You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-network-manager/how-to-exclude-elements.md
+58-44Lines changed: 58 additions & 44 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -60,12 +60,10 @@ List of supported operators:
60
60
## Basic editor
61
61
62
62
Assume you have the following virtual networks in your subscription. Each virtual network has an associated tag named **environment** with the respective value of *Production* or *Test*.
63
-
* VNet-A-EastUS - *Production*
64
-
* VNet-A-WestUS - *Production*
65
-
* VNet-B-WestUS - *Test*
66
-
* VNet-C-WestUS - *Test*
67
-
* VNetA - *Production*
68
-
* VNetB - *Test*
63
+
* myVNet01-EastUS - *Production*
64
+
* myVNet01-WestUS - *Production*
65
+
* myVNet02-WestUS - *Test*
66
+
* myVNet03-WestUS - *Test*
69
67
70
68
You only want to select virtual networks that contain **VNet-A** in the name. To begin using the basic editor to create your conditional statement, you need to create a new network group.
71
69
@@ -74,8 +72,8 @@ You only want to select virtual networks that contain **VNet-A** in the name. To
74
72
1. Select the network group from the list and select **Create Azure Policy**.
75
73
1. Enter a **Policy name** and leave the **Scope** selections unless changes are needed.
76
74
1. Under **Criteria**, select **Name** from the drop-down under **Parameter** and then select **Contains** from the drop-down under *Operator*.
77
-
1. Enter **VNET-A** under **Condition**, then select **Save**.
78
-
1. After a few minutes, select your network group and select **Group Members** under **Settings**. You should only see VNet-A-EastUS, VNet-A-WestUS, and VNetA show up in the list.
75
+
1. Enter **WestUS** under **Condition**, then select **Save**.
76
+
1. After a few minutes, select your network group and select **Group Members** under **Settings**. You should only see myVNet01-WestUS, myVNet02-WestUS, and myVNet03-WestUS show up in the list.
79
77
80
78
> [!IMPORTANT]
81
79
> The **basic editor** is only available during the creation of an Azure Policy. Once a policy is created, all edits will be done using JSON in the **Policies** section of virtual network manager or via Azure Policy.
@@ -84,41 +82,57 @@ You only want to select virtual networks that contain **VNet-A** in the name. To
84
82
85
83
## Advanced editor
86
84
87
-
The advanced editor can be used to select virtual network during the creation of a network group or when updating an existing network group. Based in [JSON](../governance/policy/concepts/assignment-structure.md), the advanced editor is useful for creating and updating complex Azure Policy conditional statements by experienced users.
85
+
The advanced editor can be used to select virtual networks during the creation of a network group or when updating an existing network group. Based in [JSON](../governance/policy/concepts/assignment-structure.md), the advanced editor is useful for creating and updating complex Azure Policy conditional statements by experienced users.
88
86
89
-
1. Select the network group created in the previous section. Then select the **Conditional statements** tab.
87
+
### Create a new policy with advanced editor
90
88
91
-
1. You'll see the conditional statements for the network group in the advance editor view as followed:
89
+
1. Go to your Azure Virtual Network Manager instance and select **Network Groups** under **Settings**. Then select **+ Create** to create a new network group.
90
+
1. Enter a **Name** and an optional **Description** for the network group, and select **Add**.
91
+
1. Select the network group from the list and select **Create Azure Policy**.
92
+
1. Enter a **Policy name** and leave the **Scope** selections unless changes are needed.
93
+
1. Under **Criteria**, select **Advanced (JSON) editor** to open the editor.
94
+
1. Enter the following JSON code into the text box and select **Save**:
92
95
93
-
```json
94
-
{
96
+
```json
97
+
{
95
98
"allOf": [
96
-
{
97
-
"field": "tags['Environment']",
98
-
"exists": true
99
-
},
100
99
{
101
100
"field": "Name",
102
-
"contains": "VNet-A"
101
+
"contains": "myVNet01"
103
102
}
104
103
]
105
-
}
106
-
```
104
+
}
105
+
```
106
+
1. After a few minutes, select your network group and select **Group Members** under **Settings**. You should only see myVNet01-WestUS and myVNet01-EastUS.
107
107
108
-
The `"allOf"` parameter contains both the conditional statements that are separated by the **AND** logical operator.
108
+
### Edit an existing policy
109
+
110
+
1. Select the network group created in the previous section. Then select the **Policies** tab.
111
+
1. Select the policy created in the previous section.
112
+
1. You'll see the conditional statements for the network group in the advance editor view as follows:
113
+
114
+
```json
115
+
[
116
+
{
117
+
"allOf": [
118
+
{
119
+
"field": "Name",
120
+
"contains": "myVNet01"
121
+
}
122
+
]
123
+
}
124
+
]
125
+
```
109
126
110
127
1. To add another conditional statement for a **Name** field *not containing* **WestUS**, enter the following into the advanced editor:
111
128
112
129
```json
113
130
{
114
131
"allOf": [
115
-
{
116
-
"field": "tags['Environment']",
117
-
"exists": true
118
-
},
132
+
119
133
{
120
134
"field": "Name",
121
-
"contains": "VNet-A"
135
+
"contains": "VNet01"
122
136
},
123
137
{
124
138
"field": "Name",
@@ -128,9 +142,9 @@ The advanced editor can be used to select virtual network during the creation of
128
142
}
129
143
```
130
144
131
-
1. Then select **Evaluate**. You should only see VNet-A-EastUS virtual network in the list.
132
-
133
-
1. Select **Review + save** and then select **Save** once validation has passed.
145
+
The `"allOf"` parameter contains both the conditional statements that are separated by the **AND** logical operator.
146
+
1. Select Save.
147
+
1. After a few minutes, select your network group and select **Group Members** under **Settings**. You should only see myVNet01-EastUS.
134
148
135
149
See [Parameter and operators](#parameters) for the complete list of parameters and operators you can use with the advanced editor. See below for more examples:
136
150
@@ -151,11 +165,11 @@ This example uses the **OR** logical operator to separate two conditional statem
151
165
"anyOf": [
152
166
{
153
167
"field": "Name",
154
-
"contains": "VNet-A"
168
+
"contains": "myVNet01"
155
169
},
156
170
{
157
171
"field": "Name",
158
-
"contains": "VNetB"
172
+
"contains": "myVNet02"
159
173
}
160
174
]
161
175
}
@@ -178,11 +192,11 @@ The `"anyOf"` parameter contains both the conditional statements that are separa
178
192
"anyOf": [
179
193
{
180
194
"field": "Name",
181
-
"contains": "VNet-A"
195
+
"contains": "myVNet01"
182
196
},
183
197
{
184
198
"field": "Name",
185
-
"contains": "VNetB"
199
+
"contains": "myVNet02"
186
200
}
187
201
]
188
202
},
@@ -197,23 +211,23 @@ Both `"allOf"` and `"anyOf"` are used in the code. Since the **AND** operator is
197
211
198
212
### Example 3: Using custom tag values with advanced editor
199
213
200
-
In this example, a conditional statement is created that finds virtual networks where a tag exists for **environment** AND the **environment** tag equals **production**.
214
+
In this example, a conditional statement is created that finds virtual networks where the name includes **myVNet** AND the **environment** tag equals **production**.
0 commit comments