title: All network port restricted on network security group which have dev Tag
body: <p>I am creating the custom policy with my requirements, I want the definition policy in which &quot;All <strong>network port</strong> should be restricted on <strong>Network Security Group</strong> which has <strong>Tag</strong> of <strong>dev</strong> only&quot;.</p>
  <p>ERROR:
  Failed to parse policy rule: 'Could not find member 'exits' on object of type 'LeafExpressionDefinition'. Path 'exits'.'.</p>
  <p>there are two builtin policy exist in azure policy definition:</p>
  <ol>
  <li><p>All network ports should be restricted on network security groups associated to your virtual machine.
  link <a href="https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2fproviders%2fMicrosoft.Authorization%2fpolicyDefinitions%2f9daedab3-fb2d-461e-b861-71790eead4f6" rel="nofollow noreferrer">https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2fproviders%2fMicrosoft.Authorization%2fpolicyDefinitions%2f9daedab3-fb2d-461e-b861-71790eead4f6</a></p>
  </li>
  <li><p>Require a tag on resource groups.
  link <a href="https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F871b6d14-10aa-478d-b590-94f262ecfa99" rel="nofollow noreferrer">https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F871b6d14-10aa-478d-b590-94f262ecfa99</a></p>
  </li>
  </ol>
  <p>I combine and update my requirements, you can check the created custom policy, I think all is ok.</p>
  <pre><code>{
  &quot;properties&quot;: {
    &quot;displayName&quot;: &quot;All network ports should be restricted on network security groups associated to your virtual machine&quot;,
    &quot;policyType&quot;:&quot;Indexed&quot;,
    &quot;mode&quot;: &quot;All&quot;,
    &quot;description&quot;: &quot;Azure Security Center has identified some of your network security groups' inbound rules to be too permissive. Inbound rules should not allow access from 'Any' or 'Internet' ranges. This can potentially enable attackers to target your resources.&quot;,
    &quot;metadata&quot;: {
      &quot;version&quot;: &quot;3.0.0&quot;,
      &quot;category&quot;: &quot;Security Center&quot;
    },
    &quot;parameters&quot;: {
      &quot;effect&quot;: {
        &quot;type&quot;: &quot;String&quot;,
        &quot;metadata&quot;: {
          &quot;displayName&quot;: &quot;Effect&quot;,
          &quot;description&quot;: &quot;Enable or disable the execution of the policy&quot;
        },
        &quot;allowedValues&quot;: [
          &quot;AuditIfNotExists&quot;,
          &quot;Disabled&quot;
        ],
        &quot;defaultValue&quot;: &quot;AuditIfNotExists&quot;
      },
      &quot;tagName&quot;: {
        &quot;type&quot;: &quot;String&quot;,
        &quot;metadata&quot;: {
          &quot;displayName&quot;: &quot;dev&quot;,
          &quot;description&quot;: &quot;Name of the tag, such as 'develpment'&quot;
        }
      }
    },
    &quot;policyRule&quot;: {
        &quot;if&quot;: {
        &quot;allOf&quot;: [
          {
            &quot;field&quot;:&quot;Microsoft.Network/networkInterfaces/networkSecurityGroup.id&quot;,
             &quot;exits&quot;: &quot;true&quot;
          },
          {
            &quot;field&quot;: &quot;[concat('tags[', parameters('dev'), ']')]&quot;,
           &quot;Equals&quot;: &quot;[parameters('tagValue')]&quot;
          }
        ]
      },
      &quot;then&quot;: {
        &quot;effect&quot;: &quot;[parameters('effect')]&quot;,
        &quot;details&quot;: {
          &quot;type&quot;: &quot;Microsoft.Security/assessments&quot;,
          &quot;name&quot;: &quot;3b20e985-f71f-483b-b078-f30d73936d43&quot;,
          &quot;existenceCondition&quot;: {
            &quot;field&quot;: &quot;Microsoft.Security/assessments/status.code&quot;,
            &quot;in&quot;: [
              &quot;NotApplicable&quot;,
              &quot;Healthy&quot;
            ]
          }
        }
      }
    }
  },
  &quot;id&quot;: &quot;/providers/Microsoft.Authorization/policyDefinitions/9daedab3-fb2d-461e-b861-71790eead4f6&quot;,
  &quot;type&quot;: &quot;Microsoft.Authorization/policyDefinitions&quot;,
  &quot;name&quot;: &quot;9daedab3-fb2d-461e-b861-71790eead4f6&quot;
  }
  </code></pre>
  <p>@syedasadrazadevops</p>