|
| 1 | +--- |
| 2 | +title: Deploy a Custom Azure Policy in an Azure Extended Zone |
| 3 | +description: Learn how to deploy a custom Azure Policy in an Azure Extended Zone. |
| 4 | +author: svaldesgzz |
| 5 | +ms.author: svaldes |
| 6 | +ms.service: azure-extended-zones |
| 7 | +ms.topic: how-to |
| 8 | +ms.date: 02/12/2026 |
| 9 | +--- |
| 10 | + |
| 11 | +# Create a custom Azure Policy in an Azure Extended Zone |
| 12 | + |
| 13 | +In this article, you learn how to create and deploy a custom Azure Policy in an Extended Zone. |
| 14 | +> [!NOTE] |
| 15 | +> Built-in Azure Policy definitions aren't supported in Extended Zones yet, but Azure Policy does support Azure Extended Zones as part of allow/deny custom policies. Thus, to enforce governance in Extended Zones you must create and deploy custom Azure Policy definitions that are tailored to the unique characteristics of these zones, namely ***extendedLocation***, ***extendedLocation.name***, and ***extendedLocation.type***. You may find it helpful to use built-in policy definitions as a reference when creating your custom policies. |
| 16 | +
|
| 17 | +## Prerequisites |
| 18 | + |
| 19 | +- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn). |
| 20 | + |
| 21 | +- Access to an Extended Zone. For more information, see [Request access to an Azure Extended Zone](request-access.md). |
| 22 | + |
| 23 | +- Basic understanding of Azure Policy. For more information, see [What is Azure Policy?](/azure/governance/policy/overview). |
| 24 | + |
| 25 | +## Sign in to Azure |
| 26 | + |
| 27 | +Sign in to the [Azure portal](https://portal.azure.com) with your Azure account. |
| 28 | + |
| 29 | +## Create a custom Azure Policy in an Azure Extended Zone |
| 30 | + |
| 31 | +In this section, you create a custom Azure Policy in an Extended Zone. |
| 32 | + |
| 33 | +For this example, we created an Allowed Locations policy that restricts the locations where resources can be deployed. |
| 34 | + |
| 35 | +1. In the search box at the top of the portal, enter ***policy***. Select **Policy** from the search results. |
| 36 | + |
| 37 | +1. In **Policy**, navigate to **Authoring → Definitions**. |
| 38 | + |
| 39 | +1. Select **+ Policy definition**. |
| 40 | + |
| 41 | +1. In **Create a policy definition**, fill in the required fields. Use the following table for guidance. |
| 42 | + |
| 43 | +**Required fields:** |
| 44 | + |
| 45 | +| Field | Guidance | |
| 46 | +|------|---------| |
| 47 | +| Definition location | Use a **management group** for enterprise-wide governance (recommended), or a **subscription** for more granular control. | |
| 48 | +| Name | Use a clear, intent-based name (for example, `Deny-NonApproved-Locations`). | |
| 49 | +| Description | Explain what the policy enforces and why. | |
| 50 | +| Category | Use an existing category or create one (for example, *Governance* or *Networking*). | |
| 51 | + |
| 52 | + |
| 53 | +5. Next, define the Policy Rule. In the **Policy rule** section, for this example, enter the following JSON code to create a policy that denies the creation of resources in locations other than an Azure Extended Zone: |
| 54 | + |
| 55 | +```json |
| 56 | +{ |
| 57 | + "mode": "Indexed", |
| 58 | + "parameters": { |
| 59 | + "listOfAllowedLocations": { |
| 60 | + "type": "Array", |
| 61 | + "metadata": { |
| 62 | + "description": "The list of locations that can be specified when deploying resources.", |
| 63 | + "strongType": "location", |
| 64 | + "displayName": "Allowed locations" |
| 65 | + } |
| 66 | + } |
| 67 | + }, |
| 68 | + "policyRule": { |
| 69 | + "if": { |
| 70 | + "allOf": [ |
| 71 | + { |
| 72 | + "field": "location", |
| 73 | + "notIn": "[parameters('listOfAllowedLocations')]" |
| 74 | + }, |
| 75 | + { |
| 76 | + "field": "location", |
| 77 | + "notEquals": "global" |
| 78 | + }, |
| 79 | + { |
| 80 | + "field": "extendedLocation.name", |
| 81 | + "notEquals": "losangeles" |
| 82 | + }, |
| 83 | + { |
| 84 | + "field": "type", |
| 85 | + "notEquals": "Microsoft.AzureActiveDirectory/b2cDirectories" |
| 86 | + } |
| 87 | + ] |
| 88 | + }, |
| 89 | + "then": { |
| 90 | + "effect": "deny" |
| 91 | + } |
| 92 | + } |
| 93 | +} |
| 94 | +``` |
| 95 | +In this example, replace `losangeles` with the name of the Extended Zone location you have access to. You can find the location name in the Azure portal when deploying resources in the Extended Zone, or by using Azure CLI or PowerShell. |
| 96 | +> [!NOTE] |
| 97 | +> The **extendedlocation.name** or similar Extended Zone-specific fields may be highlighted as errors in the json editor. You may disregard this, as you can still successfully save, deploy and enforce the policy with these fields included. |
| 98 | +
|
| 99 | +6. Select **Save** to create the policy definition. |
| 100 | + |
| 101 | + |
| 102 | +## Policy management and monitoring |
| 103 | + |
| 104 | +You can manage and monitor your Azure Policies in the Policy home dashboard in the Azure portal. |
| 105 | + |
| 106 | +## Clean up resources |
| 107 | +If you're done working with resources from this tutorial, use the following steps to delete any of the policy assignments or definitions created above: |
| 108 | + |
| 109 | +1. Select **Definitions** (or **Assignments** if you're trying to delete an assignment) under **Authoring** in the left side of the Azure Policy page. |
| 110 | + |
| 111 | +1. Search for the new initiative or policy definition (or assignment) you want to remove. |
| 112 | + |
| 113 | +1. Right-click the row or select the ellipses at the end of the definition (or assignment), and select **Delete definition** (or **Delete assignment**). |
| 114 | + |
| 115 | +## Related content |
| 116 | +- [What is Azure Policy?](/azure/governance/policy/overview) |
| 117 | +- [What is Azure Extended Zones?](overview.md) |
| 118 | +- [Deploy a virtual machine in an Extended Zone](deploy-vm-portal.md) |
| 119 | +- [Frequently asked questions](faq.md) |
0 commit comments