Azure Policy to Auto Associate Resources to NSP

Hi @Suchitra Suregaunkar so I had already tried re-evaluating compliance and creating a new remediation task however that did not work as mentioned in my initial post too. Please let me know how can I debug it further, thanks!

Hello @Tapasya Sharma @Tapasya Sharma

The issue is not with remediation tasks or ResourceDiscoveryMode. The root cause is an incorrect existenceCondition implementation in the deployIfNotExists policy.

Because the existenceCondition never evaluates to true, Azure Policy:

• Marks all resources as non‑compliant
• Never finds a valid policy evaluation result
• Causes remediation tasks to fail with NoPolicyEvaluationResult
• Does not auto‑associate new resources to the NSP

This behavior is expected when existenceCondition does not correctly match the related resource.

Your policy checks this condition:

{
  "field": "name",
  "equals": "[concat('nsp-OrganizationMasterNSP-PPE/', field('name'), '_association')]"
}

This is invalid for deployIfNotExists because:

• existenceCondition is evaluated against the related resource
• field('name') inside existenceCondition refers to the resourceAssociation, not the original Storage / Key Vault / Cosmos DB resource
• NSP resource association names are system‑generated and not guaranteed to match this constructed value

As a result, Azure Policy never detects an existing association, even when one exists.

Supported Way to Validate NSP Association:

deployIfNotExists should validate properties of the related resource, not its constructed name.

For Network Security Perimeter associations, Microsoft exposes policy aliases that must be used.

Correct Existence Check which is supported:

Validate:

1. The association points to the evaluated resource
2. The access mode is Enforced

"existenceCondition": {
  "allOf": [
    {
      "field": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations/privateLinkResource.id",
      "equals": "[field('id')]"
    },
    {
      "field": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations/accessMode",
      "equals": "Enforced"
    }
  ]
}

Update the policy to use property‑based existenceCondition

Re‑assign the policy (or trigger re‑evaluation)

Run remediation for existing resources

Validate via Policy Compliance → Compliance Details

Reference: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-deploy-if-not-exists

Azure Policy aliases for NSP resource associations confirms supported fields like privateLinkResource.id and accessMode:

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-basics#aliases

https://policyalias.mats.codes/Microsoft.Network/networkSecurityPerimeters-resourceAssociations/

Network Security Perimeter – Resource Associations schema:

https://learn.microsoft.com/en-us/azure/templates/microsoft.network/networksecurityperimeters/resourceassociations?pivots=deployment-language-bicep

Thanks,
Suchitra.

Hello @Tapasya Sharma @Tapasya Sharma

Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it".

Thanks,
Suchitra.

Hello Tapasya Sharma, If you updated the policy definition, reassigned it, and created a new resource but it still doesn’t work, the next step is to confirm whether Azure Policy is evaluating the resource at all. The NoPolicyEvaluationResult error almost always means the resource never matched the policy rule, so Azure Policy never produced a compliance record.

There may be some structural changes required, which could be the reason you’re seeing the NoPolicyEvaluationResult error and why new resources aren’t being auto‑associated.

Policy Mode change:

Your policy uses:  "mode": "Indexed"

Indexed mode only evaluates resources that support tags and location indexing, and many network or child resources used by NSP policies are not evaluated in this mode.

Because of this Azure Policy never evaluates your rule, no compliance record is generated and Remediation shows NoPolicyEvaluationResult.

You can modify to: "mode": "All" and then reassign the policy.

Modify existenceCondition:

Your existence condition checks the name:

{   
"field": "name",   
"equals": "[concat('nsp-OrganizationMasterNSP-PPE/', field('name'), '_association')]" 
}

This is not reliable for DeployIfNotExists because Azure Policy evaluates existence by resource properties, not by constructed names. If the name does not match exactly, policy thinks the resource does not exist, but at the same time evaluation may fail.

Also, checking:

{  
 "field": "type",   
"equals": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations" 
}

It seems inside existenceCondition is unnecessary.

 Instead check the associated resource id:

"existenceCondition": {   
"field": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations/privateLinkResource.id",  
 "equals": "[field('id')]" 
}

This confirms the resource is already associated to the NSP.

Missing existenceScope: Because the association resource is in a different resource group (MOR-PME-PPE), Azure Policy may not find it during evaluation.

Your policy currently only has:

"resourceGroupName": "MOR-PME-PPE"

But DeployIfNotExists also needs existenceScope. To fix this you can add existenceScope

"existenceScope": "resourceGroup"

Policy Might Not Re-Evaluate New Resources Immediately. Even after fixing the policy, the policy evaluation runs every ~30 minutes. DeployIfNotExists runs after evaluation

You can trigger it manually and Wait 10–15 minutes.

az policy state trigger-scan --subscription <subscription-id>

Hope this helps! Thanks

Hi @Suchitra Suregaunkar @Bharath Y P Thank you for the suggestions. I incorporated them and created a new JSON which has been shared with Suchitra over chat. However, I received the same error code after modifying the JSON. Could you please help identify the issue? Thank you.