diff --git a/policyAssignments/dev/pa-d-cog-service.json b/policyAssignments/dev/pa-d-cog-service.json index 8fe53f7..18296f2 100644 --- a/policyAssignments/dev/pa-d-cog-service.json +++ b/policyAssignments/dev/pa-d-cog-service.json @@ -28,7 +28,9 @@ "COG-005_listOfAllowedFormats": { "value": [ "xAI", - "OpenAI" + "OpenAI", + "Anthropic", + "Fireworks" ] }, "COG-006_Effect": { @@ -37,7 +39,9 @@ "COG-006_listOfAllowedNames": { "value": [ "gpt-4.1", + "gpt-5-mini", "gpt-5.4", + "gpt-5.5", "gpt-5.3-codex" ] }, @@ -49,6 +53,23 @@ "grok-4", "grok-4-1-fast-reasoning" ] + }, + "COG-008_Effect": { + "value": "Deny" + }, + "COG-008_listOfAllowedNames": { + "value": [ + "claude-opus-4-8", + "claude-opus-5" + ] + }, + "COG-009_Effect": { + "value": "Deny" + }, + "COG-009_listOfAllowedNames": { + "value": [ + "FW-Kimi-K3" + ] } }, "nonComplianceMessages": [ diff --git a/policyAssignments/prod/pa-p-cog-service.json b/policyAssignments/prod/pa-p-cog-service.json index 30967e9..dcf4ca8 100644 --- a/policyAssignments/prod/pa-p-cog-service.json +++ b/policyAssignments/prod/pa-p-cog-service.json @@ -28,7 +28,9 @@ "COG-005_listOfAllowedFormats": { "value": [ "xAI", - "OpenAI" + "OpenAI", + "Anthropic", + "Fireworks" ] }, "COG-006_Effect": { @@ -37,7 +39,9 @@ "COG-006_listOfAllowedNames": { "value": [ "gpt-4.1", + "gpt-5-mini", "gpt-5.4", + "gpt-5.5", "gpt-5.3-codex" ] }, @@ -49,6 +53,23 @@ "grok-4", "grok-4-1-fast-reasoning" ] + }, + "COG-008_Effect": { + "value": "Deny" + }, + "COG-008_listOfAllowedNames": { + "value": [ + "claude-opus-4-8", + "claude-opus-5" + ] + }, + "COG-009_Effect": { + "value": "Deny" + }, + "COG-009_listOfAllowedNames": { + "value": [ + "FW-Kimi-K3" + ] } }, "nonComplianceMessages": [ diff --git a/policyInitiatives/polset-cognitive-service.json b/policyInitiatives/polset-cognitive-service.json index a4473e2..4fe6113 100644 --- a/policyInitiatives/polset-cognitive-service.json +++ b/policyInitiatives/polset-cognitive-service.json @@ -123,6 +123,48 @@ "displayName": "COG-007 Allowed Model Names for xAI format", "description": "List of Model Names that are allowed to be deployed." } + }, + "COG-008_Effect": { + "type": "String", + "metadata": { + "displayName": "COG-008 Effect: Cognitive Services Deployments should only use approved Models from Anthropic", + "description": "'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. 'Deny' blocks the resource creation. 'Disable' turns off the policy." + }, + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny" + }, + "COG-008_listOfAllowedNames": { + "type": "Array", + "defaultValue": [], + "metadata": { + "displayName": "COG-008 Allowed Model Names for Anthropic format", + "description": "List of Model Names that are allowed to be deployed." + } + }, + "COG-009_Effect": { + "type": "String", + "metadata": { + "displayName": "COG-009 Effect: Cognitive Services Deployments should only use approved Models from Fireworks", + "description": "'Audit' allows a non-compliant resource to be created, but flags it as non-compliant. 'Deny' blocks the resource creation. 'Disable' turns off the policy." + }, + "allowedValues": [ + "Audit", + "Deny", + "Disabled" + ], + "defaultValue": "Deny" + }, + "COG-009_listOfAllowedNames": { + "type": "Array", + "defaultValue": [], + "metadata": { + "displayName": "COG-009 Allowed Model Names for Fireworks format", + "description": "List of Model Names that are allowed to be deployed." + } } }, "policyDefinitionGroups": [ @@ -261,6 +303,44 @@ "ISO27001-2013_A.12.5.1", "ISO27001-2013_A.14.2.4" ] + }, + { + "policyDefinitionReferenceId": "COG-008", + "policyDefinitionId": "{policyLocationResourceId}/providers/Microsoft.Authorization/policyDefinitions/pol-restrict-cog-model-names", + "parameters": { + "effect": { + "value": "[parameters('COG-008_Effect')]" + }, + "modelFormat": { + "value": "Anthropic" + }, + "listOfAllowedNames": { + "value": "[parameters('COG-008_listOfAllowedNames')]" + } + }, + "groupNames": [ + "ISO27001-2013_A.12.5.1", + "ISO27001-2013_A.14.2.4" + ] + }, + { + "policyDefinitionReferenceId": "COG-009", + "policyDefinitionId": "{policyLocationResourceId}/providers/Microsoft.Authorization/policyDefinitions/pol-restrict-cog-model-names", + "parameters": { + "effect": { + "value": "[parameters('COG-009_Effect')]" + }, + "modelFormat": { + "value": "Fireworks" + }, + "listOfAllowedNames": { + "value": "[parameters('COG-009_listOfAllowedNames')]" + } + }, + "groupNames": [ + "ISO27001-2013_A.12.5.1", + "ISO27001-2013_A.14.2.4" + ] } ] } diff --git a/tests/policy-integration-tests/cognitive-service/main.good.bicep b/tests/policy-integration-tests/cognitive-service/main.good.bicep index d01db86..e29314e 100644 --- a/tests/policy-integration-tests/cognitive-service/main.good.bicep +++ b/tests/policy-integration-tests/cognitive-service/main.good.bicep @@ -48,7 +48,7 @@ resource gpt41 'Microsoft.CognitiveServices/accounts/deployments@2025-12-01' = { } properties: { model: { - name: 'gpt-4.1' + name: 'gpt-5.4' format: 'OpenAI' } }