Add policy: Deploy NSP Association for Storage Accounts by Region

[walterzjunior]

New Policy: Deploy NSP Association for Storage Accounts by Region

Category: Network
Effect: DeployIfNotExists / AuditIfNotExists / Disabled

Summary

This policy automatically associates Azure Storage Accounts to a regional
Network Security Perimeter (NSP) using a DeployIfNotExists effect. When a
storage account exists in the specified region without an NSP resource
association, the policy creates one under the target NSP with the configured
access mode (Learning or Enforced).

Use Case

Organizations adopting Network Security Perimeters (GA since November 2025)
need to systematically associate PaaS resources to their regional NSP. This
policy automates the association for Storage Accounts, ensuring consistent
perimeter membership without manual intervention.

Parameters

Parameter	Required	Description
effect	No (default: DeployIfNotExists)	Policy effect
nspName	Yes	Name of the NSP resource
nspResourceGroupName	Yes	Resource group containing the NSP
nspProfileId	Yes	Full resource ID of the NSP profile
accessMode	No (default: Learning)	Learning or Enforced
nspRegion	Yes	Azure region of the NSP

RBAC Roles Required

• Network Contributor (4d97b98b-1d4f-4787-a291-c67834d212e7)
• Storage Account Contributor (17d1049b-9a84-46fb-8f53-869881c3d3ab)

Tested

• Validated in Azure Portal with real NSP and Storage Account resources
• API version: 2025-05-01 (GA)

[walterzjunior]

@microsoft-github-policy-service agree company="Microsoft"