---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Set up suspension of a subscription using Azure policy

# Set up suspension of a subscription using Azure policy {#ariaid-title1}

* Release version: Yokohama
* 
* Updated February 14, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Create the policy at the root level to lock or unlock an Azure account. As an Azure administrator, lock an Azure subscription, resource group, or resource to avoid accidental deletions and modifications.

## Before you begin

Make sure you have already configured the permission. For more information, see [Configure account suspension in Azure](https://servicenow-prod.fluidtopics.net/3FYey~W8uBlv5xOzsfAyow "Manage an Azure subscription using the permission and by assigning the role to a user. The role must have the permission to execute the APIs for suspending and reactivating an Azure account.").

Role required: Azure admin

## Procedure

1. Sign in to the Azure organization.
2. Search for and select Users.
3. Under the user name list, select a user.
4. From the navigation pane, select Assigned roles.
5. Under the Administrative roles, add the Global Administrator role by selecting Add Assignments.
6. Enter <kbd class="ph userinput">Microsoft Entra ID</kbd> in the search box and select Microsoft Entra IDProperties.
7. Under Access Management for Azure resources, set the toggle to Yes.  
   Using this option, you can manage access to all Azure subscriptions and management groups in this tenant.
8. Search for and select Policy.
9. Select + Policy definition.
10. Enter the following:  
    1. Select the tenant root group using the ellipsis on Definition location.

       You can select either a management group or a subscription. If you select the tenant root group, all child
       subscriptions can also be managed.
    2. Enter the name of the policy definition. For example, LockAccount_policy.
    3. The description of what the policy definition is intended to do.
    4. Under POLICY RULE, copy the following JSON code:

           {
               "properties": {
                   "displayName": "CAM_LockAccount_Policy",
                   "policyType": "Custom",
                   "mode": "All",
                   "description": "Blocks the creation of resources and configurations that fall under Azure Policy enforcement.",
                   "parameters": {
                       "allowedResourceTypes": {
                           "type": "Array",
                           "metadata": {
                               "displayName": "Allowed Resource Types",
                               "description": "List of resource types that are allowed for creation. Any resource type not listed here will be blocked.",
                               "strongType": "resourceTypes"
                           },
                           "defaultValue": []
                       },
                       "allowedLocations": {
                           "type": "Array",
                           "metadata": {
                               "displayName": "Allowed Locations",
                               "description": "List of allowed Azure regions for resource creation."
                           },
                           "defaultValue": []
                       },
                       "effect": {
                           "type": "String",
                           "metadata": {
                               "displayName": "Effect",
                               "description": "The effect determines what happens when the policy rule is evaluated to match"
                           },
                           "allowedValues": [
                               "Audit",
                               "Deny",
                               "Disabled"
                           ],
                           "defaultValue": "Deny"
                       }
                   },
                   "policyRule": {
                       "if": {
                           "anyOf": [
                               {
                                   "not": {
                                       "field": "type",
                                       "in": "[parameters('allowedResourceTypes')]"
                                   }
                               },
                               {
                                   "not": {
                                       "field": "location",
                                       "in": "[parameters('allowedLocations')]"
                                   }
                               }
                           ]
                       },
                       "then": {
                           "effect": "[parameters('effect')]"
                       }
                   }
               }
           }

    5. Select Save.  
       Note:  
       To verify if the policy is created, go to PolicyDefinitions. Change the filter Scope and Policy type to find the policy.
    6. Select the policy name and copy the Definition ID.

    Note:  
    This Definition ID is required when you [Create a suspend account configuration](https://servicenow-prod.fluidtopics.net/6jc5qmXnlvVOvpjcvDCO9g "Set up a suspension profile that allows temporary suspension or termination of cloud accounts to support cost control or policy enforcement.").

## What to do next

[Setting up Cloud Account Management in Cloud Workspace](https://servicenow-prod.fluidtopics.net/bIbFDj0Fc2oVG0D4Mt89ng "This section covers all the general topics required to set up Cloud Account Management. The topics are arranged in order of configuration priority.")

[Add members to the group](https://servicenow-prod.fluidtopics.net/PWw93S4e12AqJKLntfFFcA "Ensure accurate assignment of members to their respective groups to streamline account requests, approvals, provisioning, and certification. Grant necessary permissions through proper group assignment to prevent unauthorized access and maintain security.")

[Set up Azure connection](https://servicenow-prod.fluidtopics.net/Hq3HCNOX0ygCzS_MAeY67w "Add and configure an Azure connection with your Azure portal. Using the connection credentials, the Cloud Account Management application creates Azure subscriptions. This is a one-time configuration step.")

[Set up scan configuration for data visualization](https://servicenow-prod.fluidtopics.net/da8GmKQw7vuCrVb51Wb4TQ "Visualize all account violations by scanning them using the selected policy set. Display the severity of all violations on the admin dashboard to take appropriate actions.")

*[\>]: and then