From 9b4fdcc824c0934291323d99dc7c34184351c404 Mon Sep 17 00:00:00 2001
From: Dalibor Kovacevic <56942801+RobiladK@users.noreply.github.com>
Date: Fri, 10 Jul 2026 12:31:14 -0700
Subject: [PATCH] Add SRE Agent model provider policy

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../azurepolicy.json                          | 64 +++++++++++++++++++
 .../azurepolicy.parameters.json               | 25 ++++++++
 .../azurepolicy.rules.json                    | 25 ++++++++
 3 files changed, 114 insertions(+)
 create mode 100644 policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.json
 create mode 100644 policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.parameters.json
 create mode 100644 policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.rules.json

diff --git a/policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.json b/policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.json
new file mode 100644
index 00000000..bca04ad2
--- /dev/null
+++ b/policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.json
@@ -0,0 +1,64 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2020-10-01/policyDefinition.json#",
+  "name": "d56cddda-67d5-41d1-9b2d-4d9269e5c675",
+  "type": "Microsoft.Authorization/policyDefinitions",
+  "properties": {
+    "displayName": "SRE Agent should use only approved AI model providers",
+    "description": "Audits or denies Microsoft.App/agents resources without an explicitly configured approved default AI model provider. Assign Audit first to inventory existing agents before enforcing Deny.",
+    "mode": "All",
+    "metadata": {
+      "category": "General",
+      "version": "1.0.0"
+    },
+    "parameters": {
+      "allowedModelProviders": {
+        "type": "Array",
+        "metadata": {
+          "displayName": "Allowed AI model providers",
+          "description": "The SRE Agent default model providers that are permitted. The control plane currently represents Azure AI Foundry as MicrosoftFoundry."
+        },
+        "defaultValue": [
+          "MicrosoftFoundry"
+        ]
+      },
+      "effect": {
+        "type": "String",
+        "metadata": {
+          "displayName": "Effect",
+          "description": "Audit, Deny, or disable the policy."
+        },
+        "allowedValues": [
+          "Audit",
+          "Deny",
+          "Disabled"
+        ],
+        "defaultValue": "Audit"
+      }
+    },
+    "policyRule": {
+      "if": {
+        "allOf": [
+          {
+            "field": "type",
+            "equals": "Microsoft.App/agents"
+          },
+          {
+            "anyOf": [
+              {
+                "field": "Microsoft.App/agents/defaultModel.provider",
+                "exists": "false"
+              },
+              {
+                "field": "Microsoft.App/agents/defaultModel.provider",
+                "notIn": "[parameters('allowedModelProviders')]"
+              }
+            ]
+          }
+        ]
+      },
+      "then": {
+        "effect": "[parameters('effect')]"
+      }
+    }
+  }
+}
diff --git a/policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.parameters.json b/policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.parameters.json
new file mode 100644
index 00000000..7a0b9064
--- /dev/null
+++ b/policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.parameters.json
@@ -0,0 +1,25 @@
+{
+  "allowedModelProviders": {
+    "type": "Array",
+    "metadata": {
+      "displayName": "Allowed AI model providers",
+      "description": "The SRE Agent default model providers that are permitted. The control plane currently represents Azure AI Foundry as MicrosoftFoundry."
+    },
+    "defaultValue": [
+      "MicrosoftFoundry"
+    ]
+  },
+  "effect": {
+    "type": "String",
+    "metadata": {
+      "displayName": "Effect",
+      "description": "Audit, Deny, or disable the policy."
+    },
+    "allowedValues": [
+      "Audit",
+      "Deny",
+      "Disabled"
+    ],
+    "defaultValue": "Audit"
+  }
+}
diff --git a/policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.rules.json b/policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.rules.json
new file mode 100644
index 00000000..770b2126
--- /dev/null
+++ b/policyDefinitions/General/sre-agent-should-use-only-approved-ai-model-providers/azurepolicy.rules.json
@@ -0,0 +1,25 @@
+{
+  "if": {
+    "allOf": [
+      {
+        "field": "type",
+        "equals": "Microsoft.App/agents"
+      },
+      {
+        "anyOf": [
+          {
+            "field": "Microsoft.App/agents/defaultModel.provider",
+            "exists": "false"
+          },
+          {
+            "field": "Microsoft.App/agents/defaultModel.provider",
+            "notIn": "[parameters('allowedModelProviders')]"
+          }
+        ]
+      }
+    ]
+  },
+  "then": {
+    "effect": "[parameters('effect')]"
+  }
+}