Recently, I encountered a challenge with Azure Policy while implementing an “Allowed Locations” policy to ensure resources deployed in the correct regions. Similar to the one listed here but it’s our own custom one to allow us to make our own modifications - AzAdvertizer.net
The Problem:
Our custom policy, configured with “All” mode, was unexpectedly interfering with the creation of new Key Vault access policies.
The “Aha!” Moment:
After careful investigation, we compared our custom policy with the built-in Azure Policy for “Allowed Locations.” This built-in policy, designed specifically for this purpose, leverages the “Indexed” mode. This key difference was the root cause of the issue.