Azure Policy definition - modify - st_allowCrossTenantReplication

st_allowCrossTenantReplication.json

{
    "name": "st_allowCrossTenantReplication",
    "properties": {
        "DisplayName": "Storage account should disallow cross tenant blob replication",
        "mode": "All",
        "metadata": {
            "category": "Storage"
        },
        "parameters": {
            "effect": {
                "type": "String",
                "allowedValues": [
                    "Deny",
                    "Modify",
                    "Disabled"
                ],
                "defaultValue": "Modify"
            }
        },
        "policyRule": {
            "if": {
                "allOf": [
                    {
                        "field": "type",
                        "equals": "Microsoft.Storage/storageAccounts"
                    },
                    {
                        "not": {
                            "field": "Microsoft.Storage/storageAccounts/allowCrossTenantReplication",
                            "equals": "false"
                        }
                    }
                ]
            },
            "then": {
                "effect": "[parameters('effect')]",
                "details": {
                    "roleDefinitionIds": [
                        "/providers/microsoft.authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab"
                    ],
                    "conflictEffect": "audit",
                    "operations": [
                        {
                            "operation": "addOrReplace",
                            "field": "Microsoft.Storage/storageAccounts/allowCrossTenantReplication",
                            "value": false
                        }
                    ]
                }
            }
        }
    }
}