Policy Assignments - Update

This operation updates a policy assignment with the given scope and name. Policy assignments apply to all resources contained within their scope. For example, when you assign a policy at resource group scope, that policy applies to all resources in the group.

PATCH https://management.azure.com/{scope}/providers/Microsoft.Authorization/policyAssignments/{policyAssignmentName}?api-version=2023-04-01

URI Parameters

Name In Required Type Description
policyAssignmentName
path True

string

The name of the policy assignment.

Regex pattern: ^[^<>*%&:\?.+/]*[^<>*%&:\?.+/ ]+$

scope
path True

string

The scope of the policy assignment. Valid scopes are: management group (format: '/providers/Microsoft.Management/managementGroups/{managementGroup}'), subscription (format: '/subscriptions/{subscriptionId}'), resource group (format: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}', or resource (format: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/[{parentResourcePath}/]{resourceType}/{resourceName}'

api-version
query True

string

The API version to use for this operation.

Request Body

Name Type Description
identity

Identity

The managed identity associated with the policy assignment.

location

string

The location of the policy assignment. Only required when utilizing managed identity.

properties.overrides

Override[]

The policy property value override.

properties.resourceSelectors

ResourceSelector[]

The resource selector list to filter policies by resource properties.

Responses

Name Type Description
200 OK

PolicyAssignment

OK - Returns information about the policy assignment.

Other Status Codes

CloudError

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Update a policy assignment with a system assigned identity
Update a policy assignment with a user assigned identity
Update a policy assignment with overrides
Update a policy assignment with resource selectors

Update a policy assignment with a system assigned identity

Sample request

PATCH https://management.azure.com/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyAssignments/EnforceNaming?api-version=2023-04-01

{
  "location": "eastus",
  "identity": {
    "type": "SystemAssigned"
  }
}

Sample response

{
  "properties": {
    "displayName": "Enforce resource naming rules",
    "description": "Force resource names to begin with given DeptA and end with -LC",
    "metadata": {
      "assignedBy": "Special Someone"
    },
    "policyDefinitionId": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyDefinitions/ResourceNaming",
    "definitionVersion": "1.*.*",
    "notScopes": [],
    "parameters": {
      "prefix": {
        "value": "DeptA"
      },
      "suffix": {
        "value": "-LC"
      }
    },
    "enforcementMode": "Default",
    "scope": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2"
  },
  "identity": {
    "type": "SystemAssigned",
    "principalId": "e6d23f8d-af97-4fbc-bda6-00604e4e3d0a",
    "tenantId": "4bee2b8a-1bee-47c2-90e9-404241551135"
  },
  "location": "eastus",
  "id": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyAssignments/EnforceNaming",
  "type": "Microsoft.Authorization/policyAssignments",
  "name": "EnforceNaming"
}

Update a policy assignment with a user assigned identity

Sample request

PATCH https://management.azure.com/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyAssignments/EnforceNaming?api-version=2023-04-01

{
  "location": "eastus",
  "identity": {
    "type": "UserAssigned",
    "userAssignedIdentities": {
      "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/resourceGroups/testResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-identity": {}
    }
  }
}

Sample response

{
  "properties": {
    "displayName": "Enforce resource naming rules",
    "description": "Force resource names to begin with given DeptA and end with -LC",
    "metadata": {
      "assignedBy": "Special Someone"
    },
    "policyDefinitionId": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyDefinitions/ResourceNaming",
    "definitionVersion": "1.*.*",
    "notScopes": [],
    "parameters": {
      "prefix": {
        "value": "DeptA"
      },
      "suffix": {
        "value": "-LC"
      }
    },
    "enforcementMode": "Default",
    "scope": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2"
  },
  "identity": {
    "type": "UserAssigned",
    "userAssignedIdentities": {
      "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/resourceGroups/testResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-identity": {
        "principalId": "e6d23f8d-af97-4fbc-bda6-00604e4e3d0a",
        "clientId": "4bee2b8a-1bee-47c2-90e9-404241551135"
      }
    }
  },
  "location": "eastus",
  "id": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyAssignments/EnforceNaming",
  "type": "Microsoft.Authorization/policyAssignments",
  "name": "EnforceNaming"
}

Update a policy assignment with overrides

Sample request

PATCH https://management.azure.com/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyAssignments/CostManagement?api-version=2023-04-01

{
  "properties": {
    "overrides": [
      {
        "kind": "policyEffect",
        "value": "Audit",
        "selectors": [
          {
            "kind": "policyDefinitionReferenceId",
            "in": [
              "Limit_Skus",
              "Limit_Locations"
            ]
          }
        ]
      }
    ]
  }
}

Sample response

{
  "properties": {
    "displayName": "Limit the resource location and resource SKU",
    "description": "Limit the resource location and resource SKU",
    "metadata": {
      "assignedBy": "Special Someone"
    },
    "policyDefinitionId": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policySetDefinitions/CostManagement",
    "definitionVersion": "1.*.*",
    "notScopes": [],
    "enforcementMode": "Default",
    "scope": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2",
    "overrides": [
      {
        "kind": "policyEffect",
        "value": "Audit",
        "selectors": [
          {
            "kind": "policyDefinitionReferenceId",
            "in": [
              "Limit_Skus",
              "Limit_Locations"
            ]
          }
        ]
      }
    ]
  },
  "id": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyAssignments/CostManagement",
  "type": "Microsoft.Authorization/policyAssignments",
  "name": "CostManagement"
}

Update a policy assignment with resource selectors

Sample request

PATCH https://management.azure.com/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyAssignments/CostManagement?api-version=2023-04-01

{
  "properties": {
    "resourceSelectors": [
      {
        "name": "SDPRegions",
        "selectors": [
          {
            "kind": "resourceLocation",
            "in": [
              "eastus2euap",
              "centraluseuap"
            ]
          }
        ]
      }
    ]
  }
}

Sample response

{
  "properties": {
    "displayName": "Limit the resource location and resource SKU",
    "description": "Limit the resource location and resource SKU",
    "metadata": {
      "assignedBy": "Special Someone"
    },
    "policyDefinitionId": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policySetDefinitions/CostManagement",
    "definitionVersion": "1.*.*",
    "notScopes": [],
    "enforcementMode": "Default",
    "scope": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2",
    "resourceSelectors": [
      {
        "name": "SDPRegions",
        "selectors": [
          {
            "kind": "resourceLocation",
            "in": [
              "eastus2euap",
              "centraluseuap"
            ]
          }
        ]
      }
    ]
  },
  "id": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyAssignments/CostManagement",
  "type": "Microsoft.Authorization/policyAssignments",
  "name": "CostManagement"
}

Definitions

Name Description
CloudError

An error response from a policy operation.

createdByType

The type of identity that created the resource.

enforcementMode

The policy assignment enforcement mode. Possible values are Default and DoNotEnforce.

ErrorAdditionalInfo

The resource management error additional info.

ErrorResponse

Error Response

Identity

Identity for the resource. Policy assignments support a maximum of one identity. That is either a system assigned identity or a single user assigned identity.

NonComplianceMessage

A message that describes why a resource is non-compliant with the policy. This is shown in 'deny' error messages and on resource's non-compliant compliance results.

Override

The policy property value override.

OverrideKind

The override kind.

ParameterValuesValue

The value of a parameter.

PolicyAssignment

The policy assignment.

PolicyAssignmentUpdate

The policy assignment for Patch request.

ResourceIdentityType

The identity type. This is the only required field when adding a system or user assigned identity to a resource.

ResourceSelector

The resource selector to filter policies by resource properties.

Selector

The selector expression.

SelectorKind

The selector kind.

systemData

Metadata pertaining to creation and last modification of the resource.

UserAssignedIdentities

The user identity associated with the policy. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

CloudError

An error response from a policy operation.

Name Type Description
error

ErrorResponse

Error Response
Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.)

createdByType

The type of identity that created the resource.

Name Type Description
Application

string

Key

string

ManagedIdentity

string

User

string

enforcementMode

The policy assignment enforcement mode. Possible values are Default and DoNotEnforce.

Name Type Description
Default

string

The policy effect is enforced during resource creation or update.

DoNotEnforce

string

The policy effect is not enforced during resource creation or update.

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info

object

The additional info.

type

string

The additional info type.

ErrorResponse

Error Response

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.

code

string

The error code.

details

ErrorResponse[]

The error details.

message

string

The error message.

target

string

The error target.

Identity

Identity for the resource. Policy assignments support a maximum of one identity. That is either a system assigned identity or a single user assigned identity.

Name Type Description
principalId

string

The principal ID of the resource identity. This property will only be provided for a system assigned identity

tenantId

string

The tenant ID of the resource identity. This property will only be provided for a system assigned identity

type

ResourceIdentityType

The identity type. This is the only required field when adding a system or user assigned identity to a resource.

userAssignedIdentities

UserAssignedIdentities

The user identity associated with the policy. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

NonComplianceMessage

A message that describes why a resource is non-compliant with the policy. This is shown in 'deny' error messages and on resource's non-compliant compliance results.

Name Type Description
message

string

A message that describes why a resource is non-compliant with the policy. This is shown in 'deny' error messages and on resource's non-compliant compliance results.

policyDefinitionReferenceId

string

The policy definition reference ID within a policy set definition the message is intended for. This is only applicable if the policy assignment assigns a policy set definition. If this is not provided the message applies to all policies assigned by this policy assignment.

Override

The policy property value override.

Name Type Description
kind

OverrideKind

The override kind.

selectors

Selector[]

The list of the selector expressions.

value

string

The value to override the policy property.

OverrideKind

The override kind.

Name Type Description
policyEffect

string

It will override the policy effect type.

ParameterValuesValue

The value of a parameter.

Name Type Description
value

object

The value of the parameter.

PolicyAssignment

The policy assignment.

Name Type Default value Description
id

string

The ID of the policy assignment.

identity

Identity

The managed identity associated with the policy assignment.

location

string

The location of the policy assignment. Only required when utilizing managed identity.

name

string

The name of the policy assignment.

properties.definitionVersion

string

The version of the policy definition to use.

properties.description

string

This message will be part of response in case of policy violation.

properties.displayName

string

The display name of the policy assignment.

properties.enforcementMode

enforcementMode

Default

The policy assignment enforcement mode. Possible values are Default and DoNotEnforce.

properties.metadata

object

The policy assignment metadata. Metadata is an open ended object and is typically a collection of key value pairs.

properties.nonComplianceMessages

NonComplianceMessage[]

The messages that describe why a resource is non-compliant with the policy.

properties.notScopes

string[]

The policy's excluded scopes.

properties.overrides

Override[]

The policy property value override.

properties.parameters

<string,  ParameterValuesValue>

The parameter values for the assigned policy rule. The keys are the parameter names.

properties.policyDefinitionId

string

The ID of the policy definition or policy set definition being assigned.

properties.resourceSelectors

ResourceSelector[]

The resource selector list to filter policies by resource properties.

properties.scope

string

The scope for the policy assignment.

systemData

systemData

The system metadata relating to this resource.

type

string

The type of the policy assignment.

PolicyAssignmentUpdate

The policy assignment for Patch request.

Name Type Description
identity

Identity

The managed identity associated with the policy assignment.

location

string

The location of the policy assignment. Only required when utilizing managed identity.

properties.overrides

Override[]

The policy property value override.

properties.resourceSelectors

ResourceSelector[]

The resource selector list to filter policies by resource properties.

ResourceIdentityType

The identity type. This is the only required field when adding a system or user assigned identity to a resource.

Name Type Description
None

string

Indicates that no identity is associated with the resource or that the existing identity should be removed.

SystemAssigned

string

Indicates that a system assigned identity is associated with the resource.

UserAssigned

string

Indicates that a system assigned identity is associated with the resource.

ResourceSelector

The resource selector to filter policies by resource properties.

Name Type Description
name

string

The name of the resource selector.

selectors

Selector[]

The list of the selector expressions.

Selector

The selector expression.

Name Type Description
in

string[]

The list of values to filter in.

kind

SelectorKind

The selector kind.

notIn

string[]

The list of values to filter out.

SelectorKind

The selector kind.

Name Type Description
policyDefinitionReferenceId

string

The selector kind to filter policies by the policy definition reference ID.

resourceLocation

string

The selector kind to filter policies by the resource location.

resourceType

string

The selector kind to filter policies by the resource type.

resourceWithoutLocation

string

The selector kind to filter policies by the resource without location.

systemData

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string

The timestamp of resource creation (UTC).

createdBy

string

The identity that created the resource.

createdByType

createdByType

The type of identity that created the resource.

lastModifiedAt

string

The timestamp of resource last modification (UTC)

lastModifiedBy

string

The identity that last modified the resource.

lastModifiedByType

createdByType

The type of identity that last modified the resource.

UserAssignedIdentities

The user identity associated with the policy. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

Name Type Description