Azure Policy for BlobServices

Question

Hi, community!

I'm using this policy in order to audit blob versioning:

{
  "properties": {
    "displayName": "Custom: Configure your Storage account to enable blob versioning",
    "policyType": "Custom",
    "mode": "Indexed",
    "description": "You can enable Blob storage versioning to automatically maintain previous versions of an object. When blob versioning is enabled, you can access earlier versions of a blob to recover your data if it's modified or deleted.",
    "metadata": {
      "version": "1.0.0",
      "category": "Storage"
    },
    "version": "1.0.0",
    "parameters": {},
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Storage/storageAccounts/blobServices"
          },
          {
            "anyOf": [
              {
                "allOf": [
                  {
                    "value": "[requestContext().apiVersion]",
                    "less": "2019-10-10"
                  },
                  {
                    "field": "Microsoft.Storage/storageAccounts/blobServices/isVersioningEnabled",
                    "exists": "true"
                  }
                ]
              },
              {
                "field": "Microsoft.Storage/storageAccounts/blobServices/isVersioningEnabled",
                "equals": "false"
              }
            ]
          }
        ]
      },
      "then": {
        "effect": "${effect}"
      }
    }
  },
  "versions": [
    "1.0.0"
  ]
}

But in Azure Portal Policy Compliance I do not see any compliant/non-compliant resources.
I tried to use Microsoft.Storage/storageAccounts type - throws error about type mismatch.

Other policies that are related to Microsoft.Storage/storageAccounts type - showing all storage accounts and compliant/non-compliant ones, but Microsoft.Storage/storageAccounts/blobServices - not. Is it a feature or a bug? And how I can see whicg storage accounts have VersioningEnabled?

Answer 1

Try changing mode to All instead of Indexed. Also increase the API version. This one is not found on the docs.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.