Policy Set Definitions - List By Management Group
Retrieves all policy set definitions in management group.
This operation retrieves a list of all the policy set definitions in a given management group that match the optional given $filter. Valid values for $filter are: 'atExactScope()', 'policyType -eq {value}' or 'category eq '{value}''. If $filter is not provided, the unfiltered list includes all policy set definitions associated with the management group, including those that apply directly or from management groups that contain the given management group. If $filter=atExactScope() is provided, the returned list only includes all policy set definitions that at the given management group. If $filter='policyType -eq {value}' is provided, the returned list only includes all policy set definitions whose type match the {value}. Possible policyType values are NotSpecified, BuiltIn and Custom. If $filter='category -eq {value}' is provided, the returned list only includes all policy set definitions whose category match the {value}.
GET https://management.azure.com/providers/Microsoft.Management/managementGroups/{managementGroupId}/providers/Microsoft.Authorization/policySetDefinitions?api-version=2023-04-01
GET https://management.azure.com/providers/Microsoft.Management/managementGroups/{managementGroupId}/providers/Microsoft.Authorization/policySetDefinitions?api-version=2023-04-01&$filter={$filter}&$expand={$expand}&$top={$top}
URI Parameters
Name | In | Required | Type | Description |
---|---|---|---|---|
management
|
path | True |
string |
The ID of the management group. |
api-version
|
query | True |
string |
The API version to use for this operation. |
$expand
|
query |
string |
Comma-separated list of additional properties to be included in the response. Supported values are 'LatestDefinitionVersion, EffectiveDefinitionVersion'. |
|
$filter
|
query |
string |
The filter to apply on the operation. Valid values for $filter are: 'atExactScope()', 'policyType -eq {value}' or 'category eq '{value}''. If $filter is not provided, no filtering is performed. If $filter=atExactScope() is provided, the returned list only includes all policy set definitions that at the given scope. If $filter='policyType -eq {value}' is provided, the returned list only includes all policy set definitions whose type match the {value}. Possible policyType values are NotSpecified, BuiltIn, Custom, and Static. If $filter='category -eq {value}' is provided, the returned list only includes all policy set definitions whose category match the {value}. |
|
$top
|
query |
integer int32 |
Maximum number of records to return. When the $top filter is not provided, it will return 500 records. |
Responses
Name | Type | Description |
---|---|---|
200 OK |
OK - Returns an array of policy set definitions. |
|
Other Status Codes |
Error response describing why the operation failed. |
Security
azure_auth
Azure Active Directory OAuth2 Flow.
Type:
oauth2
Flow:
implicit
Authorization URL:
https://login.microsoftonline.com/common/oauth2/authorize
Scopes
Name | Description |
---|---|
user_impersonation | impersonate your user account |
Examples
List policy set definitions at management group level
Sample request
Sample response
{
"value": [
{
"properties": {
"displayName": "[Preview]: Enable Monitoring in Azure Security Center",
"policyType": "BuiltIn",
"description": "Monitor all the available security recommendations in Azure Security Center. This is the default policy for Azure Security Center.",
"metadata": {
"category": "Security Center"
},
"version": "1.2.1",
"versions": [
"1.2.1",
"1.0.0"
],
"parameters": {},
"policyDefinitions": [
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a8bef009-a5c9-4d0f-90d7-6018734e8a16",
"definitionVersion": "1.*.*",
"policyDefinitionReferenceId": "RefId1"
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/af8051bf-258b-44e2-a2bf-165330459f9d",
"definitionVersion": "1.*.*",
"policyDefinitionReferenceId": "RefId2"
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/86b3d65f-7626-441e-b690-81a8b71cff60",
"definitionVersion": "1.*.*",
"policyDefinitionReferenceId": "RefId3"
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/655cb504-bcee-4362-bd4c-402e6aa38759",
"definitionVersion": "1.*.*",
"policyDefinitionReferenceId": "RefId4"
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b0f33259-77d7-4c9e-aac6-3aabcfae693c",
"policyDefinitionReferenceId": "RefId5"
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/47a6b606-51aa-4496-8bb7-64b11cf66adc",
"definitionVersion": "1.*.*",
"policyDefinitionReferenceId": "RefId6"
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/44452482-524f-4bf4-b852-0bff7cc4a3ed",
"definitionVersion": "1.*.*",
"policyDefinitionReferenceId": "RefId7"
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15",
"policyDefinitionReferenceId": "RefId8"
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/af6cd1bd-1635-48cb-bde7-5b15693900b9",
"definitionVersion": "1.*.*",
"policyDefinitionReferenceId": "RefId9"
},
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0961003e-5a0a-4549-abde-af6a37f2724d",
"definitionVersion": "1.*.*",
"policyDefinitionReferenceId": "RefId10"
}
]
},
"id": "/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8",
"type": "Microsoft.Authorization/policySetDefinitions",
"name": "1f3afdf9-d0c9-4c3d-847f-89da613e70a8"
},
{
"id": "/providers/Microsoft.Management/managementgroups/MyManagementGroup/providers/Microsoft.Authorization/policySetDefinitions/CostManagement",
"type": "Microsoft.Authorization/policySetDefinitions",
"name": "CostManagement",
"properties": {
"displayName": "Cost Management",
"description": "Policies to enforce low cost storage SKUs",
"metadata": {
"category": "Cost Management"
},
"version": "1.2.1",
"versions": [
"1.2.1",
"1.0.0"
],
"policyDefinitions": [
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7433c107-6db4-4ad1-b57a-a76dce0154a1",
"definitionVersion": "1.*.*",
"policyDefinitionReferenceId": "Limit_Skus",
"parameters": {
"listOfAllowedSKUs": {
"value": [
"Standard_GRS",
"Standard_LRS"
]
}
}
},
{
"policyDefinitionId": "/providers/Microsoft.Management/managementgroups/MyManagementGroup/providers/Microsoft.Authorization/policyDefinitions/ResourceNaming",
"definitionVersion": "1.*.*",
"policyDefinitionReferenceId": "Resource_Naming",
"parameters": {
"prefix": {
"value": "DeptA"
},
"suffix": {
"value": "-LC"
}
}
}
]
}
}
]
}
Definitions
Name | Description |
---|---|
Cloud |
An error response from a policy operation. |
created |
The type of identity that created the resource. |
Error |
The resource management error additional info. |
Error |
Error Response |
Metadata |
General metadata for the parameter. |
Parameter |
The definition of a parameter that can be provided to the policy. |
parameter |
The data type of the parameter. |
Parameter |
The value of a parameter. |
Policy |
The policy definition group. |
Policy |
The policy definition reference. |
Policy |
The policy set definition. |
Policy |
List of policy set definitions. |
policy |
The type of policy set definition. Possible values are NotSpecified, BuiltIn, Custom, and Static. |
system |
Metadata pertaining to creation and last modification of the resource. |
CloudError
An error response from a policy operation.
Name | Type | Description |
---|---|---|
error |
Error Response |
createdByType
The type of identity that created the resource.
Name | Type | Description |
---|---|---|
Application |
string |
|
Key |
string |
|
ManagedIdentity |
string |
|
User |
string |
ErrorAdditionalInfo
The resource management error additional info.
Name | Type | Description |
---|---|---|
info |
object |
The additional info. |
type |
string |
The additional info type. |
ErrorResponse
Error Response
Name | Type | Description |
---|---|---|
additionalInfo |
The error additional info. |
|
code |
string |
The error code. |
details |
The error details. |
|
message |
string |
The error message. |
target |
string |
The error target. |
Metadata
General metadata for the parameter.
Name | Type | Description |
---|---|---|
assignPermissions |
boolean |
Set to true to have Azure portal create role assignments on the resource ID or resource scope value of this parameter during policy assignment. This property is useful in case you wish to assign permissions outside the assignment scope. |
description |
string |
The description of the parameter. |
displayName |
string |
The display name for the parameter. |
strongType |
string |
Used when assigning the policy definition through the portal. Provides a context aware list of values for the user to choose from. |
ParameterDefinitionsValue
The definition of a parameter that can be provided to the policy.
Name | Type | Description |
---|---|---|
allowedValues |
object[] |
The allowed values for the parameter. |
defaultValue |
object |
The default value for the parameter if no value is provided. |
metadata |
General metadata for the parameter. |
|
schema |
object |
Provides validation of parameter inputs during assignment using a self-defined JSON schema. This property is only supported for object-type parameters and follows the Json.NET Schema 2019-09 implementation. You can learn more about using schemas at https://json-schema.org/ and test draft schemas at https://www.jsonschemavalidator.net/. |
type |
The data type of the parameter. |
parameterType
The data type of the parameter.
Name | Type | Description |
---|---|---|
Array |
string |
|
Boolean |
string |
|
DateTime |
string |
|
Float |
string |
|
Integer |
string |
|
Object |
string |
|
String |
string |
ParameterValuesValue
The value of a parameter.
Name | Type | Description |
---|---|---|
value |
object |
The value of the parameter. |
PolicyDefinitionGroup
The policy definition group.
Name | Type | Description |
---|---|---|
additionalMetadataId |
string |
A resource ID of a resource that contains additional metadata about the group. |
category |
string |
The group's category. |
description |
string |
The group's description. |
displayName |
string |
The group's display name. |
name |
string |
The name of the group. |
PolicyDefinitionReference
The policy definition reference.
Name | Type | Description |
---|---|---|
definitionVersion |
string |
The version of the policy definition to use. |
effectiveDefinitionVersion |
string |
The effective version of the policy definition in use. This is only present if requested via the $expand query parameter. |
groupNames |
string[] |
The name of the groups that this policy definition reference belongs to. |
latestDefinitionVersion |
string |
The latest version of the policy definition available. This is only present if requested via the $expand query parameter. |
parameters |
<string,
Parameter |
The parameter values for the referenced policy rule. The keys are the parameter names. |
policyDefinitionId |
string |
The ID of the policy definition or policy set definition. |
policyDefinitionReferenceId |
string |
A unique id (within the policy set definition) for this policy definition reference. |
PolicySetDefinition
The policy set definition.
Name | Type | Description |
---|---|---|
id |
string |
The ID of the policy set definition. |
name |
string |
The name of the policy set definition. |
properties.description |
string |
The policy set definition description. |
properties.displayName |
string |
The display name of the policy set definition. |
properties.metadata |
object |
The policy set definition metadata. Metadata is an open ended object and is typically a collection of key value pairs. |
properties.parameters |
<string,
Parameter |
The policy set definition parameters that can be used in policy definition references. |
properties.policyDefinitionGroups |
The metadata describing groups of policy definition references within the policy set definition. |
|
properties.policyDefinitions |
An array of policy definition references. |
|
properties.policyType |
The type of policy set definition. Possible values are NotSpecified, BuiltIn, Custom, and Static. |
|
properties.version |
string |
The policy set definition version in #.#.# format. |
properties.versions |
string[] |
A list of available versions for this policy set definition. |
systemData |
The system metadata relating to this resource. |
|
type |
string |
The type of the resource (Microsoft.Authorization/policySetDefinitions). |
PolicySetDefinitionListResult
List of policy set definitions.
Name | Type | Description |
---|---|---|
nextLink |
string |
The URL to use for getting the next set of results. |
value |
An array of policy set definitions. |
policyType
The type of policy set definition. Possible values are NotSpecified, BuiltIn, Custom, and Static.
Name | Type | Description |
---|---|---|
BuiltIn |
string |
|
Custom |
string |
|
NotSpecified |
string |
|
Static |
string |
systemData
Metadata pertaining to creation and last modification of the resource.
Name | Type | Description |
---|---|---|
createdAt |
string |
The timestamp of resource creation (UTC). |
createdBy |
string |
The identity that created the resource. |
createdByType |
The type of identity that created the resource. |
|
lastModifiedAt |
string |
The timestamp of resource last modification (UTC) |
lastModifiedBy |
string |
The identity that last modified the resource. |
lastModifiedByType |
The type of identity that last modified the resource. |