Share via

az policy assignment

Manage policy assignments.

Policy assignments are used to apply a policy definition or policy set definition to a given resource scope.

Commands

Name Description Type Status
az policy assignment create

Create a policy assignment.

 Core GA
az policy assignment delete

Delete a policy assignment.

 Core GA
az policy assignment identity

Managed identity of the policy assignment.

 Core GA
az policy assignment identity assign

Assign a managed identity.

 Core GA
az policy assignment identity remove

Remove the managed identity.

 Core GA
az policy assignment identity show

Retrieve the managed identity.

 Core GA
az policy assignment list

Retrieve all applicable policy assignments.

 Core GA
az policy assignment non-compliance-message

Non-compliance message used by the policy assignment.

 Core GA
az policy assignment non-compliance-message create

Create a non-compliance message.

 Core GA
az policy assignment non-compliance-message delete

Delete a non-compliance message.

 Core GA
az policy assignment non-compliance-message list

Retrieve non-compliance messages.

 Core GA
az policy assignment non-compliance-message show

Retrieve a non-compliance message.

 Core GA
az policy assignment non-compliance-message update

Update a non-compliance message.

 Core GA
az policy assignment show

Retrieve a policy assignment.

 Core GA
az policy assignment update

Update a policy assignment.

 Core GA

az policy assignment create

Edit

Create a policy assignment.

Create a policy assignment with the given scope and name. Policy assignments apply to all resources contained within their scope. For example, when you assign a policy at resource group scope, that policy applies to all resources in the group.

az policy assignment create [--assign-identity --mi-system-assigned --system-assigned]
                            [--definition-version]
                            [--description]
                            [--display-name]
                            [--enforcement-mode {Default, DoNotEnforce}]
                            [--identity-scope]
                            [--___location]
                            [--metadata]
                            [--mi-user-assigned --user-assigned]
                            [--name]
                            [--non-compliance-messages]
                            [--not-scopes]
                            [--overrides]
                            [--params]
                            [--policy]
                            [--policy-set-definition]
                            [--resource-group]
                            [--resource-selectors]
                            [--role]
                            [--scope]

Examples

Create a resource policy assignment at scope

az policy assignment create --scope "/providers/Microsoft.Management/managementGroups/{managementGroupName}" --policy {policyName} -p "{ 'allowedLocations': { 'value': [ 'australiaeast', 'eastus', 'japaneast' ] } }"

Create a resource policy assignment and provide rule parameter values

az Create a resource policy assignment and provide rule parameter values policy assignment create --policy {policyName} -p "{ 'allowedLocations': { 'value': [ 'australiaeast', 'eastus', 'japaneast' ] } }"

Create a resource policy assignment with a system assigned identity

az policy assignment create --name myPolicy --policy {policyName} --mi-system-assigned --___location eastus

Create a resource policy assignment with a system assigned identity with Contributor role access to the subscription

az policy assignment create --name myPolicy --policy {policyName} --mi-system-assigned --identity-scope /subscriptions/{subscriptionId} --role Contributor --___location eastus

Create a resource policy assignment with a user assigned identity

az policy assignment create --name myPolicy --policy {policyName} -g MyResourceGroup --mi-user-assigned myAssignedId --___location westus

Create a resource policy assignment with an enforcement mode

az policy assignment create --name myPolicy --policy {policyName} --enforcement-mode DoNotEnforce

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--assign-identity --mi-system-assigned --system-assigned

Sets the system assigned managed identity.

Property Value
Parameter group: Identity Arguments
--definition-version

The policy version to assign.

Property Value
Parameter group: Properties Arguments
--description

Policy assignment description.

Property Value
Parameter group: Properties Arguments
--display-name

The display name of the policy assignment.

Property Value
Parameter group: Properties Arguments
--enforcement-mode -e

The policy assignment enforcement mode.

Property Value
Parameter group: Properties Arguments
Default value: Default
Accepted values: Default, DoNotEnforce
--identity-scope

Scope that the system assigned identity can access.

--___location -l

The ___location of the policy assignment.

Property Value
Parameter group: Parameters Arguments
--metadata

The policy assignment metadata. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Properties Arguments
--mi-user-assigned --user-assigned

Sets the user assigned managed identity. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Identity Arguments
--name -n

The name of the policy assignment.

--non-compliance-messages -m

The messages that describe why a resource is non-compliant with the policy. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: non-compliance-message Arguments
--not-scopes

The policy assignment excluded scopes. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Properties Arguments
--overrides

The policy override. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Properties Arguments
--params -p

The parameter values for the assigned policy rule. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Properties Arguments
--policy

The name or resource ID of the policy definition or policy set definition to be assigned.

--policy-set-definition -d

The policy definition or policy set definition to assign.

Property Value
Parameter group: Properties Arguments
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-selectors

The resource selectors list to filter policies by resource properties. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Properties Arguments
--role

Role name or id that will be assigned to the managed identity.

--scope

The scope of the policy assignment.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az policy assignment delete

Edit

Delete a policy assignment.

Delete the policy assignment with the given name and scope.

az policy assignment delete --name
                            [--resource-group]
                            [--scope]

Examples

Delete a policy assignment at scope

az policy assignment delete --scope subscriptions/{subscriptionId} --name EnforceNaming

Delete a policy assignment

az policy assignment delete --name MyPolicyAssignment

Required Parameters

--name -n

The name of the policy assignment.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scope

The scope of the policy assignment.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az policy assignment list

Edit

Retrieve all applicable policy assignments.

Retrieve the list of all policy assignments applicable to the given subscription or management group.

az policy assignment list [--disable-scope-strict-match {0, 1, f, false, n, no, t, true, y, yes}]
                          [--expand]
                          [--filter]
                          [--management-group]
                          [--max-items]
                          [--next-token]
                          [--resource-group]
                          [--scope]

Examples

List policy assignments that apply to a resource group

az policy assignment list --resource-group TestResourceGroup --filter atScope() --expand LatestDefinitionVersion, EffectiveDefinitionVersion

List policy assignments that apply to a management group

az policy assignment list --management-group TestManagementGroup --filter atScope()

List policy assignments that apply to a subscription

az policy assignment list --filter atScope()

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--disable-scope-strict-match -d

Include policy assignments either inherited from parent scopes or at child scopes.

Property Value
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--expand

Additional properties to include in output.

--filter

Filter list results.

--management-group

The management group.

--max-items

Total number of items to return in the command's output. If the total number of items available is more than the value specified, a token is provided in the command's output. To resume pagination, provide the token value in --next-token argument of a subsequent command.

Property Value
Parameter group: Pagination Arguments
--next-token

Token to specify where to start paginating. This is the token value from a previously truncated response.

Property Value
Parameter group: Pagination Arguments
--resource-group -g

The resource group.

--scope

Scope at which to list applicable policy assignments. If scope is not provided, the scope will be the implied or specified subscription.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az policy assignment show

Edit

Retrieve a policy assignment.

Retrieve and show the details of a single policy assignment with the given name and scope.

az policy assignment show --name
                          [--expand]
                          [--resource-group]
                          [--scope]

Examples

Show a resource policy assignment

az policy assignment show --name MyPolicyAssignment

Required Parameters

--name -n

The name of the policy assignment.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--expand

Additional properties to include in output.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scope

The scope of the policy assignment.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False

az policy assignment update

Edit

Update a policy assignment.

Update the policy assignment with the given name and scope by applying the given property values.

az policy assignment update --name
                            [--add]
                            [--definition-version]
                            [--description]
                            [--display-name]
                            [--enforcement-mode {Default, DoNotEnforce}]
                            [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                            [--___location]
                            [--metadata]
                            [--non-compliance-messages]
                            [--not-scopes]
                            [--overrides]
                            [--params]
                            [--policy]
                            [--policy-set-definition]
                            [--remove]
                            [--resource-group]
                            [--resource-selectors]
                            [--scope]
                            [--set]

Examples

Update a resource policy assignment's description

az policy assignment update --name myPolicy --description 'My policy description'

Required Parameters

--name -n

The name of the policy assignment.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

Property Value
Parameter group: Generic Update Arguments
--definition-version

The policy version to assign.

Property Value
Parameter group: Properties Arguments
--description

Policy assignment description.

Property Value
Parameter group: Properties Arguments
--display-name

The display name of the policy assignment.

Property Value
Parameter group: Properties Arguments
--enforcement-mode -e

The policy assignment enforcement mode.

Property Value
Parameter group: Properties Arguments
Accepted values: Default, DoNotEnforce
--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Property Value
Parameter group: Generic Update Arguments
Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--___location -l

The ___location of the policy assignment.

Property Value
Parameter group: Parameters Arguments
--metadata

The policy assignment metadata. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Properties Arguments
--non-compliance-messages -m

The messages that describe why a resource is non-compliant with the policy. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: non-compliance-message Arguments
--not-scopes

The policy assignment excluded scopes. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Properties Arguments
--overrides

The policy property value override. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Properties Arguments
--params -p

The parameter values for the assigned policy rule. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Properties Arguments
--policy

The name or resource ID of the policy definition or policy set definition to be assigned.

--policy-set-definition -d

The policy definition or policy set definition to assign.

Property Value
Parameter group: Properties Arguments
--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

Property Value
Parameter group: Generic Update Arguments
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-selectors

The resource selectors list to filter policies by resource properties. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property Value
Parameter group: Properties Arguments
--scope

The scope of the policy assignment.

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

Property Value
Parameter group: Generic Update Arguments
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

Property Value
Default value: False
--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property Value
Default value: False
--output -o

Output format.

Property Value
Default value: json
Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property Value
Default value: False