Restricting VM Sizes with Azure Policy

What Azure Policy Is

Azure Policy is a cloud governance service that evaluates resources in Microsoft Azure by comparing their properties to business rules defined in JSON format. It allows organizations to enforce standards, achieve compliance, and guard against unintended costs across subscriptions and management groups.

How It Meets the Restriction Requirement

By assigning the built-in Allowed virtual machine size SKUs definition through Azure Policy, administrators can explicitly define an allowlist of permitted VM sizes (such as standard B-series or general-purpose SKUs). When a developer attempts to deploy a VM size that is not on the allowed list, Azure Policy evaluates the request during the ARM deployment phase and immediately denies resource creation, proactively preventing budget overruns.

Key Advantages and Capabilities

• Proactive governance: Blocks non-compliant and expensive resource deployments before any charges accrue.
• Built-in definitions: Provides ready-to-use policies specifically designed for compute SKU control and location limits.
• Hierarchical assignment: Can be applied at the Management Group, Subscription, or Resource Group scope.
• Automated compliance reporting: Continuously audits existing environments for policy compliance.
• Remediation capabilities: Supports automated remediation tasks for resources requiring configuration updates.

Why This Is Optimal

Unlike passive monitoring tools that notify administrators only after charges have already started, Azure Policy acts as an automated guardrail at the deployment layer. This makes it the most effective governance mechanism to restrict VM sizes and control infrastructure spending.