Test Azure Policy evaluation while enforcement is disabled

Source facts

Microsoft’s Policy-as-Code workflow uses disabled enforcementMode during integration testing so resource creation and updates are not blocked while existing resources are still audited. It recommends a dedicated validation resource group or subscription even in that mode. The source explicitly calls for PUT and PATCH testing, compliant and noncompliant resources, and edge cases such as a missing property. Disabling enforcement does not replace those tests. Microsoft Learn.

Applicability

This is an Azure Policy assignment test, not a Machine Configuration choice about correcting guest settings. Establish the expected evaluation for each test resource before using its reported compliance as evidence.

DSE recommendation

Use a dedicated validation scope and test expected compliant, noncompliant and missing-property cases before enabling enforcement. Have the definition author and resource owner agree which create and update operations represent real deployments. Include a negative example that should fail the intended requirement; a collection containing only compliant resources cannot demonstrate that the rule detects the condition of interest.

Verification

Record each tested operation, resulting resource properties and reported policy evaluation. Compare actual findings with the predicted outcome and investigate both false positives and false negatives. Keep successful deployment separate from correct policy evaluation while blocking is disabled. Only advance the definition after mismatches are resolved, preserving the test inputs and results so a later rule change can be evaluated against the same cases.

Official references

Microsoft Learn: Azure Policy as Code workflows. Source reviewed September 9, 2026.