From dd75cf0dad1225421f3f51a72f4cdc9392d3199d Mon Sep 17 00:00:00 2001 From: Rui Hiraoka Date: Thu, 5 Nov 2026 17:07:40 +0900 Subject: [PATCH 1/2] Add APIM private endpoint public access policy Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../azurepolicy.json | 66 +++++++++++++++++++ .../azurepolicy.parameters.json | 15 +++++ .../azurepolicy.rules.json | 38 +++++++++++ 3 files changed, 119 insertions(+) create mode 100644 policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.json create mode 100644 policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.parameters.json create mode 100644 policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.rules.json diff --git a/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.json b/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.json new file mode 100644 index 00000000..a6935520 --- /dev/null +++ b/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.json @@ -0,0 +1,66 @@ +{ + "name": "3a374935-c7d3-415f-9d51-e29bdf7fad8a", + "type": "Microsoft.Authorization/policyDefinitions", + "properties": { + "displayName": "API Management with private endpoint should disable public network access", + "description": "Audits or denies API Management services with at least one approved private endpoint connection when public network access to the gateway remains enabled. Services without an approved private endpoint are not evaluated because public network access can only be disabled after a private endpoint is configured. Only SKUs that support inbound private endpoints are evaluated; Consumption, Basic v2, and classic tiers injected into a virtual network are excluded.", + "metadata": { + "version": "1.0.0", + "category": "API Management" + }, + "mode": "Indexed", + "parameters": { + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Deny, Audit or Disabled the execution of the Policy" + }, + "allowedValues": [ + "Deny", + "Audit", + "Disabled" + ], + "defaultValue": "Audit" + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.ApiManagement/service" + }, + { + "field": "Microsoft.ApiManagement/service/sku.name", + "in": [ + "Developer", + "Basic", + "Standard", + "Premium", + "StandardV2", + "PremiumV2" + ] + }, + { + "count": { + "field": "Microsoft.ApiManagement/service/privateEndpointConnections[*]", + "where": { + "field": "Microsoft.ApiManagement/service/privateEndpointConnections[*].privateLinkServiceConnectionState.status", + "equals": "Approved" + } + }, + "greaterOrEquals": 1 + }, + { + "field": "Microsoft.ApiManagement/service/publicNetworkAccess", + "notEquals": "Disabled" + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } + } + } +} diff --git a/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.parameters.json b/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.parameters.json new file mode 100644 index 00000000..d2c89f94 --- /dev/null +++ b/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.parameters.json @@ -0,0 +1,15 @@ +{ + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Deny, Audit or Disabled the execution of the Policy" + }, + "allowedValues": [ + "Deny", + "Audit", + "Disabled" + ], + "defaultValue": "Audit" + } +} diff --git a/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.rules.json b/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.rules.json new file mode 100644 index 00000000..0a0d52f0 --- /dev/null +++ b/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.rules.json @@ -0,0 +1,38 @@ +{ + "if": { + "allOf": [ + { + "field": "type", + "equals": "Microsoft.ApiManagement/service" + }, + { + "field": "Microsoft.ApiManagement/service/sku.name", + "in": [ + "Developer", + "Basic", + "Standard", + "Premium", + "StandardV2", + "PremiumV2" + ] + }, + { + "count": { + "field": "Microsoft.ApiManagement/service/privateEndpointConnections[*]", + "where": { + "field": "Microsoft.ApiManagement/service/privateEndpointConnections[*].privateLinkServiceConnectionState.status", + "equals": "Approved" + } + }, + "greaterOrEquals": 1 + }, + { + "field": "Microsoft.ApiManagement/service/publicNetworkAccess", + "notEquals": "Disabled" + } + ] + }, + "then": { + "effect": "[parameters('effect')]" + } +} From 7f465c437f65d321ccad439f7a1188a75ddc9555 Mon Sep 17 00:00:00 2001 From: Rui Hiraoka Date: Thu, 5 Nov 2026 17:14:15 +0900 Subject: [PATCH 2/2] Remove redundant APIM SKU condition Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../azurepolicy.json | 13 +------------ .../azurepolicy.rules.json | 11 ----------- 2 files changed, 1 insertion(+), 23 deletions(-) diff --git a/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.json b/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.json index a6935520..0390b1c1 100644 --- a/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.json +++ b/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.json @@ -3,7 +3,7 @@ "type": "Microsoft.Authorization/policyDefinitions", "properties": { "displayName": "API Management with private endpoint should disable public network access", - "description": "Audits or denies API Management services with at least one approved private endpoint connection when public network access to the gateway remains enabled. Services without an approved private endpoint are not evaluated because public network access can only be disabled after a private endpoint is configured. Only SKUs that support inbound private endpoints are evaluated; Consumption, Basic v2, and classic tiers injected into a virtual network are excluded.", + "description": "Audits or denies API Management services with at least one approved private endpoint connection when public network access to the gateway remains enabled. Services without an approved private endpoint are not evaluated because public network access can only be disabled after a private endpoint is configured. SKUs and network configurations that do not support private endpoints cannot meet the approved private endpoint condition and are therefore not evaluated.", "metadata": { "version": "1.0.0", "category": "API Management" @@ -31,17 +31,6 @@ "field": "type", "equals": "Microsoft.ApiManagement/service" }, - { - "field": "Microsoft.ApiManagement/service/sku.name", - "in": [ - "Developer", - "Basic", - "Standard", - "Premium", - "StandardV2", - "PremiumV2" - ] - }, { "count": { "field": "Microsoft.ApiManagement/service/privateEndpointConnections[*]", diff --git a/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.rules.json b/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.rules.json index 0a0d52f0..99101f00 100644 --- a/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.rules.json +++ b/policyDefinitions/API Management/api-management-with-private-endpoint-should-disable-public-network-access/azurepolicy.rules.json @@ -5,17 +5,6 @@ "field": "type", "equals": "Microsoft.ApiManagement/service" }, - { - "field": "Microsoft.ApiManagement/service/sku.name", - "in": [ - "Developer", - "Basic", - "Standard", - "Premium", - "StandardV2", - "PremiumV2" - ] - }, { "count": { "field": "Microsoft.ApiManagement/service/privateEndpointConnections[*]",