az policy exemption

Manage policy exemptions.

Policy exemptions specify resources that a policy assignment does not apply to.

Commands

Name	Description	Type	Status
az policy exemption create	Create a policy exemption.	Core	GA
az policy exemption delete	Delete a policy exemption.	Core	GA
az policy exemption list	Retrieve all applicable policy exemptions.	Core	GA
az policy exemption show	Retrieve a policy exemption.	Core	GA
az policy exemption update	Update a policy exemption.	Core	GA

az policy exemption create

Edit

Create a policy exemption.

Create a policy exemption with the given name and scope. Policy exemptions apply to all resources contained within their scope. For example, when you create a policy exemption at resource group scope for a policy assignment at the same or higher scope level, the exemption exempts all applicable resources in the resource group from applying to that policy assignment.

az policy exemption create --exemption-category {Mitigated, Waiver}
                           --policy-assignment
                           [--assignment-scope-validation {Default, DoNotValidate}]
                           [--description]
                           [--display-name]
                           [--expires-on]
                           [--metadata]
                           [--name]
                           [--policy-definition-reference-ids]
                           [--resource-group]
                           [--resource-selectors]
                           [--scope]

Examples

Create a policy exemption in default subscription

az policy exemption create -n exemptTestVM --policy-assignment "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyAssignments/limitVMSku" --exemption-category "Waiver"

Create a policy exemption in the resource group

az policy exemption create -n exemptTestVM --policy-assignment "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyAssignments/limitVMSku" --exemption-category "Waiver" --resource-group "myResourceGroup"

Create a policy exemption in a management group

az policy exemption create -n exemptTestVM --policy-assignment "/providers/Microsoft.Management/managementGroups/{managementGroupName}/providers/Microsoft.Authorization/policyAssignments/limitVMSku" --exemption-category "Waiver" --scope "/providers/Microsoft.Management/managementGroups/{managementGroupName}"

Required Parameters

--exemption-category -e

The policy exemption category.

Property	Value
Parameter group:	Properties Arguments
Accepted values:	Mitigated, Waiver

--policy-assignment -a

The policy assignment to exempt.

Property	Value
Parameter group:	Properties Arguments

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--assignment-scope-validation -v

The assignment scope validation.

Property	Value
Parameter group:	Properties Arguments
Default value:	Default
Accepted values:	Default, DoNotValidate

--description

Policy exemption description.

Property	Value
Parameter group:	Properties Arguments

--display-name

The display name of the policy exemption.

Property	Value
Parameter group:	Properties Arguments

--expires-on

Breaking change

The expiration date and time.

Property	Value
Parameter group:	Properties Arguments

--metadata

The policy exemption metadata. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--name -n

The name of the policy exemption.

--policy-definition-reference-ids -r

The policy definition reference IDs. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-selectors

The resource selectors list to filter policies by resource properties. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--scope

The scope of the policy assignment.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy exemption delete

Edit

Delete a policy exemption.

Delete the policy exemption with the given name and scope.

az policy exemption delete --name
                           [--resource-group]
                           [--scope]

Examples

Delete a policy exemption

az policy exemption delete --name MyPolicyExemption --resource-group "myResourceGroup"

Required Parameters

--name -n

The name of the policy exemption.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scope

The scope of the policy assignment.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy exemption list

Edit

Retrieve all applicable policy exemptions.

Retrieve the list of all policy assignments applicable to the given subscription or management group.

az policy exemption list [--disable-scope-strict-match {0, 1, f, false, n, no, t, true, y, yes}]
                         [--filter]
                         [--management-group]
                         [--max-items]
                         [--next-token]
                         [--resource-group]
                         [--scope]

Examples

List policy exemptions that apply to a management group

az policy exemption list --management-group DevOrg --filter atScopeAndBelow()

List policy exemptions that apply to a resource group

az policy exemption list --resource-group TestResourceGroup

List policy exemptions that apply to a subscription

az policy exemption list

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--disable-scope-strict-match -d

Include policy exemptions either inherited from parent scopes or at child scopes.

Property	Value
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--filter

Filter list results.

--management-group

The management group.

--max-items

Total number of items to return in the command's output. If the total number of items available is more than the value specified, a token is provided in the command's output. To resume pagination, provide the token value in --next-token argument of a subsequent command.

Property	Value
Parameter group:	Pagination Arguments

--next-token

Token to specify where to start paginating. This is the token value from a previously truncated response.

Property	Value
Parameter group:	Pagination Arguments

--resource-group -g

The resource group.

--scope

Scope at which to list applicable policy exemptions. If scope is not provided, the scope will be the implied or specified subscription.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy exemption show

Edit

Retrieve a policy exemption.

Retrieve and show the details of the policy exemption with the given name and scope.

az policy exemption show --name
                         [--resource-group]
                         [--scope]

Examples

Show a policy exemption

az policy exemption show --name MyPolicyExemption --resource-group "myResourceGroup"

Required Parameters

--name -n

The name of the policy exemption.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scope

The scope of the policy assignment.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy exemption update

Edit

Update a policy exemption.

Update the policy exemption with the given name and scope by applying the given property values.

az policy exemption update --name
                           [--add]
                           [--assignment-scope-validation {Default, DoNotValidate}]
                           [--description]
                           [--display-name]
                           [--exemption-category {Mitigated, Waiver}]
                           [--expires-on]
                           [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                           [--metadata]
                           [--policy-assignment]
                           [--policy-definition-reference-ids]
                           [--remove]
                           [--resource-group]
                           [--resource-selectors]
                           [--scope]
                           [--set]

Examples

Update a policy exemption category

az policy exemption update -n exemptTestVM --exemption-category "Mitigated"

Update a policy exemption in a resource group

az policy exemption update -n exemptTestVM --display-name "Updated display name" --resource-group myResourceGroup

Update a policy exemption at scope

az policy exemption update -n exemptTestVM --description "This exemption is very cool." --scope "/providers/Microsoft.Management/managementGroups/{managementGroupName}"

Required Parameters

--name -n

The name of the policy exemption.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

Property	Value
Parameter group:	Generic Update Arguments

--assignment-scope-validation -v

The assignment scope validation.

Property	Value
Parameter group:	Properties Arguments
Accepted values:	Default, DoNotValidate

--description

Policy exemption description.

Property	Value
Parameter group:	Properties Arguments

--display-name

The display name of the policy exemption.

Property	Value
Parameter group:	Properties Arguments

--exemption-category -e

The policy exemption category.

Property	Value
Parameter group:	Properties Arguments
Accepted values:	Mitigated, Waiver

--expires-on

Breaking change

The expiration date and time.

Property	Value
Parameter group:	Properties Arguments

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Property	Value
Parameter group:	Generic Update Arguments
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--metadata

The policy exemption metadata. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--policy-assignment -a

The policy assignment to exempt.

Property	Value
Parameter group:	Properties Arguments

--policy-definition-reference-ids -r

The policy definition reference IDs. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

Property	Value
Parameter group:	Generic Update Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-selectors

The resource selectors list to filter policies by resource properties. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--scope

The scope of the policy assignment.

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

Property	Value
Parameter group:	Generic Update Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

Feedback

Was this page helpful?

Share via

az policy exemption

Commands

az policy exemption create

Examples

Required Parameters

Optional Parameters

az policy exemption delete

Examples

Required Parameters

Optional Parameters

az policy exemption list

Examples

Optional Parameters

az policy exemption show

Examples

Required Parameters

Optional Parameters

az policy exemption update

Examples

Required Parameters

Optional Parameters

Feedback