self-service-policy-exemptions

Type: regulative

Decision

An exemption must be granted through a merged pull request against the landing zone's parameter file.

Why

A deny policy without an exemption path gets worked around rather than enforced, as teams find other routes when blocked.

Violations

• Exemption applied in the portal rather than through a merged pull request.
• Exemption description that does not name the reason for the exemption.

Anchor

no-unapproved-resources

Implements

• guardrail

Files

• landing-zones/bicep/modules/base/policyExemption.bicep
• landing-zones/bicep/modules/azurePolicy.bicep
• landing-zones/managementGroup-AppName-environment.bicepparam

← Back to knowledge graph