Resolve Azure Policy Kubernetes template conflicts at their source

Source facts

Azure Policy considers constraint templates conflicting when they share a resource metadata name but their definitions reference different source locations. New conflicting templates are not installed until the conflict is resolved; already installed definitions can continue operating.

Microsoft also says that manually changing templates or constraints installed by the add-on is unsupported and those edits are overwritten. A cluster administrator’s ability to edit the objects is not a supported repair workflow. Microsoft Learn.

Applicability

Review an existing managed cluster with a reported constraint-template conflict. Identify each assignment, template metadata name, source location, and actual installed object before deciding which definition needs correction.

DSE recommendation

DSE recommends resolving the conflicting policy sources through their owners. Record which intended control is missing and which existing control remains active. Preserve the conflicting definitions and avoid an emergency manual cluster edit that the add-on will overwrite. Review the proposed source correction against the approved policy purpose.

Verification

After the authorized correction synchronizes, inspect both the conflict status and the installed template. Use a controlled compliant and noncompliant workload to verify the intended behavior. Confirm previously active controls still function, and retain assignment IDs, template identities, and observed results before closing the incident.

Official references

Microsoft Learn: Learn Azure Policy for Kubernetes. Source retrieved September 9, 2026.