Managing Azure Deny Policies: Exemption Guidelines for Update and Upgrade Operations
Codebeamer AI customer hosted deployment applies Azure Policies to enforce governance and prevent unauthorized changes.
While necessary for security, these policies may block any changes to deployment, for example: applying patches, scaling, and so on. The IaC Azure Policy deployment automatically creates a deny policy exemption in the customer environment.
• The exemption has a short expiration window of about five minutes after deploying the Azure Policy component.
• After expiration, deny policy is fully enforced; all further updates or changes are blocked.
When to exempt deny policy
You must exempt the deny policy before performing:
• IaC patch deployment
• Service patch deployment
• IaC and service patch update
• Any Day-2 operations. For example: scaling, configuration updates, and so on.
Extending Azure Policy exemption
1. Go to > > > . Locate the existing exemption for Codebeamer AI customer hosted deployment.
2. Edit the exemption to update the expiration time. Perform the IaC and service upgrade.
3. After completion, allow the exemption to expire or manually set the expiration time shortly after the upgrade.
For more information, refer Microsoft documentation
az policy exemption | Microsoft Learn.