Is it possible to deny vnet peering between subscriptions that are in different management groups with azure policy ?

Question

Hi,

We are in the process of setting up sandbox subscriptions in a dedicated management group and we would like to deny vnet peerings between these subscriptions and production subscriptions which are also in their dedicated management group. Vnet peerings between sandboxes would remain allowed.

Thanks in advance

Answer 1

Absolutely.

Check out this policy here

Use that policy exactly if you want to manually specify which vnets can peer, or you can change the policy condition to a contains and add the required subscription ID.

Important note: "AZ Policy Advertizer" is NOT an official Microsoft website, I personally find it very useful but all information there must be treated as public and validated before usage.

Good luck!