Azure Compute Gallery Image - Unable to interact with Publisher field in Azure Policy

Question

I've created some image definitions and versions in an Azure Compute Gallery. While creating these through the portal I entered the Publisher, Image and SKU fields.
I want to deploy an Azure Policy which limits available images to those which are published by me, under the name 'MyPublisher'.

The Policy definition includes the following rule with the deny effect:

"not": {
              "allOf": [
                {
                  "field": "Microsoft.Compute/imagePublisher",
                  "equals": "MyPublisher"
                }
              ]
        }

I've tested this with against the Ubuntu images in the public Azure Marketplace, using the value of 'Canonical' for the imagePublisher field and verified that the policy works.

While creating the Azure Compute Gallery images through the portal I entered the Publisher, Image and SKU fields.
When I view the images in the portal, these properties are not displayed on their own lines, and seem to somehow have been mashed together -
Publisher :: Offer :: SKU : MyPublisher :: Windows :: Server2019

If I look at the ARM template of the image the properties appear to be present:

{
    "type": "Microsoft.Compute/galleries/images",
    "apiVersion": "2021-10-01",
    "name": "[concat(parameters('gallery_name'), '/mygalleryimage')]",
    "location": "uksouth",
    "properties": {
    "hyperVGeneration": "V2",
    "osType": "Windows",
    "osState": "Generalized",
    "identifier": {
            "publisher": "MyPublisher",
            "offer": "Windows",
            "sku": "Server2019"
        },

I've noticed a difference when I view the ARM template of VM's deployed with my own image or with a public Marketplace image.
My image only contains the property 'id' in the 'imageReference' property of the VM's 'storageProfile' property, whereas the published images contain the expected Publisher, Offer and SKU fields.
Built from Marketplace image:

"imageReference": {
    "publisher": "Canonical",
    "offer": "UbuntuServer",
    "sku": "18_04-lts-gen2",
    "version": "latest"
}

Built from my image:

"imageReference": {
    "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/mycomputerg/providers/Microsoft.Compute/galleries/MyComputeGallery/images/mypublishedimage"
}		

The Publisher, Offer and SKU are all visible when viewing the images through PowerShell commands.

Is this a limitation of the images from the Compute Gallery, or have I made an error in the Policy definition?

Answer 1

Hello,

Did anyone find a solution ?