Kubernetes clusters should have the Azure Policy add-on enabled
Ensure that AKS uses Azure Policies Add-on. The add-on extends Gatekeeper v3, an admission controller webhook for Open Policy Agent (OPA). It is used to enforce compliance and governance policies on the cluster.
Azure Policy Add-on for Kubernetes service (AKS) extends Gatekeeper v3, an admission controller webhook for Open Policy Agent (OPA), to apply at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.
What this control checks
AKS cluster must have the Azure Policy add-on enabled (azure_policy_enabled set to true).
Common pitfalls
Policy triggers when the add-on setting is absent or false
The policy triggers its effect when addonProfiles.azurePolicy.enabled does not exist. It also triggers its effect when addonProfiles.azurePolicy.enabled equals false.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Azure Policy Add-on for Kubernetes service (AKS) should be installed and enabled on your clusters" (0a15ec92-a229-4763-bb14-0ea34a568f8d) and "Deploy Azure Policy Add-on to Azure Kubernetes Service clusters" (a8eff44f-8c92-45c3-a3fb-9880802d67a7).
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_116; KICS query "AKS Uses Azure Policies Add-On Disabled" (43789711-161b-4708-b5bb-9d1c626f7492); Trivy check AZU-0066.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_addon_azure_policy_enabled - Checkov Check:
CKV_AZURE_116 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_addon_azure_policy_enabled - Azure Policy Definitions:
0a15ec92-a229-4763-bb14-0ea34a568f8d,a8eff44f-8c92-45c3-a3fb-9880802d67a7 - KICS Query:
43789711-161b-4708-b5bb-9d1c626f7492 - Trivy Check:
AZU-0066
Last reviewed: 2026-10-13