AKS clusters should have the Azure Policy Add-on installed and enabled
Azure Policy Add-on for Kubernetes service (AKS) extends Gatekeeper v3, an admission controller webhook for Open Policy Agent (OPA). It applies at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.
Azure Policy Add-on for Kubernetes service (AKS) extends Gatekeeper v3, an admission controller webhook for Open Policy Agent (OPA), to apply at-scale enforcements and safeguards on your clusters in a centralized, consistent manner. Azure Kubernetes Service should enable Azure Policy Add-On to enforce compliance and governance policies on the cluster.
What this control checks
Checks whether each AKS cluster has the Azure Policy Add-on turned on
Common pitfalls
The effect parameter can turn the policy off
The effect parameter allows Audit and Disabled. Setting it to Disabled stops the policy from evaluating clusters.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Azure Policy Add-on for Kubernetes service (AKS) should be installed and enabled on your clusters" (0a15ec92-a229-4763-bb14-0ea34a568f8d) and "Deploy Azure Policy Add-on to Azure Kubernetes Service clusters" (a8eff44f-8c92-45c3-a3fb-9880802d67a7); PowerPipe controls azure_compliance.control.kubernetes_cluster_add_on_azure_policy_enabled and azure_compliance.control.kubernetes_cluster_addon_azure_policy_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_116; KICS query "AKS Uses Azure Policies Add-On Disabled" (43789711-161b-4708-b5bb-9d1c626f7492); Trivy check AZU-0066.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CM-6 (Configuration Settings).
Framework mappings
The clauses this control is mapped to in each framework.
- Configuration Settings (CM-6)
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- CM-6 Configuration Settings
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_add_on_azure_policy_enabled - Checkov Check:
CKV_AZURE_116 - Powerpipe Controls:
azure_compliance.control.kubernetes_cluster_add_on_azure_policy_enabled,azure_compliance.control.kubernetes_cluster_addon_azure_policy_enabled - Azure Policy Definitions:
0a15ec92-a229-4763-bb14-0ea34a568f8d,a8eff44f-8c92-45c3-a3fb-9880802d67a7 - KICS Query:
43789711-161b-4708-b5bb-9d1c626f7492 - Trivy Check:
AZU-0066
Last reviewed: 2026-10-13