Add policy: Deploy DNS Security Policy VNet Link by Region

[walterzjunior]

New Policy: Deploy DNS Security Policy VNet Link by Region

Category: Network
Effect: DeployIfNotExists / AuditIfNotExists / Disabled

Summary

Automatically creates a DNS Resolver Policy Virtual Network Link for every VNet
using Azure-provided DNS, linking it to the corresponding regional DNS Security
Policy in a central security subscription. Uses a tag-based existence check and
a cross-subscription nested deployment to create the link resource.

Use Case

Organizations using Azure DNS Security Policies (DNS Resolver Policy with security
rules) need to link all VNets to the regional policy. This policy automates the
linking for VNets that use Azure-provided DNS (no custom DNS servers configured).

Parameters

Parameter	Type	Required	Description
effect	String	No (default: DeployIfNotExists)	Policy effect
securitySubscriptionId	String	Yes	Subscription hosting the DNS Resolver Policies
securityResourceGroup	String	Yes	Resource group containing the policies
supportedLocations	Array	Yes	Regions where DNS Security Policies exist
locationToPolicyMap	Object	Yes	Maps region → DNS Resolver Policy name

RBAC Roles Required

• Network Contributor (4d97b98b-1d4f-4787-a291-c67834d212e7)
• Contributor (b24988ac-6180-42a0-ab88-20f7382dd24c) — for cross-subscription deployment

Key Design Decisions

• Cross-subscription nested deployment (VNet in workload sub, link in security sub)
• Tag dnsSecurityPolicyLinked used as existence marker
• Supports multi-region via locationToPolicyMap parameter

Tested

• Validated with Azure DNS Resolver Policies and VNet links
• API version: 2025-10-01-preview (DNS Resolver Policies)