Controlling Azure Hybrid Benefit for Windows Server

Errant use of the Azure Hybrid Benefit for Windows Server could leave organizations with significant license noncompliance risks. An Azure Policy template (shown here) can control where the Azure Hybrid Benefit for Windows Server can be used within an Azure tenancy, which can reduce the risk.

The Azure Hybrid Benefit for Windows Server allows server OS rental fees to be waived for Azure VMs it has been configured on. However, there has been no technical way to constrain the benefit to qualified VMs. In a software audit, an organization might have to make expensive retroactive payments to cover overuse of the benefit.

Azure Policy is a service that helps administrators manage how Azure resources are deployed by their organizations. With the service and the new template, Azure administrators can deny use of the Hybrid Benefit everywhere that the benefit should not be permitted. The administrator shown here has navigated to the Azure Policy blade in the Azure portal and searched for policy templates with names containing “Deny,” returning this sole entry. From here, the administrator can assign the policy to an Azure management group, subscription, or resource group. The policy can also be added to new initiatives (collection of policies) or added to new blueprints within the Azure Blueprints infrastructure.