{
   "properties":{
      "displayName":"App Service apps should enable outbound non-RFC 1918 traffic to Azure Virtual Network",
      "policyType":"BuiltIn",
      "mode":"Indexed",
      "description":"By default, if one uses regional Azure Virtual Network (VNET) integration, the app only routes RFC1918 traffic into that respective virtual network. Using the API to set 'vnetRouteAllEnabled' to true enables all outbound traffic into the Azure Virtual Network. This setting allows features like network security groups and user defined routes to be used for all outbound traffic from the App Service app.",
      "metadata":{
         "version":"1.0.0",
         "category":"App Service"
      },
      "parameters":{
         "effect":{
            "type":"string",
            "defaultValue":"AuditIfNotExists",
            "allowedValues":[
               "AuditIfNotExists",
               "Disabled"
            ],
            "metadata":{
               "displayName":"Effect",
               "description":"Enable or disable the execution of the policy"
            }
         }
      },
      "policyRule":{
         "if":{
            "field":"type",
            "equals":"Microsoft.Web/sites"
         },
         "then":{
            "effect":"[parameters('effect')]",
            "details":{
               "type":"Microsoft.Web/sites/config",
               "name":"web",
               "existenceCondition":{
                  "field":"Microsoft.Web/sites/config/vnetRouteAllEnabled",
                  "equals":"true"
               }
            }
         }
      }
   },
   "id":"/providers/Microsoft.Authorization/policyDefinitions/33228571-70a4-4fa1-8ca1-26d0aba8d6ef",
   "name":"33228571-70a4-4fa1-8ca1-26d0aba8d6ef"
}