Skip to content

Commit b044f53

Browse files
taoyangcloudtaoyangcloud
committed
Add policies for Foundry model deployments with Responsible AI and deployment type restrictions
1 parent 0aacc04 commit b044f53

5 files changed

Lines changed: 286 additions & 0 deletions

File tree

‎policyAssignments/dev/pa-d-cog-service.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,31 @@
7070
"value": [
7171
"FW-Kimi-K3"
7272
]
73+
},
74+
"COG-010_Effect": {
75+
"value": "Deny"
76+
},
77+
"COG-010_approvedRaiPolicies": {
78+
"value": [
79+
"Microsoft.DefaultV2",
80+
"Contoso.DefaultV1"
81+
]
82+
},
83+
"COG-011_Effect": {
84+
"value": "Deny"
85+
},
86+
"COG-011_modelNames": {
87+
"value": [
88+
"gpt-5-mini",
89+
"gpt-5-nano",
90+
"gpt-5.2",
91+
"gpt-5.4-mini",
92+
"gpt-5.4-nano",
93+
"gpt-5.4",
94+
"gpt-5.5",
95+
"FW-Kimi-K3",
96+
"FW-Kimi-K2.7-Code"
97+
]
7398
}
7499
},
75100
"nonComplianceMessages": [
@@ -80,6 +105,10 @@
80105
{
81106
"policyDefinitionReferenceId": "COG-007",
82107
"message": "PolicyID: COG-007 Violation in polset-cognitive-service Initiative - 'Only approved xAI models are allowed to be deployed in Cognitive Services'"
108+
},
109+
{
110+
"policyDefinitionReferenceId": "COG-011",
111+
"message": "PolicyID: COG-011 Violation in polset-cognitive-service Initiative - 'List of Foundry model deployments must use DataZoneStandard deployment type in AI Foundry accounts.'"
83112
}
84113
],
85114
"roleDefinitionIds": [

‎policyAssignments/prod/pa-p-cog-service.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,31 @@
7070
"value": [
7171
"FW-Kimi-K3"
7272
]
73+
},
74+
"COG-010_Effect": {
75+
"value": "Deny"
76+
},
77+
"COG-010_approvedRaiPolicies": {
78+
"value": [
79+
"Microsoft.DefaultV2",
80+
"Contoso.DefaultV1"
81+
]
82+
},
83+
"COG-011_Effect": {
84+
"value": "Deny"
85+
},
86+
"COG-011_modelNames": {
87+
"value": [
88+
"gpt-5-mini",
89+
"gpt-5-nano",
90+
"gpt-5.2",
91+
"gpt-5.4-mini",
92+
"gpt-5.4-nano",
93+
"gpt-5.4",
94+
"gpt-5.5",
95+
"FW-Kimi-K3",
96+
"FW-Kimi-K2.7-Code"
97+
]
7398
}
7499
},
75100
"nonComplianceMessages": [
@@ -80,6 +105,10 @@
80105
{
81106
"policyDefinitionReferenceId": "COG-007",
82107
"message": "PolicyID: COG-007 Violation in polset-cognitive-service Initiative - 'Only approved xAI models are allowed to be deployed in Cognitive Services'"
108+
},
109+
{
110+
"policyDefinitionReferenceId": "COG-011",
111+
"message": "PolicyID: COG-011 Violation in polset-cognitive-service Initiative - 'List of Foundry model deployments must use DataZoneStandard deployment type in AI Foundry accounts.'"
83112
}
84113
],
85114
"roleDefinitionIds": [

‎policyDefinitions/cognitive-service/pol-enforce-foundry-deployment-rai-policy.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"name": "pol-enforce-foundry-deployment-rai-policy",
3+
"properties": {
4+
"displayName": "Foundry deployments must have an approved Responsible AI policy assigned",
5+
"description": "Ensure Foundry model deployments have an associated approved Responsible AI policy.",
6+
"mode": "All",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "Cognitive Services",
10+
"preview": false,
11+
"deprecated": false
12+
},
13+
"parameters": {
14+
"effect": {
15+
"type": "String",
16+
"metadata": {
17+
"displayName": "Effect",
18+
"description": "Enable or disable execution of the policy."
19+
},
20+
"allowedValues": [
21+
"Audit",
22+
"Deny",
23+
"Disabled"
24+
],
25+
"defaultValue": "Audit"
26+
},
27+
"approvedRaiPolicies": {
28+
"type": "Array",
29+
"metadata": {
30+
"displayName": "Approved RAI policy names",
31+
"description": "Responsible AI policy names that satisfy the organisation content safety baseline."
32+
},
33+
"defaultValue": [
34+
"Microsoft.DefaultV2"
35+
]
36+
}
37+
},
38+
"policyRule": {
39+
"if": {
40+
"allOf": [
41+
{
42+
"field": "type",
43+
"equals": "Microsoft.CognitiveServices/accounts/deployments"
44+
},
45+
{
46+
"anyOf": [
47+
{
48+
"field": "Microsoft.CognitiveServices/accounts/deployments/raiPolicyName",
49+
"exists": "false"
50+
},
51+
{
52+
"not": {
53+
"field": "Microsoft.CognitiveServices/accounts/deployments/raiPolicyName",
54+
"in": "[parameters('approvedRaiPolicies')]"
55+
}
56+
}
57+
]
58+
}
59+
]
60+
},
61+
"then": {
62+
"effect": "[parameters('effect')]"
63+
}
64+
}
65+
}
66+
}

‎policyDefinitions/cognitive-service/pol-enforce-foundry-model-deployment-type.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"name": "pol-enforce-foundry-model-deployment-type",
3+
"properties": {
4+
"displayName": "List of Foundry Model deployments must use approved deployment type",
5+
"mode": "All",
6+
"description": "Enforce Foundry models to be deployed using approved deployment types.",
7+
"metadata": {
8+
"version": "1.0.0",
9+
"category": "Cognitive Services"
10+
},
11+
"parameters": {
12+
"effect": {
13+
"type": "String",
14+
"metadata": {
15+
"displayName": "Effect",
16+
"description": "Enable or disable execution of the policy."
17+
},
18+
"allowedValues": [
19+
"Audit",
20+
"Deny",
21+
"Disabled"
22+
],
23+
"defaultValue": "Deny"
24+
},
25+
"modelNames": {
26+
"type": "Array",
27+
"metadata": {
28+
"displayName": "In-scope model names",
29+
"description": "Model names this restriction applies to. Matched against model.name. Comparison is case-insensitive."
30+
}
31+
},
32+
"allowedDeploymentType": {
33+
"type": "string",
34+
"metadata": {
35+
"displayName": "Approved deployment type",
36+
"description": "Permitted value of sku.name for the in-scope models."
37+
},
38+
"defaultValue": "DataZoneStandard"
39+
}
40+
},
41+
"policyRule": {
42+
"if": {
43+
"allOf": [
44+
{
45+
"field": "type",
46+
"equals": "Microsoft.CognitiveServices/accounts/deployments"
47+
},
48+
{
49+
"field": "Microsoft.CognitiveServices/accounts/deployments/model.name",
50+
"in": "[parameters('modelNames')]"
51+
},
52+
{
53+
"field": "Microsoft.CognitiveServices/accounts/deployments/sku.name",
54+
"notEquals": "[parameters('allowedDeploymentType')]"
55+
}
56+
]
57+
},
58+
"then": {
59+
"effect": "[parameters('effect')]"
60+
}
61+
}
62+
}
63+
}

‎policyInitiatives/polset-cognitive-service.json‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,49 @@
165165
"displayName": "COG-009 Allowed Model Names for Fireworks format",
166166
"description": "List of Model Names that are allowed to be deployed."
167167
}
168+
},
169+
"COG-010_Effect": {
170+
"type": "String",
171+
"metadata": {
172+
"displayName": "COG-010 Effect: Foundry deployments must have an approved Responsible AI policy assigned",
173+
"description": "'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. 'Deny' blocks the resource creation. 'Disable' turns off the policy."
174+
},
175+
"allowedValues": [
176+
"Audit",
177+
"Deny",
178+
"Disabled"
179+
],
180+
"defaultValue": "Deny"
181+
},
182+
"COG-010_approvedRaiPolicies": {
183+
"type": "Array",
184+
"metadata": {
185+
"displayName": "COG-010 Approved RAI policy names",
186+
"description": "Responsible AI policy names that satisfy the organisation content safety baseline."
187+
},
188+
"defaultValue": [
189+
"Microsoft.DefaultV2"
190+
]
191+
},
192+
"COG-011_Effect": {
193+
"type": "String",
194+
"metadata": {
195+
"displayName": "COG-011 Effect: List of Foundry Model deployments must use DataZoneStandard deployment type",
196+
"description": "'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. 'Deny' blocks the resource creation. 'Disable' turns off the policy."
197+
},
198+
"allowedValues": [
199+
"Audit",
200+
"Deny",
201+
"Disabled"
202+
],
203+
"defaultValue": "Deny"
204+
},
205+
"COG-011_modelNames": {
206+
"type": "Array",
207+
"metadata": {
208+
"displayName": "COG-011 In-scope model names",
209+
"description": "Model names this restriction applies to. Matched against model.name. Comparison is case-insensitive."
210+
}
168211
}
169212
},
170213
"policyDefinitionGroups": [
@@ -195,6 +238,14 @@
195238
{
196239
"name": "ISO27001-2013_A.14.2.4",
197240
"additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/ISO27001-2013_A.14.2.4"
241+
},
242+
{
243+
"name": "ISO27001-2013_A.14.2.5",
244+
"additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/ISO27001-2013_A.14.2.5"
245+
},
246+
{
247+
"name": "ISO27001-2013_A.18.1.1",
248+
"additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/ISO27001-2013_A.18.1.1"
198249
}
199250
],
200251
"policyDefinitions": [
@@ -341,6 +392,54 @@
341392
"ISO27001-2013_A.12.5.1",
342393
"ISO27001-2013_A.14.2.4"
343394
]
395+
},
396+
{
397+
"policyDefinitionReferenceId": "COG-010",
398+
"policyDefinitionId": "{policyLocationResourceId}/providers/Microsoft.Authorization/policyDefinitions/pol-enforce-foundry-deployment-rai-policy",
399+
"parameters": {
400+
"effect": {
401+
"value": "[parameters('COG-010_Effect')]"
402+
},
403+
"approvedRaiPolicies": {
404+
"value": "[parameters('COG-010_approvedRaiPolicies')]"
405+
}
406+
},
407+
"groupNames": [
408+
"ISO27001-2013_A.14.2.5"
409+
]
410+
},
411+
{
412+
"policyDefinitionReferenceId": "COG-010",
413+
"policyDefinitionId": "{policyLocationResourceId}/providers/Microsoft.Authorization/policyDefinitions/pol-enforce-foundry-deployment-rai-policy",
414+
"parameters": {
415+
"effect": {
416+
"value": "[parameters('COG-010_Effect')]"
417+
},
418+
"approvedRaiPolicies": {
419+
"value": "[parameters('COG-010_approvedRaiPolicies')]"
420+
}
421+
},
422+
"groupNames": [
423+
"ISO27001-2013_A.14.2.5"
424+
]
425+
},
426+
{
427+
"policyDefinitionReferenceId": "COG-011",
428+
"policyDefinitionId": "{policyLocationResourceId}/providers/Microsoft.Authorization/policyDefinitions/pol-enforce-foundry-model-deployment-type",
429+
"parameters": {
430+
"effect": {
431+
"value": "[parameters('COG-011_Effect')]"
432+
},
433+
"modelNames": {
434+
"value": "[parameters('COG-011_modelNames')]"
435+
},
436+
"allowedDeploymentType": {
437+
"value": "DataZoneStandard"
438+
}
439+
},
440+
"groupNames": [
441+
"ISO27001-2013_A.18.1.1"
442+
]
344443
}
345444
]
346445
}

0 commit comments

Comments
 (0)