title: Is there a way to deny creation of web app's without a network rule defined
body: <p>I am trying to deny creation of web apps in azure that do not have network rules defined. </p>
  
  <p>I am trying to using Azure Policy for this, but am unable to get the policy to work. I have identified the policy aliases that hold the configuration in Azure:</p>
  
  <pre><code>Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].vnetSubnetResourceId
  Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].vnetTrafficTag
  Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].subnetTrafficTag
  Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].action
  Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].tag
  Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].priority
  Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].name
  Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].description
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*].ipAddress
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*].subnetMask
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*].vnetSubnetResourceId
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*].vnetTrafficTag
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*].subnetTrafficTag
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*].action
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*].tag
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*].priority
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*].name
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*].description                  
  Microsoft.Web/sites/config/web.scmIpSecurityRestrictions[*]
  </code></pre>
  
  <p>But the policy that I have tride does not work, this is the latest iteration:</p>
  
  <pre><code>{
    "mode": "All",
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Web/sites"
          },
          {
            "not": {
              "field": "Microsoft.Web/sites/config/web.ipSecurityRestrictions[*].action",
              "equals": "deny"
            }
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    },
    "parameters": {}
  }
  </code></pre>
  
  <p>I am trying to look in the array for a "deny" action, if this is defined then no action is needed, else deny. But the policy does nothing, I can deploy web app with and without network rules.</p>