You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
For example, the following JSON shows a policy assignment in _DoNotEnforce_ mode with dynamic
35
35
parameters:
@@ -191,15 +191,22 @@ shows our policy assignment with two additional Azure regions added to the **SDP
191
191
192
192
Resource selectors have the following properties:
193
193
-`name`: The name of the resource selector.
194
-
-`selectors`: The factor used to determine which subset of resources applicable to the policy assignment should be evaluated for compliance.
195
-
-`kind`: The property of a `selector` that describes what characteristic will narrow down the set of evaluated resources. Each 'kind' can only be used once in a single resource selector. Allowed values are:
196
-
-`resourceLocation`: This is used to select resources based on their type. Can be used in up to 10 resource selectors. Cannot be used in the same resource selector as `resourceWithoutLocation`.
194
+
195
+
-`selectors`: (Optional) The property used to determine which subset of resources applicable to the policy assignment should be evaluated for compliance.
196
+
197
+
-`kind`: The property of a selector that describes what characteristic will narrow down the set of evaluated resources. Each kind can only be used once in a single resource selector. Allowed values are:
198
+
199
+
-`resourceLocation`: This is used to select resources based on their type. Cannot be used in the same resource selector as `resourceWithoutLocation`.
200
+
197
201
-`resourceType`: This is used to select resources based on their type.
202
+
198
203
-`resourceWithoutLocation`: This is used to select resources at the subscription level which do not have a location. Currently only supports `subscriptionLevelResources`. Cannot be used in the same resource selector as `resourceLocation`.
204
+
199
205
-`in`: The list of allowed values for the specified `kind`. Cannot be used with `notIn`. Can contain up to 50 values.
206
+
200
207
-`notIn`: The list of not-allowed values for the specified `kind`. Cannot be used with `in`. Can contain up to 50 values.
201
208
202
-
A **resource selector** can contain multiple **selectors**. To be applicable to a resource selector, a resource must meet requirements specified by all its selectors. Further, multiple**resource selectors** can be specified in a single assignment. In-scope resources are evaluated when they satisfy any one of these resource selectors.
209
+
A **resource selector** can contain multiple **selectors**. To be applicable to a resource selector, a resource must meet requirements specified by all its selectors. Further, up to 10**resource selectors** can be specified in a single assignment. In-scope resources are evaluated when they satisfy any one of these resource selectors.
203
210
204
211
## Overrides (preview)
205
212
@@ -234,7 +241,22 @@ Let's take a look at an example. Imagine you have a policy initiative named _Cos
234
241
}
235
242
```
236
243
237
-
Note that one override can be used to replace the effect of many policies by specifying multiple values in the policyDefinitionReferenceId array. A single override can be used for up to 50 policyDefinitionReferenceIds, and a single policy assignment can contain up to 10 overrides, evaluated in the order in which they are specified. Before the assignment is created, the effect chosen in the override is validated against the policy rule and parameter allowed value list, in cases where the effect is [parameterized](definition-structure.md#parameters).
244
+
Overrides have the following properties:
245
+
-`kind`: The property the assignment will override. The supported kind is `policyEffect`.
246
+
247
+
-`value`: The new value which will override the existing value. The supported values are [effects](effects.md).
248
+
249
+
-`selectors`: (Optional) The property used to determine what scope of the policy assignment should take on the override.
250
+
251
+
-`kind`: The property of a selector that describes what characteristic will narrow down the scope of the override. Allowed value for `kind: policyEffect` is:
252
+
253
+
-`policyDefinitionReferenceId`: This specifies which policy definitions within an initiative assignment should take on the effect override.
254
+
255
+
-`in`: The list of allowed values for the specified `kind`. Cannot be used with `notIn`. Can contain up to 50 values.
256
+
257
+
-`notIn`: The list of not-allowed values for the specified `kind`. Cannot be used with `in`. Can contain up to 50 values.
258
+
259
+
Note that one override can be used to replace the effect of many policies by specifying multiple values in the policyDefinitionReferenceId array. A single override can be used for up to 50 policyDefinitionReferenceIds, and a single policy assignment can contain up to 10 overrides, evaluated in the order in which they are specified. Before the assignment is created, the effect chosen in the override is validated against the policy rule and parameter allowed value list (in cases where the effect is [parameterized](definition-structure.md#parameters)).
> A policy exemption is created as a child object on the resource hierarchy or the individual
@@ -58,7 +60,8 @@ two of the policy definitions in the initiative, the `customOrgPolicy` custom po
58
60
"allowedLocations"
59
61
],
60
62
"exemptionCategory": "waiver",
61
-
"expiresOn": "2020-12-31T23:59:00.0000000Z"
63
+
"expiresOn": "2020-12-31T23:59:00.0000000Z",
64
+
"assignmentScopeValidation": "Default"
62
65
}
63
66
}
64
67
```
@@ -136,6 +139,62 @@ format `yyyy-MM-ddTHH:mm:ss.fffffffZ`.
136
139
> The policy exemptions isn't deleted when the `expiresOn` date is reached. The object is preserved
137
140
> for record-keeping, but the exemption is no longer honored.
138
141
142
+
## Resource selectors (preview)
143
+
144
+
Exemptions support an optional property `resourceSelectors`. This property works the same way in exemptions as it does in assignments, allowing for gradual rollout or rollback of an _exemption_ to certain subsets of resources in a controlled manner based on resource type, resource location, or whether the resource has a location. More details about how to use resource selectors can be found in the [assignment structure](assignment-structure.md#resource-selectors-preview). Below is an example exemption JSON which leverages resource selectors. In this example, only resources in `westcentralus` will be exempt from the policy assignment:
Regions can be added or removed from the `resourceLocation` list in the example above. Resource selectors allow for greater flexibility of where and how exemptions can be created and managed.
174
+
175
+
## Assignment scope validation (preview)
176
+
177
+
In most scenarios, the exemption scope is validated to ensure it is at or under the policy assignment scope. The optional `assignmentScopeValidation` property can allow an exemption to bypass this validation and be created outside of the assignment scope. This is intended for situations where a subscription needs to be moved from one management group (MG) to another, but the move would be blocked by policy due to properties of resources within the subscription. In this scenario, an exemption could be created for the subscription in its current MG to exempt its resources from a policy assignment on the destination MG. That way, when the subscription is moved into the destination MG, the operation is not blocked because resources are already exempt from the policy assignment in question. The use of this property is illustrated below:
0 commit comments