Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
868 questions
Any can update and guide me on this
Export the data of Policy Assignments Name, Type (Intiatives or Policy), Scope and then for each Policy Assignments I need the policy definitions Version, category, type associated with it and export in excel file
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 90%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJI%3C/text%3E%3C/svg%3E)
J.I. PRASHANDH
0
Reputation points
Hello Team,
Can any one help on how I can Export the data of Policy Assignments Name, Type (Intiatives or Policy), Scope and then for each Policy Assignments I need the policy definitions Version, category, type associated with it and export in excel file.
Any KQL Query or Powershell script that helps.
Thank YOU...
2 answers
Sort by: Most helpful
-
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(19.2, 2%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPK%3C/text%3E%3C/svg%3E)
Prashant Kumar 775 Reputation points Microsoft Employee2024-09-04T06:40:33.0966667+00:00 Hi J.I PRASHANDH
You can use policyresources table in Azure Resource graph to get policy assignments, definitions and setdefinitions(initiative) details.
You will get most of your fields from policyassignments type but to get more information about related policy definitions or setdefinitions, you will have to use join between these three types.
Sample ARG query:
policyresources | where type == "microsoft.authorization/policyassignments" | project id,name,subscriptionId,policyDefinitionId =(properties.policyDefinitionId),scope = (properties.scope),definitionVersion=(properties.definitionVersion)-
J.I. PRASHANDH 0 Reputation points
2024-09-04T06:55:38.4866667+00:00 Hi @Prashant kumar How can I get the policy assignments by scope in Resource graph query ?I need to add a query in Resource graph to get the policy assignments by scope..Scope can be a management group.
-
Prashant Kumar 775 Reputation points Microsoft Employee
2024-09-04T07:09:39.7033333+00:00 You can filter for scope in the query.
policyresources | where type == "microsoft.authorization/policyassignments" | mv-expand properties //| where properties.scope == '/subscriptions/123456' // for subscription scope //| where properties.scope == '/providers/Microsoft.Management/managementGroups/1234556c' // for management group scope | project id,name,subscriptionId,policyDefinitionId =(properties.policyDefinitionId),scope = (properties.scope),definitionVersion=(properties.definitionVersion) uncomment the where condition based on the scope -
J.I. PRASHANDH 0 Reputation points
2024-09-04T07:51:47.1+00:00 It seems to be working fine now.
I need to get the Definition type that we see (Intiative or Policy) and the Category that we see in the definition and also the type Custom or Builtin.
-
J.I. PRASHANDH 0 Reputation points
2024-09-04T09:39:15.5666667+00:00 Any Update... @Prashant Kumar
-
J.I. PRASHANDH 0 Reputation points
2024-09-04T10:07:33.3533333+00:00 Overall I need the Policy Assignment Name, Scope, Definition Type (Intiative or Policy) that we see in the Assignment and then from its Policy Definition I need the Version and Category.
-
J.I. PRASHANDH 0 Reputation points
2024-09-06T06:02:23.15+00:00 Hi @Prashant Kumar Can you Please Update.
-
Prashant Kumar 775 Reputation points Microsoft Employee
2024-09-06T10:39:35.13+00:00 Hi @J.I. PRASHANDH Could you please try the ARG query below?
policyresources | where type == "microsoft.authorization/policyassignments" //| where properties.scope == '/subscriptions/123456' // for subscription scope //| where properties.scope == '/providers/Microsoft.Management/managementGroups/1234556c' // for management group scope | extend properties | extend pdefid=tostring(properties.policyDefinitionId) | project id,name,subscriptionId,pdefid,assignmentscope = (properties.scope) | join kind=inner (policyresources | where type == 'microsoft.authorization/policydefinitions' | extend definitionType = iff(kind == 'policysetdefinitions', 'Initiative','Policy') | extend custom_Or_Builtin = iff(properties.policyType == 'Custom', 'Custom', 'BuiltIn') | extend properties | extend properties.metada | project pdefid=id,definitionType,custom_Or_Builtin, definitioncategory= (properties.metadata.category),definitionVersion=(properties.version)) on pdefid | project id,name,pdefid,assignmentscope,definitionType,definitionVersion,custom_Or_Builtin,definitioncategory Please note that this query has been shared on a good effort basis. If you have any further issues with Azure resource graph queries, I recommend raising a support case for detailed troubleshooting.
Sign in to comment -