Policy Exemptions - Update

This operation updates a policy exemption with the given scope and name.

PATCH https://management.azure.com/{scope}/providers/Microsoft.Authorization/policyExemptions/{policyExemptionName}?api-version=2022-07-01-preview

URI Parameters

Name In Required Type Description
policyExemptionName
path True

string

The name of the policy exemption to delete.

scope
path True

string

The scope of the policy exemption. Valid scopes are: management group (format: '/providers/Microsoft.Management/managementGroups/{managementGroup}'), subscription (format: '/subscriptions/{subscriptionId}'), resource group (format: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}', or resource (format: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/[{parentResourcePath}/]{resourceType}/{resourceName}'

api-version
query True

string

The API version to use for the operation.

Request Body

Name Type Description
properties.assignmentScopeValidation

AssignmentScopeValidation

The option whether validate the exemption is at or under the assignment scope.

properties.resourceSelectors

ResourceSelector[]

The resource selector list to filter policies by resource properties.

Responses

Name Type Description
200 OK

PolicyExemption

OK - Returns information about the policy exemption.

Other Status Codes

CloudError

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Update a policy exemption with resource selectors

Sample request

PATCH https://management.azure.com/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/resourceGroups/demoCluster/providers/Microsoft.Authorization/policyExemptions/DemoExpensiveVM?api-version=2022-07-01-preview

{
  "properties": {
    "assignmentScopeValidation": "Default",
    "resourceSelectors": [
      {
        "name": "SDPRegions",
        "selectors": [
          {
            "kind": "resourceLocation",
            "in": [
              "eastus2euap",
              "centraluseuap"
            ]
          }
        ]
      }
    ]
  }
}

Sample response

{
  "properties": {
    "policyAssignmentId": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/providers/Microsoft.Authorization/policyAssignments/CostManagement",
    "policyDefinitionReferenceIds": [
      "Limit_Skus"
    ],
    "exemptionCategory": "Waiver",
    "displayName": "Exempt demo cluster",
    "description": "Exempt demo cluster from limit sku",
    "metadata": {
      "reason": "Temporary exemption for a expensive VM demo"
    },
    "assignmentScopeValidation": "Default",
    "resourceSelectors": [
      {
        "name": "SDPRegions",
        "selectors": [
          {
            "kind": "resourceLocation",
            "in": [
              "eastus2euap",
              "centraluseuap"
            ]
          }
        ]
      }
    ]
  },
  "systemData": {
    "createdBy": "string",
    "createdByType": "User",
    "createdAt": "2020-07-01T01:01:01.1075056Z",
    "lastModifiedBy": "string",
    "lastModifiedByType": "User",
    "lastModifiedAt": "2020-07-01T02:01:01.1075056Z"
  },
  "id": "/subscriptions/ae640e6b-ba3e-4256-9d62-2993eecfa6f2/resourceGroups/demoCluster/providers/Microsoft.Authorization/policyExemptions/DemoExpensiveVM",
  "type": "Microsoft.Authorization/policyExemptions",
  "name": "DemoExpensiveVM"
}

Definitions

Name Description
AssignmentScopeValidation

The option whether validate the exemption is at or under the assignment scope.

CloudError

An error response from a policy operation.

createdByType

The type of identity that created the resource.

ErrorAdditionalInfo

The resource management error additional info.

ErrorResponse

Error Response

exemptionCategory

The policy exemption category. Possible values are Waiver and Mitigated.

PolicyExemption

The policy exemption.

PolicyExemptionUpdate

The policy exemption for Patch request.

ResourceSelector

The resource selector to filter policies by resource properties.

Selector

The selector expression.

SelectorKind

The selector kind.

systemData

Metadata pertaining to creation and last modification of the resource.

AssignmentScopeValidation

The option whether validate the exemption is at or under the assignment scope.

Name Type Description
Default

string

This option will validate the exemption is at or under the assignment scope.

DoNotValidate

string

This option will bypass the validation the exemption scope is at or under the policy assignment scope.

CloudError

An error response from a policy operation.

Name Type Description
error

ErrorResponse

Error Response
Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.)

createdByType

The type of identity that created the resource.

Name Type Description
Application

string

Key

string

ManagedIdentity

string

User

string

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info

object

The additional info.

type

string

The additional info type.

ErrorResponse

Error Response

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.

code

string

The error code.

details

ErrorResponse[]

The error details.

message

string

The error message.

target

string

The error target.

exemptionCategory

The policy exemption category. Possible values are Waiver and Mitigated.

Name Type Description
Mitigated

string

This category of exemptions usually means the mitigation actions have been applied to the scope.

Waiver

string

This category of exemptions usually means the scope is not applicable for the policy.

PolicyExemption

The policy exemption.

Name Type Default value Description
id

string

The ID of the policy exemption.

name

string

The name of the policy exemption.

properties.assignmentScopeValidation

AssignmentScopeValidation

Default

The option whether validate the exemption is at or under the assignment scope.

properties.description

string

The description of the policy exemption.

properties.displayName

string

The display name of the policy exemption.

properties.exemptionCategory

exemptionCategory

The policy exemption category. Possible values are Waiver and Mitigated.

properties.expiresOn

string

The expiration date and time (in UTC ISO 8601 format yyyy-MM-ddTHH:mm:ssZ) of the policy exemption.

properties.metadata

object

The policy exemption metadata. Metadata is an open ended object and is typically a collection of key value pairs.

properties.policyAssignmentId

string

The ID of the policy assignment that is being exempted.

properties.policyDefinitionReferenceIds

string[]

The policy definition reference ID list when the associated policy assignment is an assignment of a policy set definition.

properties.resourceSelectors

ResourceSelector[]

The resource selector list to filter policies by resource properties.

systemData

systemData

Azure Resource Manager metadata containing createdBy and modifiedBy information.

type

string

The type of the resource (Microsoft.Authorization/policyExemptions).

PolicyExemptionUpdate

The policy exemption for Patch request.

Name Type Default value Description
properties.assignmentScopeValidation

AssignmentScopeValidation

Default

The option whether validate the exemption is at or under the assignment scope.

properties.resourceSelectors

ResourceSelector[]

The resource selector list to filter policies by resource properties.

ResourceSelector

The resource selector to filter policies by resource properties.

Name Type Description
name

string

The name of the resource selector.

selectors

Selector[]

The list of the selector expressions.

Selector

The selector expression.

Name Type Description
in

string[]

The list of values to filter in.

kind

SelectorKind

The selector kind.

notIn

string[]

The list of values to filter out.

SelectorKind

The selector kind.

Name Type Description
policyDefinitionReferenceId

string

The selector kind to filter policies by the policy definition reference ID.

resourceLocation

string

The selector kind to filter policies by the resource location.

resourceType

string

The selector kind to filter policies by the resource type.

resourceWithoutLocation

string

The selector kind to filter policies by the resource without location.

systemData

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string

The timestamp of resource creation (UTC).

createdBy

string

The identity that created the resource.

createdByType

createdByType

The type of identity that created the resource.

lastModifiedAt

string

The timestamp of resource last modification (UTC)

lastModifiedBy

string

The identity that last modified the resource.

lastModifiedByType

createdByType

The type of identity that last modified the resource.