Repository navigation
Add control-plane Azure Policy walkthroughs to egress samples - #1052
Conversation
Add the custom exact-host Azure Policy definition, assignment parameters, allowed and denied RAI policy examples, and matching walkthroughs to the Python and .NET egress samples. The documentation distinguishes policy effect, assignment enforcement mode, and RAI runtime enforcement, including an optional Default versus DoNotEnforce comparison. Co-authored-by: Evan Mattson <evan.mattson@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 699774a2-7282-41a8-9946-5a8b05ba6c35
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The optional .NET deployment instructions omit a required policy-ID materialization step.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Adds mirrored Azure Policy control-plane walkthroughs to the Python and .NET egress samples.
Changes:
- Adds an exact-host governance policy and assignment parameters.
- Demonstrates compliant and denied RAI-policy writes.
- Documents enforcement modes, optional runtime checks, and cleanup.
| File | Description |
|---|---|
samples/python/.../18-egress-control/README.md |
Links the control-plane walkthrough. |
samples/python/.../control-plane/README.md |
Documents the Python walkthrough. |
samples/python/.../control-plane/policy-definition.json |
Defines host governance rules. |
samples/python/.../control-plane/assignment-parameters.json |
Configures approved hosts and denial. |
samples/python/.../control-plane/rai-policy-allowed.json |
Provides a compliant request. |
samples/python/.../control-plane/rai-policy-denied.json |
Provides a noncompliant request. |
samples/csharp/.../egress-control/README.md |
Links the control-plane walkthrough. |
samples/csharp/.../control-plane/README.md |
Documents the .NET walkthrough. |
samples/csharp/.../control-plane/policy-definition.json |
Mirrors the governance definition. |
samples/csharp/.../control-plane/assignment-parameters.json |
Mirrors assignment parameters. |
samples/csharp/.../control-plane/rai-policy-allowed.json |
Mirrors the compliant request. |
samples/csharp/.../control-plane/rai-policy-denied.json |
Mirrors the noncompliant request. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Add the required azure.yaml materialization step before deploying the accepted policy with the .NET sample. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 699774a2-7282-41a8-9946-5a8b05ba6c35
There was a problem hiding this comment.
🔵 Needs a closer look
Final approval requires human confirmation of the new RAI aliases and live Azure Policy behavior against the preview API.
0 open findings
2 resolved since last review
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
There was a problem hiding this comment.
🟡 Changes recommended
The cleanup instructions need explicit identity-switch guidance to avoid leaving RAI-policy resources behind.
2 open findings
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
Separate administrator cleanup of the policy assignment and definition from developer cleanup of the test RAI policy resources. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 699774a2-7282-41a8-9946-5a8b05ba6c35
There was a problem hiding this comment.
🟢 Approval recommended
The mirrored artifacts are consistent, scoped appropriately, and provide complete setup, verification, boundary, and cleanup guidance.
0 open findings
2 resolved since last review
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
Summary
RequestDisallowedByPolicydenial without requiring a model deployment or running hosted agentenforcementMode, and RAI runtimeegressPolicy.modeDefaultversusDoNotEnforcewhile keeping denied-update and runtime checks optionalThis is a bounded exact-host teaching policy, not the full built-in governance policy. It demonstrates control-plane ARM enforcement and does not claim APES or runtime traffic enforcement.
This public contribution ports and completes the work originally reviewed in microsoft-foundry/foundry-samples-pr#1049.
Validation
bash .github/scripts/validate-sample.sh --language python --sample-dir samples/python/hosted-agents/agent-framework/responses/18-egress-controlbash .github/scripts/validate-sample.sh --language csharp --sample-dir samples/csharp/hosted-agents/agent-framework/egress-controljqgit diff --checkThe original private PR records live West US 2 validation for allowed create, denied create/update, unchanged rejected-update state, hosted-agent outbound behavior, and cleanup. This public port does not change the validated policy definition or request artifacts. The optional
DoNotEnforceflow is documentation-only and was not rerun live as part of this port.