Skip to content

Commit 1b282bc

Browse files
Merge pull request #214621 from shanhix1/patch-16
More selectors & overrides additions
2 parents 8af62ac + dfbc3d0 commit 1b282bc

File tree

2 files changed

+106
-25
lines changed

2 files changed

+106
-25
lines changed

articles/governance/policy/concepts/assignment-structure.md

Lines changed: 38 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -19,17 +19,17 @@ resource properties with different needs for compliance.
1919
2020
You use JavaScript Object Notation (JSON) to create a policy assignment. The policy assignment contains elements for:
2121

22-
- display name
23-
- description
24-
- metadata
25-
- enforcement mode
26-
- excluded scopes
27-
- policy definition
28-
- non-compliance messages
29-
- parameters
30-
- identity
31-
- resource selectors (preview)
32-
- overrides (preview)
22+
- [display name](#display-name-and-description)
23+
- [description](#display-name-and-description)
24+
- [metadata](#metadata)
25+
- [resource selectors (preview)](#resource-selectors-preview)
26+
- [overrides (preview)](#overrides-preview)
27+
- [enforcement mode](#enforcement-mode)
28+
- [excluded scopes](#excluded-scopes)
29+
- [policy definition](#policy-definition-id)
30+
- [non-compliance messages](#non-compliance-messages)
31+
- [parameters](#parameters)
32+
- [identity](#identity)
3333

3434
For example, the following JSON shows a policy assignment in _DoNotEnforce_ mode with dynamic
3535
parameters:
@@ -191,15 +191,22 @@ shows our policy assignment with two additional Azure regions added to the **SDP
191191

192192
Resource selectors have the following properties:
193193
- `name`: The name of the resource selector.
194-
- `selectors`: The factor used to determine which subset of resources applicable to the policy assignment should be evaluated for compliance.
195-
- `kind`: The property of a `selector` that describes what characteristic will narrow down the set of evaluated resources. Each 'kind' can only be used once in a single resource selector. Allowed values are:
196-
- `resourceLocation`: This is used to select resources based on their type. Can be used in up to 10 resource selectors. Cannot be used in the same resource selector as `resourceWithoutLocation`.
194+
195+
- `selectors`: (Optional) The property used to determine which subset of resources applicable to the policy assignment should be evaluated for compliance.
196+
197+
- `kind`: The property of a selector that describes what characteristic will narrow down the set of evaluated resources. Each kind can only be used once in a single resource selector. Allowed values are:
198+
199+
- `resourceLocation`: This is used to select resources based on their type. Cannot be used in the same resource selector as `resourceWithoutLocation`.
200+
197201
- `resourceType`: This is used to select resources based on their type.
202+
198203
- `resourceWithoutLocation`: This is used to select resources at the subscription level which do not have a location. Currently only supports `subscriptionLevelResources`. Cannot be used in the same resource selector as `resourceLocation`.
204+
199205
- `in`: The list of allowed values for the specified `kind`. Cannot be used with `notIn`. Can contain up to 50 values.
206+
200207
- `notIn`: The list of not-allowed values for the specified `kind`. Cannot be used with `in`. Can contain up to 50 values.
201208

202-
A **resource selector** can contain multiple **selectors**. To be applicable to a resource selector, a resource must meet requirements specified by all its selectors. Further, multiple **resource selectors** can be specified in a single assignment. In-scope resources are evaluated when they satisfy any one of these resource selectors.
209+
A **resource selector** can contain multiple **selectors**. To be applicable to a resource selector, a resource must meet requirements specified by all its selectors. Further, up to 10 **resource selectors** can be specified in a single assignment. In-scope resources are evaluated when they satisfy any one of these resource selectors.
203210

204211
## Overrides (preview)
205212

@@ -234,7 +241,22 @@ Let's take a look at an example. Imagine you have a policy initiative named _Cos
234241
}
235242
```
236243

237-
Note that one override can be used to replace the effect of many policies by specifying multiple values in the policyDefinitionReferenceId array. A single override can be used for up to 50 policyDefinitionReferenceIds, and a single policy assignment can contain up to 10 overrides, evaluated in the order in which they are specified. Before the assignment is created, the effect chosen in the override is validated against the policy rule and parameter allowed value list, in cases where the effect is [parameterized](definition-structure.md#parameters).
244+
Overrides have the following properties:
245+
- `kind`: The property the assignment will override. The supported kind is `policyEffect`.
246+
247+
- `value`: The new value which will override the existing value. The supported values are [effects](effects.md).
248+
249+
- `selectors`: (Optional) The property used to determine what scope of the policy assignment should take on the override.
250+
251+
- `kind`: The property of a selector that describes what characteristic will narrow down the scope of the override. Allowed value for `kind: policyEffect` is:
252+
253+
- `policyDefinitionReferenceId`: This specifies which policy definitions within an initiative assignment should take on the effect override.
254+
255+
- `in`: The list of allowed values for the specified `kind`. Cannot be used with `notIn`. Can contain up to 50 values.
256+
257+
- `notIn`: The list of not-allowed values for the specified `kind`. Cannot be used with `in`. Can contain up to 50 values.
258+
259+
Note that one override can be used to replace the effect of many policies by specifying multiple values in the policyDefinitionReferenceId array. A single override can be used for up to 50 policyDefinitionReferenceIds, and a single policy assignment can contain up to 10 overrides, evaluated in the order in which they are specified. Before the assignment is created, the effect chosen in the override is validated against the policy rule and parameter allowed value list (in cases where the effect is [parameterized](definition-structure.md#parameters)).
238260

239261
## Enforcement mode
240262

articles/governance/policy/concepts/exemption-structure.md

Lines changed: 68 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,15 @@ see [Understand scope in Azure Policy](./scope.md). Azure Policy exemptions only
1717

1818
You use JavaScript Object Notation (JSON) to create a policy exemption. The policy exemption contains elements for:
1919

20-
- display name
21-
- description
22-
- metadata
23-
- policy assignment
24-
- policy definitions within an initiative
25-
- exemption category
26-
- expiration
20+
- [display name](#display-name-and-description)
21+
- [description](#display-name-and-description)
22+
- [metadata](#metadata)
23+
- [policy assignment](#policy-assignment-id)
24+
- [policy definitions within an initiative](#policy-definition-ids)
25+
- [exemption category](#exemption-category)
26+
- [expiration](#expiration)
27+
- [resource selectors](#resource-selectors-preview)
28+
- [assignment scope validation](#assignment-scope-validation-preview)
2729

2830
> [!NOTE]
2931
> A policy exemption is created as a child object on the resource hierarchy or the individual
@@ -58,7 +60,8 @@ two of the policy definitions in the initiative, the `customOrgPolicy` custom po
5860
"allowedLocations"
5961
],
6062
"exemptionCategory": "waiver",
61-
"expiresOn": "2020-12-31T23:59:00.0000000Z"
63+
"expiresOn": "2020-12-31T23:59:00.0000000Z",
64+
"assignmentScopeValidation": "Default"
6265
}
6366
}
6467
```
@@ -136,6 +139,62 @@ format `yyyy-MM-ddTHH:mm:ss.fffffffZ`.
136139
> The policy exemptions isn't deleted when the `expiresOn` date is reached. The object is preserved
137140
> for record-keeping, but the exemption is no longer honored.
138141
142+
## Resource selectors (preview)
143+
144+
Exemptions support an optional property `resourceSelectors`. This property works the same way in exemptions as it does in assignments, allowing for gradual rollout or rollback of an _exemption_ to certain subsets of resources in a controlled manner based on resource type, resource location, or whether the resource has a location. More details about how to use resource selectors can be found in the [assignment structure](assignment-structure.md#resource-selectors-preview). Below is an example exemption JSON which leverages resource selectors. In this example, only resources in `westcentralus` will be exempt from the policy assignment:
145+
146+
```json
147+
{
148+
"properties": {
149+
"policyAssignmentId": "/subscriptions/{subId}/providers/Microsoft.Authorization/policyAssignments/CostManagement",
150+
"policyDefinitionReferenceIds": [
151+
"limitSku", "limitType"
152+
],
153+
"exemptionCategory": "Waiver",
154+
"resourceSelectors": [
155+
{
156+
"name": "TemporaryMitigation",
157+
"selectors": [
158+
{
159+
"kind": "resourceLocation",
160+
"in": [ "westcentralus" ]
161+
}
162+
]
163+
}
164+
]
165+
},
166+
"systemData": { ... },
167+
"id": "/subscriptions/{subId}/resourceGroups/demoCluster/providers/Microsoft.Authorization/policyExemptions/DemoExpensiveVM",
168+
"type": "Microsoft.Authorization/policyExemptions",
169+
"name": "DemoExpensiveVM"
170+
}
171+
```
172+
173+
Regions can be added or removed from the `resourceLocation` list in the example above. Resource selectors allow for greater flexibility of where and how exemptions can be created and managed.
174+
175+
## Assignment scope validation (preview)
176+
177+
In most scenarios, the exemption scope is validated to ensure it is at or under the policy assignment scope. The optional `assignmentScopeValidation` property can allow an exemption to bypass this validation and be created outside of the assignment scope. This is intended for situations where a subscription needs to be moved from one management group (MG) to another, but the move would be blocked by policy due to properties of resources within the subscription. In this scenario, an exemption could be created for the subscription in its current MG to exempt its resources from a policy assignment on the destination MG. That way, when the subscription is moved into the destination MG, the operation is not blocked because resources are already exempt from the policy assignment in question. The use of this property is illustrated below:
178+
179+
```json
180+
{
181+
"properties": {
182+
"policyAssignmentId": "/providers/Microsoft.Management/managementGroups/{mgB}/providers/Microsoft.Authorization/policyAssignments/CostManagement",
183+
"policyDefinitionReferenceIds": [
184+
"limitSku", "limitType"
185+
],
186+
"exemptionCategory": "Waiver",
187+
"assignmentScopeValidation": "DoNotValidate",
188+
},
189+
"systemData": { ... },
190+
"id": "/subscriptions/{subIdA}/providers/Microsoft.Authorization/policyExemptions/DemoExpensiveVM",
191+
"type": "Microsoft.Authorization/policyExemptions",
192+
"name": "DemoExpensiveVM"
193+
}
194+
```
195+
196+
Allowed values for `assignmentScopeValidation` are `Default`and `DoNotValidate`. If not specified, the default validation process will occur.
197+
139198
## Required permissions
140199

141200
The Azure RBAC permissions needed to manage Policy exemption objects are in the
@@ -159,4 +218,4 @@ assignment.
159218
- Learn how to [get compliance data](../how-to/get-compliance-data.md).
160219
- Learn how to [remediate non-compliant resources](../how-to/remediate-resources.md).
161220
- Review what a management group is with
162-
[Organize your resources with Azure management groups](../../management-groups/overview.md).
221+
[Organize your resources with Azure management groups](../../management-groups/overview.md).

0 commit comments

Comments
 (0)