New Policy to prevent manual changes from user identities

policyAssignments/dev/pa-d-nsg.json

@@ -49,9 +49,17 @@
           "AzureActiveDirectory",
           "*"
         ]
+      },
+      "NSG-005_Effect": {
+        "value": "Deny"
       }
     },
-    "nonComplianceMessages": []
+    "nonComplianceMessages": [
+      {
+        "policyDefinitionReferenceId": "NSG-005",
+        "message": "PolicyID: NSG-005 Violation in polset-nsg Initiative - Manual changes to Network Security Groups are not allowed."
+      }
+    ]
   },
   "definitionSourceManagementGroupId": "/providers/Microsoft.Management/managementGroups/CONTOSO-DEV",
   "managementGroupId": "CONTOSO-DEV"

policyAssignments/prod/pa-p-nsg.json

@@ -49,9 +49,17 @@
           "AzureActiveDirectory",
           "*"
         ]
+      },
+      "NSG-005_Effect": {
+        "value": "Deny"
       }
     },
-    "nonComplianceMessages": []
+    "nonComplianceMessages": [
+      {
+        "policyDefinitionReferenceId": "NSG-005",
+        "message": "PolicyID: NSG-005 Violation in polset-nsg Initiative - Manual changes to Network Security Groups are not allowed."
+      }
+    ]
   },
   "definitionSourceManagementGroupId": "/providers/Microsoft.Management/managementGroups/CONTOSO",
   "managementGroupId": "CONTOSO"

policyDefinitions/general/pol-restrict-user-arm-api-requests.json

@@ -0,0 +1,53 @@
+{
+    "name": "pol-restrict-user-arm-api-requests",
+    "properties": {
+      "displayName": "Restrict Manual ARM API Requests by User Identity",
+      "description": "This policy enforces Control Plane ARM API requests for resources must come from a non-user identity, which prevents click-ops and enforces resource management are carried out by Infrastructure as Code.",
+      "mode": "All",
+      "metadata": {
+        "category": "General",
+        "version": "1.0.0",
+        "preview": false,
+        "deprecated": false
+      },
+      "parameters": {
+        "resourceTypePrefix": {
+          "type": "string",
+          "metadata": {
+            "description": "The resource type prefix that should be restricted from using manual ARM API requests.",
+            "displayName": "Resource type prefix"
+          }
+        },
+        "effect": {
+          "type": "String",
+          "metadata": {
+            "displayName": "Policy Effect",
+            "description": "The desired effect of the policy."
+          },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Deny"
+        }
+      },
+      "policyRule": {
+        "if": {
+          "allOf": [
+          {
+            "field": "type",
+            "like": "[concat(parameters('resourceTypePrefix'),'*')]"
+          },
+          {
+            "value": "[tryGet(requestContext().identity, 'idtyp')]",
+            "equals": "user"
+          }
+          ]
+        },
+        "then": {
+          "effect": "[parameters('effect')]"
+        }
+      }
+    }
+  }

policyInitiatives/polset-nsg.json

@@ -81,9 +81,26 @@
           "displayName": "NSG-004: Allowed Outbound Service Tags",
           "description": "List of allowed service tags for outbound rules"
         }
+      },
+      "NSG-005_Effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "NSG-005 Effect: Restrict Manual NSG changes by Users",
+          "description": "Enable or disable the execution of the policy"
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Deny"
       }
     },
     "policyDefinitionGroups": [
+      {
+        "name": "ISO27001-2013_A.12.1.2",
+        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/ISO27001-2013_A.12.1.2"
+      },
       {
         "name": "ISO27001-2013_A.12.4.1",
         "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/ISO27001-2013_A.12.4.1"
@@ -156,6 +173,21 @@
         "groupNames": [
           "ISO27001-2013_A.13.1.1"
         ]
+      },
+      {
+        "policyDefinitionReferenceId": "NSG-005",
+        "policyDefinitionId": "{policyLocationResourceId}/providers/Microsoft.Authorization/policyDefinitions/pol-restrict-user-arm-api-requests",
+        "parameters": {
+          "effect": {
+            "value": "[parameters('NSG-005_Effect')]"
+          },
+          "resourceTypePrefix": {
+            "value": "Microsoft.Network/networkSecurityGroups"
+          }
+        },
+        "groupNames": [
+          "ISO27001-2013_A.12.1.2"
+        ]
       }
     ]
   }

tests/policy-integration-tests/network-security-group/README.md

@@ -19,3 +19,9 @@ The following policies are in scope for testing:
 | `pa-d-nsg` | `NSG-003` | Allowed list of Service Tags in Network Security Group Inbound Security Rules | `Deny` |
 | `pa-d-nsg` | `NSG-004` | Allowed list of Service Tags in Network Security Group Outbound Security Rules | `Deny` |
 | `pa-d-diag-settings` | `DS-038` | Diagnostic Settings for Network Security Group Must Be Configured | `DeployIfNotExists` |
+
+The following policies are not in scope for testing:
+
+| Policy Assignment | Policy Reference ID | Policy Name | Policy Effect | Comments |
+| :---------------- | :---------------- | :------------ | :------------ | :------- |
+| `pa-d-nsg` | `NSG-005` | Manual changes to Network Security Groups are not allowed | `Deny` | Unable to perform negative test because it requires a user account |

tests/policy-integration-tests/network-security-group/main.bad.nsg.rule.bicep

@@ -8,7 +8,7 @@ metadata summary = 'Deploys test network security group rule resource that shoul
 // Load the configuration file
 var globalConfig = loadJsonContent('../.shared/policy_integration_test_config.jsonc')
 var namePrefix = globalConfig.namePrefix
-
+//Unable to perform negative test for the deny policy NSG-005: Manual changes to Network Security Groups are not allowed because it requires a user account, which is not possible to simulate in the pipeline.
 // define template specific variables
 var existingServiceShort = 'nsg1'
 var existingNsgName = 'nsg-${namePrefix}-${existingServiceShort}-01'

tests/policy-integration-tests/network-security-group/main.good.nsg.bicep

@@ -15,7 +15,7 @@ var namePrefix = globalConfig.namePrefix
 // define template specific variables
 var serviceShort = 'nsg2'
 var newNsgName = 'nsg-${namePrefix}-${serviceShort}-01'
-
+//This template should be compliant with policy NSG-005: Manual changes to Network Security Groups are not allowed because the pipeline that deploys this template is using a service principal instead of an user account.
 resource nsg 'Microsoft.Network/networkSecurityGroups@2025-05-01' = {
   name: newNsgName
   location: location