{
   "properties": {
      "displayName": "Audit if Key Vault has no virtual network rules",
      "description": "Audits Key Vault vaults if they do not have virtual network service endpoints set up. More information on virtual network service endpoints in Key Vault is available here: https://docs.microsoft.com/en-us/azure/key-vault/key-vault-overview-vnet-service-endpoints",
      "mode": "Indexed",
      "parameters": {},
      "policyRule": {
         "if": {
            "allOf": [
               {
                  "field": "type",
                  "equals": "Microsoft.KeyVault/vaults"
               },
               {
                  "anyOf": [
                     {
                        "field": "Microsoft.KeyVault/vaults/networkAcls.virtualNetworkRules[*].id",
                        "exists": "false"
                     },
                     {
                        "field": "Microsoft.KeyVault/vaults/networkAcls.virtualNetworkRules[*].id",
                        "notLike": "*"
                     },
                     {
                        "field": "Microsoft.KeyVault/vaults/networkAcls.defaultAction",
                        "equals": "Allow"
                     }
                  ]
               }
            ]
         },
         "then": {
            "effect": "audit"
         }
      }
   }
}