I set up a DeployIfNotExists policy to enable diagnostic settings on our storage accounts. After assigning the policy, I manually started a remediation task. The task reports as completed or succeeded, but the diagnostic settings are not added to the resources, and there are no obvious errors in the deployment history.
The managed identity appears to have the required role assignment, and the policy parameters look correct. The only reliable workaround so far has been deleting and recreating a storage account so the policy catches it during creation.
Could stale compliance data or delayed policy evaluation be causing the remediation task to skip these resources? What should I check to determine whether the resources are actually being evaluated as non-compliant or whether the policy definition is matching them incorrectly?
3 Answers
Also inspect the policy's existenceCondition. If it is too broad, Azure may believe the required diagnostic setting already exists even when it is missing a workspace, category, or other expected value. That makes the resource appear compliant and prevents the deployment from running. Comparing the condition against the actual diagnostic settings on an affected account is usually more useful than looking only at the remediation task status.
Check the current compliance state first. DeployIfNotExists only deploys when Azure Policy has evaluated the resource as non-compliant. If the compliance result is stale and still says compliant, the remediation task can show as successful because there was nothing eligible to remediate. Review the Policy Insights compliance details for one affected storage account to see whether it was marked compliant, skipped, or actually selected for remediation.
Give policy evaluation some time before assuming the task failed. You can trigger a policy evaluation or start the remediation through the Azure Policy tooling, but the results are not always immediate. If it still has not changed after roughly a day, check the Activity Log and Policy Insights details for the specific resource, then verify the managed identity permissions and the policy assignment scope.
This can take several hours to catch up. I had a tagging policy behave the same way, and waiting for the next evaluation cycle eventually updated the state. Recreating the resource only appeared to help because it forced a new evaluation.