Publish generated Azure Policy JSON through an explicit deployment step

Source facts

Microsoft states that the Azure Policy extension can generate policy-definition JSON from a constraint or mutation template, but does not create the definition in Azure. The generated fields still need completion, followed by creation through the portal or a supported SDK. Microsoft Learn.

Applicability

Apply this review when a team uses the extension to prepare a Kubernetes-related policy definition. Identify the generated file, unfinished fields and intended Azure definition scope. Treat the editor artifact and the deployed policy object as separately reviewable states.

DSE recommendation

DSE recommends assigning an owner for the transition from generated JSON to an approved definition. Review every placeholder, keep the completed file under the established change process and choose an explicit publishing mechanism. Avoid reporting the policy as deployed from an editor screenshot. Confirm assignment intent separately after the definition has been created.

Verification

Compare the approved local JSON with the definition retrieved from the intended Azure scope. Confirm that the deployed object has the expected identifier and completed values. Record creation evidence and any later assignment as distinct steps. If the object is absent, report the work as prepared but unpublished rather than interpreting successful generation as enforcement.

Official references

Microsoft Learn: Azure Policy extension for Visual Studio Code.