{
   "properties":{
      "displayName":"App Service Environment apps should not be reachable over public internet",
      "policyType":"BuiltIn",
      "mode":"Indexed",
      "description":"To ensure apps deployed in an App Service Environment are not accessible over public internet, one should deploy App Service Environment with an IP address in virtual network. To set the IP address to a virtual network IP, the App Service Environment must be deployed with an internal load balancer.",
      "metadata":{
         "version":"1.0.0",
         "category":"App Service"
      },
      "parameters":{
         "effect":{
            "type":"string",
            "defaultValue":"Audit",
            "allowedValues":[
               "Audit",
               "Deny",
               "Disabled"
            ],
            "metadata":{
               "displayName":"Effect",
               "description":"Enable or disable the execution of the policy"
            }
         }
      },
      "policyRule":{
         "if":{
            "allOf":[
               {
                  "field":"type",
                  "equals":"Microsoft.Web/hostingEnvironments"
               },
               {
                  "field":"kind",
                  "like":"ASE*"
               },
               {
                  "anyOf":[
                     {
                        "allOf":[
                           {
                              "value":"[requestContext().apiVersion]",
                              "less":"2018-02-01"
                           },
                           {
                              "anyOf":[
                                 {
                                    "field":"Microsoft.Web/HostingEnvironments/internalLoadBalancingMode",
                                    "notContains":"2"
                                 },
                                 {
                                    "field":"Microsoft.Web/HostingEnvironments/internalLoadBalancingMode",
                                    "notContains":"3"
                                 }
                              ]
                           }
                        ]
                     },
                     {
                        "allOf":[
                           {
                              "value":"[requestContext().apiVersion]",
                              "greaterOrEquals":"2018-02-01"
                           },
                           {
                              "anyOf":[
                                 {
                                    "field":"Microsoft.Web/HostingEnvironments/internalLoadBalancingMode",
                                    "notContains":"Web"
                                 },
                                 {
                                    "field":"Microsoft.Web/HostingEnvironments/internalLoadBalancingMode",
                                    "notContains":"Publishing"
                                 }
                              ]
                           }
                        ]
                     }
                  ]
               }
            ]
         },
         "then":{
            "effect":"[parameters('effect')]"
         }
      }
   },
   "id":"/providers/Microsoft.Authorization/policyDefinitions/2d048aca-6479-4923-88f5-e2ac295d9af3",
   "name":"2d048aca-6479-4923-88f5-e2ac295d9af3"
}