💡 Feature Request - Policy assignments for private DNS records

[JimmyKarlsson112]

Describe the solution you'd like

Support for private DNS records auto creation in central connectivity subscription and of creation of private DNS zones in Corp landing zone. Docs: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/private-link-and-dns-integration-at-scale

Describe alternatives you've considered

Policy Definitions are in place. Could be good to have a feature toggle (true & false). Support for multi-region would be great but for first iteration one region would suffice.

Additional context

Add any other context or screenshots about the feature request here. 📷

[jtracey93]

Thanks for raising this @JimmyKarlsson112, as discussed offline this is something we are already aware of and will start working on soon.

Stay tuned for a new release 👍

[cloudchristoph]

Just FYI:

I've used policy-based deployments for Private Link DNS zones in the past. The goal was to have auto-deployment policies for all Private DNS records regarding Private Link.

Some of the 'auto-deploy-dns-entry' policies suggested by the responsible Azure Resource Team collides with other policies, because of the way that 'subgroup' is addressed in some policies. See this open issue: https://github.com/Azure/azure-policy/issues/858

There could be more of those issues. Just wanna let you know before implementation.

[jtracey93]

Just FYI:

I've used policy-based deployments for Private Link DNS zones in the past. The goal was to have auto-deployment policies for all Private DNS records regarding Private Link.

Some of the 'auto-deploy-dns-entry' policies suggested by the responsible Azure Resource Team collides with other policies, because of the way that 'subgroup' is addressed in some policies. See this open issue: Azure/azure-policy#858

There could be more of those issues. Just wanna let you know before implementation.

Thanks @cloudchristoph, good spot was talking to a customer and colleague about this just last week (@matt-FFFFFF). You indeed found the fix by including the following in the if condition of the policy to further narrow the PE mapping to a service:

{
  field: "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].privateLinkServiceId",
  contains: "Microsoft.CognitiveServices/accounts" //change this to the associated service you require
}

[jtracey93]

Ado sync

[jtracey93]

ADO 25171