Azure Policy for AKS adds scoped enforcement actions
Azure Policy for AKS now provides separate control over where policy auditing and admission enforcement occur.
Scoped enforcement actions combine an action with selected enforcement points, including compliance auditing, the Gatekeeper admission webhook and the now generally available Kubernetes Validating Admission Policy path.
Teams can select multiple enforcement points for one action. When VAP and Gatekeeper validation are both enabled, VAP runs first and Gatekeeper supplies a fallback. Compliance visibility depends on whether the audit enforcement point is included.
Different actions, such as audit and deny, require separate policy assignments.
Partner briefing
- What it is
Scoped enforcement actions for Azure Policy on AKS.
- What’s changing
Separates enforcement-point selection across auditing, Gatekeeper and VAP.
- Why it matters
Provides explicit control over compliance visibility and admission-time denial.
- Who it affects
AKS platform and governance teams.