Policy Set Definitions - List By Management Group

Retrieves all policy set definitions in management group.
This operation retrieves a list of all the policy set definitions in a given management group that match the optional given $filter. Valid values for $filter are: 'atExactScope()', 'policyType -eq {value}' or 'category eq '{value}''. If $filter is not provided, the unfiltered list includes all policy set definitions associated with the management group, including those that apply directly or from management groups that contain the given management group. If $filter=atExactScope() is provided, the returned list only includes all policy set definitions that at the given management group. If $filter='policyType -eq {value}' is provided, the returned list only includes all policy set definitions whose type match the {value}. Possible policyType values are NotSpecified, BuiltIn and Custom. If $filter='category -eq {value}' is provided, the returned list only includes all policy set definitions whose category match the {value}.

GET https://management.azure.com/providers/Microsoft.Management/managementGroups/{managementGroupId}/providers/Microsoft.Authorization/policySetDefinitions?api-version=2023-04-01
GET https://management.azure.com/providers/Microsoft.Management/managementGroups/{managementGroupId}/providers/Microsoft.Authorization/policySetDefinitions?api-version=2023-04-01&$filter={$filter}&$expand={$expand}&$top={$top}

URI Parameters

Name In Required Type Description
managementGroupId
path True

string

The ID of the management group.

api-version
query True

string

The API version to use for this operation.

$expand
query

string

Comma-separated list of additional properties to be included in the response. Supported values are 'LatestDefinitionVersion, EffectiveDefinitionVersion'.

$filter
query

string

The filter to apply on the operation. Valid values for $filter are: 'atExactScope()', 'policyType -eq {value}' or 'category eq '{value}''. If $filter is not provided, no filtering is performed. If $filter=atExactScope() is provided, the returned list only includes all policy set definitions that at the given scope. If $filter='policyType -eq {value}' is provided, the returned list only includes all policy set definitions whose type match the {value}. Possible policyType values are NotSpecified, BuiltIn, Custom, and Static. If $filter='category -eq {value}' is provided, the returned list only includes all policy set definitions whose category match the {value}.

$top
query

integer

int32

Maximum number of records to return. When the $top filter is not provided, it will return 500 records.

Responses

Name Type Description
200 OK

PolicySetDefinitionListResult

OK - Returns an array of policy set definitions.

Other Status Codes

CloudError

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

List policy set definitions at management group level

Sample request

GET https://management.azure.com/providers/Microsoft.Management/managementGroups/MyManagementGroup/providers/Microsoft.Authorization/policySetDefinitions?api-version=2023-04-01

Sample response

{
  "value": [
    {
      "properties": {
        "displayName": "[Preview]: Enable Monitoring in Azure Security Center",
        "policyType": "BuiltIn",
        "description": "Monitor all the available security recommendations in Azure Security Center. This is the default policy for Azure Security Center.",
        "metadata": {
          "category": "Security Center"
        },
        "version": "1.2.1",
        "versions": [
          "1.2.1",
          "1.0.0"
        ],
        "parameters": {},
        "policyDefinitions": [
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a8bef009-a5c9-4d0f-90d7-6018734e8a16",
            "definitionVersion": "1.*.*",
            "policyDefinitionReferenceId": "RefId1"
          },
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/af8051bf-258b-44e2-a2bf-165330459f9d",
            "definitionVersion": "1.*.*",
            "policyDefinitionReferenceId": "RefId2"
          },
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/86b3d65f-7626-441e-b690-81a8b71cff60",
            "definitionVersion": "1.*.*",
            "policyDefinitionReferenceId": "RefId3"
          },
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/655cb504-bcee-4362-bd4c-402e6aa38759",
            "definitionVersion": "1.*.*",
            "policyDefinitionReferenceId": "RefId4"
          },
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b0f33259-77d7-4c9e-aac6-3aabcfae693c",
            "policyDefinitionReferenceId": "RefId5"
          },
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/47a6b606-51aa-4496-8bb7-64b11cf66adc",
            "definitionVersion": "1.*.*",
            "policyDefinitionReferenceId": "RefId6"
          },
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/44452482-524f-4bf4-b852-0bff7cc4a3ed",
            "definitionVersion": "1.*.*",
            "policyDefinitionReferenceId": "RefId7"
          },
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15",
            "policyDefinitionReferenceId": "RefId8"
          },
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/af6cd1bd-1635-48cb-bde7-5b15693900b9",
            "definitionVersion": "1.*.*",
            "policyDefinitionReferenceId": "RefId9"
          },
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0961003e-5a0a-4549-abde-af6a37f2724d",
            "definitionVersion": "1.*.*",
            "policyDefinitionReferenceId": "RefId10"
          }
        ]
      },
      "id": "/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8",
      "type": "Microsoft.Authorization/policySetDefinitions",
      "name": "1f3afdf9-d0c9-4c3d-847f-89da613e70a8"
    },
    {
      "id": "/providers/Microsoft.Management/managementgroups/MyManagementGroup/providers/Microsoft.Authorization/policySetDefinitions/CostManagement",
      "type": "Microsoft.Authorization/policySetDefinitions",
      "name": "CostManagement",
      "properties": {
        "displayName": "Cost Management",
        "description": "Policies to enforce low cost storage SKUs",
        "metadata": {
          "category": "Cost Management"
        },
        "version": "1.2.1",
        "versions": [
          "1.2.1",
          "1.0.0"
        ],
        "policyDefinitions": [
          {
            "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7433c107-6db4-4ad1-b57a-a76dce0154a1",
            "definitionVersion": "1.*.*",
            "policyDefinitionReferenceId": "Limit_Skus",
            "parameters": {
              "listOfAllowedSKUs": {
                "value": [
                  "Standard_GRS",
                  "Standard_LRS"
                ]
              }
            }
          },
          {
            "policyDefinitionId": "/providers/Microsoft.Management/managementgroups/MyManagementGroup/providers/Microsoft.Authorization/policyDefinitions/ResourceNaming",
            "definitionVersion": "1.*.*",
            "policyDefinitionReferenceId": "Resource_Naming",
            "parameters": {
              "prefix": {
                "value": "DeptA"
              },
              "suffix": {
                "value": "-LC"
              }
            }
          }
        ]
      }
    }
  ]
}

Definitions

Name Description
CloudError

An error response from a policy operation.

createdByType

The type of identity that created the resource.

ErrorAdditionalInfo

The resource management error additional info.

ErrorResponse

Error Response

Metadata

General metadata for the parameter.

ParameterDefinitionsValue

The definition of a parameter that can be provided to the policy.

parameterType

The data type of the parameter.

ParameterValuesValue

The value of a parameter.

PolicyDefinitionGroup

The policy definition group.

PolicyDefinitionReference

The policy definition reference.

PolicySetDefinition

The policy set definition.

PolicySetDefinitionListResult

List of policy set definitions.

policyType

The type of policy set definition. Possible values are NotSpecified, BuiltIn, Custom, and Static.

systemData

Metadata pertaining to creation and last modification of the resource.

CloudError

An error response from a policy operation.

Name Type Description
error

ErrorResponse

Error Response
Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.)

createdByType

The type of identity that created the resource.

Name Type Description
Application

string

Key

string

ManagedIdentity

string

User

string

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info

object

The additional info.

type

string

The additional info type.

ErrorResponse

Error Response

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.

code

string

The error code.

details

ErrorResponse[]

The error details.

message

string

The error message.

target

string

The error target.

Metadata

General metadata for the parameter.

Name Type Description
assignPermissions

boolean

Set to true to have Azure portal create role assignments on the resource ID or resource scope value of this parameter during policy assignment. This property is useful in case you wish to assign permissions outside the assignment scope.

description

string

The description of the parameter.

displayName

string

The display name for the parameter.

strongType

string

Used when assigning the policy definition through the portal. Provides a context aware list of values for the user to choose from.

ParameterDefinitionsValue

The definition of a parameter that can be provided to the policy.

Name Type Description
allowedValues

object[]

The allowed values for the parameter.

defaultValue

object

The default value for the parameter if no value is provided.

metadata

Metadata

General metadata for the parameter.

schema

object

Provides validation of parameter inputs during assignment using a self-defined JSON schema. This property is only supported for object-type parameters and follows the Json.NET Schema 2019-09 implementation. You can learn more about using schemas at https://json-schema.org/ and test draft schemas at https://www.jsonschemavalidator.net/.

type

parameterType

The data type of the parameter.

parameterType

The data type of the parameter.

Name Type Description
Array

string

Boolean

string

DateTime

string

Float

string

Integer

string

Object

string

String

string

ParameterValuesValue

The value of a parameter.

Name Type Description
value

object

The value of the parameter.

PolicyDefinitionGroup

The policy definition group.

Name Type Description
additionalMetadataId

string

A resource ID of a resource that contains additional metadata about the group.

category

string

The group's category.

description

string

The group's description.

displayName

string

The group's display name.

name

string

The name of the group.

PolicyDefinitionReference

The policy definition reference.

Name Type Description
definitionVersion

string

The version of the policy definition to use.

effectiveDefinitionVersion

string

The effective version of the policy definition in use. This is only present if requested via the $expand query parameter.

groupNames

string[]

The name of the groups that this policy definition reference belongs to.

latestDefinitionVersion

string

The latest version of the policy definition available. This is only present if requested via the $expand query parameter.

parameters

<string,  ParameterValuesValue>

The parameter values for the referenced policy rule. The keys are the parameter names.

policyDefinitionId

string

The ID of the policy definition or policy set definition.

policyDefinitionReferenceId

string

A unique id (within the policy set definition) for this policy definition reference.

PolicySetDefinition

The policy set definition.

Name Type Description
id

string

The ID of the policy set definition.

name

string

The name of the policy set definition.

properties.description

string

The policy set definition description.

properties.displayName

string

The display name of the policy set definition.

properties.metadata

object

The policy set definition metadata. Metadata is an open ended object and is typically a collection of key value pairs.

properties.parameters

<string,  ParameterDefinitionsValue>

The policy set definition parameters that can be used in policy definition references.

properties.policyDefinitionGroups

PolicyDefinitionGroup[]

The metadata describing groups of policy definition references within the policy set definition.

properties.policyDefinitions

PolicyDefinitionReference[]

An array of policy definition references.

properties.policyType

policyType

The type of policy set definition. Possible values are NotSpecified, BuiltIn, Custom, and Static.

properties.version

string

The policy set definition version in #.#.# format.

properties.versions

string[]

A list of available versions for this policy set definition.

systemData

systemData

The system metadata relating to this resource.

type

string

The type of the resource (Microsoft.Authorization/policySetDefinitions).

PolicySetDefinitionListResult

List of policy set definitions.

Name Type Description
nextLink

string

The URL to use for getting the next set of results.

value

PolicySetDefinition[]

An array of policy set definitions.

policyType

The type of policy set definition. Possible values are NotSpecified, BuiltIn, Custom, and Static.

Name Type Description
BuiltIn

string

Custom

string

NotSpecified

string

Static

string

systemData

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string

The timestamp of resource creation (UTC).

createdBy

string

The identity that created the resource.

createdByType

createdByType

The type of identity that created the resource.

lastModifiedAt

string

The timestamp of resource last modification (UTC)

lastModifiedBy

string

The identity that last modified the resource.

lastModifiedByType

createdByType

The type of identity that last modified the resource.