azure-arg-external-evaluation-policy-author

To author an Azure Policy with Azure Resource Graph queries, you design an External Evaluation policy that queries ARG at request-time to decide enforcement. This generates a complete artifact bundle including a policyDefinition.json, test-flow.http, and EXPLANATION.md for review.

Azure Policy External Evaluation is a mechanism that enables enforcement decisions based on live Azure Resource Graph data at request-time. You need it for subscription-scoped resource operations requiring ARG-backed decisions that standard policy definitions cannot evaluate.

You iteratively co-design and validate KQL queries that project a single claim used by the Azure Resource Graph policy. This interactive KQL co-design process ensures the query produces the correct claim before generating the final policy artifacts.

Yes, Azure Policy External Evaluation applies specifically to subscription-scoped resource operations requiring ARG-backed decisions. It evaluates live Azure Resource Graph data at runtime to determine enforcement outcomes for those operations.

Creating an Azure ARG External Evaluation policy outputs a complete artifact bundle containing a policyDefinition.json for the policy shape, a test-flow.http for REST endpoint testing, and an EXPLANATION.md documenting decisions and co-design iterations.

No, authoring Azure Policy External Evaluation policies is a read-only process for policy creation and does not modify customer resources. It solely generates policy artifacts and validates KQL queries against Azure Resource Graph.