Azure Policy built-in definitions for Azure App Configuration

This page is an index of Azure Policy built-in policy definitions for Azure App Configuration. For additional Azure Policy built-ins for other services, see Azure Policy built-in definitions.

The name of each built-in policy definition links to the policy definition in the Azure portal. Use the link in the Version column to view the source on the Azure Policy GitHub repo.

Azure App Configuration

Name (Azure portal)	Description	Effect(s)	Version (GitHub)
App Configuration should disable public network access	Disabling public network access improves security by ensuring that the resource isn't exposed on the public internet. You can limit exposure of your resources by creating private endpoints instead. Learn more at: https://aka.ms/appconfig/private-endpoint.	Audit, Deny, Disabled	1.0.0
App Configuration should use a customer-managed key	Customer-managed keys provide enhanced data protection by allowing you to manage your encryption keys. This is often required to meet compliance requirements.	Audit, Deny, Disabled	1.1.0
App Configuration should use a SKU that supports private link	When using a supported SKU, Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your app configuration instances instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/appconfig/private-endpoint.	Audit, Deny, Disabled	1.0.0
App Configuration should use private link	Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The private link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to your app configuration instances instead of the entire service, you'll also be protected against data leakage risks. Learn more at: https://aka.ms/appconfig/private-endpoint.	AuditIfNotExists, Disabled	1.0.2
App Configuration stores should have local authentication methods disabled	Disabling local authentication methods improves security by ensuring that App Configuration stores require Microsoft Entra identities exclusively for authentication. Learn more at: https://go.microsoft.com/fwlink/?linkid=2161954.	Audit, Deny, Disabled	1.0.1
Configure App Configuration stores to disable local authentication methods	Disable local authentication methods so that your App Configuration stores require Microsoft Entra identities exclusively for authentication. Learn more at: https://go.microsoft.com/fwlink/?linkid=2161954.	Modify, Disabled	1.0.1
Configure App Configuration to disable public network access	Disable public network access for App Configuration so that it isn't accessible over the public internet. This configuration helps protect them against data leakage risks. You can limit exposure of the your resources by creating private endpoints instead. Learn more at: https://aka.ms/appconfig/private-endpoint.	Modify, Disabled	1.0.0
Configure private endpoints for App Configuration	Private endpoints let you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to your app configuration instances, data leakage risks are reduced. Learn more at: https://aka.ms/appconfig/private-endpoint.	DeployIfNotExists, Disabled	1.0.0
Enable logging by category group for App Configuration (microsoft.appconfiguration/configurationstores) to Event Hub	Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to an Event Hub for App Configuration (microsoft.appconfiguration/configurationstores).	DeployIfNotExists, AuditIfNotExists, Disabled	1.1.0
Enable logging by category group for App Configuration (microsoft.appconfiguration/configurationstores) to Log Analytics	Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to a Log Analytics workspace for App Configuration (microsoft.appconfiguration/configurationstores).	DeployIfNotExists, AuditIfNotExists, Disabled	1.0.0
Enable logging by category group for App Configuration (microsoft.appconfiguration/configurationstores) to Storage	Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to a Storage Account for App Configuration (microsoft.appconfiguration/configurationstores).	DeployIfNotExists, AuditIfNotExists, Disabled	1.0.0

Next steps

• See the built-ins on the Azure Policy GitHub repo.
• Review the Azure Policy definition structure.
• Review Understanding policy effects.