russell Maycock