Azure Policy Definition to Enforce IaC and Restrict Click Ops

This article presents an Azure Policy definition that restricts manual Azure Resource Manager (ARM) API requests from user identities, thereby enforcing Infrastructure as Code (IaC) and reducing configuration drift. The policy uses the requestContext().identity function to deny operations when the caller is a user account, allowing only service principals (e.g., from CI/CD pipelines) to make changes. It includes a resourceTypePrefix parameter for targeting specific resource types or providers, and the author demonstrates its effectiveness by applying it to Network Security Groups and testing with Azure DevOps. The article also discusses important considerations such as testing in non-production environments, policy scope limitations (subscription and below), and exemptions. This is a practical guide for DevOps engineers and cloud architects looking to enforce IaC practices in Azure.