fix(policy): remove duplicate WAF-on-AppGw built in Enforce-Guardrails-Network_20250326 - #2171
Open
Pratyush Verma (pratyushverma63) wants to merge 4 commits into
Conversation
Pratyush Verma (pratyushverma63)
requested review from
Qi Zhang (Zhangqi910) and
Copilot
July 14, 2026 05:00
Pratyush Verma (pratyushverma63)
had a problem deploying
to
csu-rw
July 14, 2026 05:00 — with 
GitHub Actions
Error
GitHub Actions
Error
Copilot started reviewing on behalf of
Pratyush Verma (pratyushverma63)
July 14, 2026 05:00
View session
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Enforce-Guardrails-Network_20250326 custom policy initiative by removing a duplicate reference to the built-in “WAF should be enabled for Application Gateway” policy and deleting the now-unused appGwWaf initiative parameter, keeping the remaining WAF-on-AppGw enforcement via the existing Deny-Waf-Fw-rules reference.
Changes:
- Removed the
appGwWafinitiative parameter (previously only used by the duplicate reference). - Removed the duplicate policy reference block
Deny-AppGw-Without-Waffor built-in policy564feb30-bf6a-4854-b4bb-0d2d2d1e6c66.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
… duplicate WAF-on-AppGw reference The built-in policy 564feb30-bf6a-4854-b4bb-0d2d2d1e6c66 (WAF should be enabled for Application Gateway) was referenced twice in Enforce-Guardrails-Network_20250326: as Deny-Waf-Fw-rules (param wafFwRules) and Deny-AppGw-Without-Waf (param appGwWaf). Following the breaking-change process: the existing initiative is deprecated as-published and superseded by a new dated initiative Enforce-Guardrails-Network_20260714 without the duplicate reference or the redundant appGwWaf parameter. The default network guardrails assignment and portal tooltip now target the new initiative, and initiatives.json was regenerated from Bicep. BREAKING CHANGE: Enforce-Guardrails-Network_20250326 is deprecated and replaced by Enforce-Guardrails-Network_20260714 (removes the appGwWaf parameter).
Pratyush Verma (pratyushverma63)
force-pushed
the
pratyverma4078_Duplicate_Policy_in_Enforce-Guardrails-Network_20250326
branch
from
July 14, 2026 18:40
0071a58 to
8ad7730
Compare
Pratyush Verma (pratyushverma63)
had a problem deploying
to
csu-rw
July 14, 2026 18:40 — with
GitHub Actions
Failure
GitHub Actions
Failure
…ate_Policy_in_Enforce-Guardrails-Network_20250326 # Conflicts: # eslzArm/managementGroupTemplates/policyDefinitions/initiatives.json
Pratyush Verma (pratyushverma63)
had a problem deploying
to
csu-rw
August 18, 2026 04:33 — with
GitHub Actions
Error
GitHub Actions
Error
…ate_Policy_in_Enforce-Guardrails-Network_20250326 # Conflicts: # eslzArm/managementGroupTemplates/policyDefinitions/initiatives.json
Pratyush Verma (pratyushverma63)
requested a deployment
to
csu-rw
August 20, 2026 07:11 — with
GitHub Actions
Waiting
GitHub Actions
Waiting
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
Enforce-Guardrails-Network_20250326initiative referenced the built-in policy564feb30-bf6a-4854-b4bb-0d2d2d1e6c66("Web Application Firewall (WAF) should be enabled forApplication Gateway") twice:
|
Deny-Waf-Fw-rules|wafFwRules||
Deny-AppGw-Without-Waf(duplicate) |appGwWaf|The
Deny-AppGw-Without-Wafentry is redundant — the same built-in is already enforced viaDeny-Waf-Fw-rules. This PR removes the duplicate reference and its now-unusedappGwWafparameter.Removing a parameter (
appGwWaf) from a published initiative can adversely impact any existingassignment that sets it. Per the breaking-change process,
the fix is delivered as a new dated initiative rather than an in-place edit.
Changes
Enforce-Guardrails-Network_20250326— kept as-published, with[Deprecated]:displayName,version: 2.0.0-deprecated,deprecated: true, andsupersededBy: Enforce-Guardrails-Network_20260714.Enforce-Guardrails-Network_20260714— identical content removed the duplicatereference and
appGwWafparameter;replacesPolicy: Enforce-Guardrails-Network_20250326;version: 2.1.0._20260714. (The default assignment does not setappGwWaf, so no assignment parameters change.)_20260714.Files changed (6)
src/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-Network_20250326.jsonsrc/resources/Microsoft.Authorization/policySetDefinitions/Enforce-Guardrails-Network_20260714.json(new)src/templates/initiatives.bicepeslzArm/managementGroupTemplates/policyDefinitions/initiatives.jsoneslzArm/managementGroupTemplates/policyAssignments/ENFORCE-GuardrailsNetworkPolicyAssignment.jsoneslzArm/eslz-portal.jsonTesting
tested that policy is shown in the portal https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetail.ReactView/id/%2Fproviders%2Fmicrosoft.authorization%2Fpolicydefinitions%2F564feb30-bf6a-4854-b4bb-0d2d2d1e6c66/version/2.0.0/scopes~/%5B%22%2Fsubscriptions%2F1a32a88c-076d-45a5-87c7-978346609b5a%22%5D
Related docs PR
Deprecation notice added in Azure/Azure-Landing-Zones: Azure/Azure-Landing-Zones#4211
BREAKING CHANGE:
Enforce-Guardrails-Network_20250326is deprecated and replaced byEnforce-Guardrails-Network_20260714(removes theappGwWafparameter).