We recommend using Azure Native.
published on Monday, Mar 9, 2026 by Pulumi
We recommend using Azure Native.
published on Monday, Mar 9, 2026 by Pulumi
Configures the specified Policy Definition at the specified Scope. Also, Policy Set Definitions are supported.
!> Note: The azure.policy.Assignment resource has been deprecated in favour of the azure.management.GroupPolicyAssignment, azure.core.ResourcePolicyAssignment, azure.core.ResourceGroupPolicyAssignment and azure.core.SubscriptionPolicyAssignment resources and will be removed in v3.0 of the Azure Provider.
Example Usage
using Pulumi;
using Azure = Pulumi.Azure;
class MyStack : Stack
{
public MyStack()
{
var exampleDefinition = new Azure.Policy.Definition("exampleDefinition", new Azure.Policy.DefinitionArgs
{
PolicyType = "Custom",
Mode = "All",
DisplayName = "my-policy-definition",
PolicyRule = @" {
""if"": {
""not"": {
""field"": ""location"",
""in"": ""[parameters('allowedLocations')]""
}
},
""then"": {
""effect"": ""audit""
}
}
",
Parameters = @" {
""allowedLocations"": {
""type"": ""Array"",
""metadata"": {
""description"": ""The list of allowed locations for resources."",
""displayName"": ""Allowed locations"",
""strongType"": ""location""
}
}
}
",
});
var exampleResourceGroup = new Azure.Core.ResourceGroup("exampleResourceGroup", new Azure.Core.ResourceGroupArgs
{
Location = "West Europe",
});
var exampleAssignment = new Azure.Policy.Assignment("exampleAssignment", new Azure.Policy.AssignmentArgs
{
Scope = exampleResourceGroup.Id,
PolicyDefinitionId = exampleDefinition.Id,
Description = "Policy Assignment created via an Acceptance Test",
DisplayName = "My Example Policy Assignment",
Metadata = @" {
""category"": ""General""
}
",
Parameters = @"{
""allowedLocations"": {
""value"": [ ""West Europe"" ]
}
}
",
});
}
}
package main
import (
"fmt"
"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/core"
"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/policy"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
exampleDefinition, err := policy.NewDefinition(ctx, "exampleDefinition", &policy.DefinitionArgs{
PolicyType: pulumi.String("Custom"),
Mode: pulumi.String("All"),
DisplayName: pulumi.String("my-policy-definition"),
PolicyRule: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v", " {\n", " \"if\": {\n", " \"not\": {\n", " \"field\": \"location\",\n", " \"in\": \"[parameters('allowedLocations')]\"\n", " }\n", " },\n", " \"then\": {\n", " \"effect\": \"audit\"\n", " }\n", " }\n")),
Parameters: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v", " {\n", " \"allowedLocations\": {\n", " \"type\": \"Array\",\n", " \"metadata\": {\n", " \"description\": \"The list of allowed locations for resources.\",\n", " \"displayName\": \"Allowed locations\",\n", " \"strongType\": \"location\"\n", " }\n", " }\n", " }\n")),
})
if err != nil {
return err
}
exampleResourceGroup, err := core.NewResourceGroup(ctx, "exampleResourceGroup", &core.ResourceGroupArgs{
Location: pulumi.String("West Europe"),
})
if err != nil {
return err
}
_, err = policy.NewAssignment(ctx, "exampleAssignment", &policy.AssignmentArgs{
Scope: exampleResourceGroup.ID(),
PolicyDefinitionId: exampleDefinition.ID(),
Description: pulumi.String("Policy Assignment created via an Acceptance Test"),
DisplayName: pulumi.String("My Example Policy Assignment"),
Metadata: pulumi.String(fmt.Sprintf("%v%v%v", " {\n", " \"category\": \"General\"\n", " }\n")),
Parameters: pulumi.String(fmt.Sprintf("%v%v%v%v%v", "{\n", " \"allowedLocations\": {\n", " \"value\": [ \"West Europe\" ]\n", " }\n", "}\n")),
})
if err != nil {
return err
}
return nil
})
}
Example coming soon!
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
const exampleDefinition = new azure.policy.Definition("exampleDefinition", {
policyType: "Custom",
mode: "All",
displayName: "my-policy-definition",
policyRule: ` {
"if": {
"not": {
"field": "location",
"in": "[parameters('allowedLocations')]"
}
},
"then": {
"effect": "audit"
}
}
`,
parameters: ` {
"allowedLocations": {
"type": "Array",
"metadata": {
"description": "The list of allowed locations for resources.",
"displayName": "Allowed locations",
"strongType": "location"
}
}
}
`,
});
const exampleResourceGroup = new azure.core.ResourceGroup("exampleResourceGroup", {location: "West Europe"});
const exampleAssignment = new azure.policy.Assignment("exampleAssignment", {
scope: exampleResourceGroup.id,
policyDefinitionId: exampleDefinition.id,
description: "Policy Assignment created via an Acceptance Test",
displayName: "My Example Policy Assignment",
metadata: ` {
"category": "General"
}
`,
parameters: `{
"allowedLocations": {
"value": [ "West Europe" ]
}
}
`,
});
import pulumi
import pulumi_azure as azure
example_definition = azure.policy.Definition("exampleDefinition",
policy_type="Custom",
mode="All",
display_name="my-policy-definition",
policy_rule=""" {
"if": {
"not": {
"field": "location",
"in": "[parameters('allowedLocations')]"
}
},
"then": {
"effect": "audit"
}
}
""",
parameters=""" {
"allowedLocations": {
"type": "Array",
"metadata": {
"description": "The list of allowed locations for resources.",
"displayName": "Allowed locations",
"strongType": "location"
}
}
}
""")
example_resource_group = azure.core.ResourceGroup("exampleResourceGroup", location="West Europe")
example_assignment = azure.policy.Assignment("exampleAssignment",
scope=example_resource_group.id,
policy_definition_id=example_definition.id,
description="Policy Assignment created via an Acceptance Test",
display_name="My Example Policy Assignment",
metadata=""" {
"category": "General"
}
""",
parameters="""{
"allowedLocations": {
"value": [ "West Europe" ]
}
}
""")
Example coming soon!
Create Assignment Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new Assignment(name: string, args: AssignmentArgs, opts?: CustomResourceOptions);@overload
def Assignment(resource_name: str,
args: AssignmentArgs,
opts: Optional[ResourceOptions] = None)
@overload
def Assignment(resource_name: str,
opts: Optional[ResourceOptions] = None,
policy_definition_id: Optional[str] = None,
scope: Optional[str] = None,
description: Optional[str] = None,
display_name: Optional[str] = None,
enforcement_mode: Optional[bool] = None,
identity: Optional[AssignmentIdentityArgs] = None,
location: Optional[str] = None,
metadata: Optional[str] = None,
name: Optional[str] = None,
not_scopes: Optional[Sequence[str]] = None,
parameters: Optional[str] = None)func NewAssignment(ctx *Context, name string, args AssignmentArgs, opts ...ResourceOption) (*Assignment, error)public Assignment(string name, AssignmentArgs args, CustomResourceOptions? opts = null)
public Assignment(String name, AssignmentArgs args)
public Assignment(String name, AssignmentArgs args, CustomResourceOptions options)
type: azure:policy:Assignment
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args AssignmentArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args AssignmentArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args AssignmentArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args AssignmentArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args AssignmentArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var exampleassignmentResourceResourceFromPolicyassignment = new Azure.Policy.Assignment("exampleassignmentResourceResourceFromPolicyassignment", new()
{
PolicyDefinitionId = "string",
Scope = "string",
Description = "string",
DisplayName = "string",
EnforcementMode = false,
Identity = new Azure.Policy.Inputs.AssignmentIdentityArgs
{
PrincipalId = "string",
TenantId = "string",
Type = "string",
},
Location = "string",
Metadata = "string",
Name = "string",
NotScopes = new[]
{
"string",
},
Parameters = "string",
});
example, err := policy.NewAssignment(ctx, "exampleassignmentResourceResourceFromPolicyassignment", &policy.AssignmentArgs{
PolicyDefinitionId: pulumi.String("string"),
Scope: pulumi.String("string"),
Description: pulumi.String("string"),
DisplayName: pulumi.String("string"),
EnforcementMode: pulumi.Bool(false),
Identity: &policy.AssignmentIdentityArgs{
PrincipalId: pulumi.String("string"),
TenantId: pulumi.String("string"),
Type: pulumi.String("string"),
},
Location: pulumi.String("string"),
Metadata: pulumi.String("string"),
Name: pulumi.String("string"),
NotScopes: pulumi.StringArray{
pulumi.String("string"),
},
Parameters: pulumi.String("string"),
})
var exampleassignmentResourceResourceFromPolicyassignment = new com.pulumi.azure.policy.Assignment("exampleassignmentResourceResourceFromPolicyassignment", com.pulumi.azure.policy.AssignmentArgs.builder()
.policyDefinitionId("string")
.scope("string")
.description("string")
.displayName("string")
.enforcementMode(false)
.identity(AssignmentIdentityArgs.builder()
.principalId("string")
.tenantId("string")
.type("string")
.build())
.location("string")
.metadata("string")
.name("string")
.notScopes("string")
.parameters("string")
.build());
exampleassignment_resource_resource_from_policyassignment = azure.policy.Assignment("exampleassignmentResourceResourceFromPolicyassignment",
policy_definition_id="string",
scope="string",
description="string",
display_name="string",
enforcement_mode=False,
identity={
"principal_id": "string",
"tenant_id": "string",
"type": "string",
},
location="string",
metadata="string",
name="string",
not_scopes=["string"],
parameters="string")
const exampleassignmentResourceResourceFromPolicyassignment = new azure.policy.Assignment("exampleassignmentResourceResourceFromPolicyassignment", {
policyDefinitionId: "string",
scope: "string",
description: "string",
displayName: "string",
enforcementMode: false,
identity: {
principalId: "string",
tenantId: "string",
type: "string",
},
location: "string",
metadata: "string",
name: "string",
notScopes: ["string"],
parameters: "string",
});
type: azure:policy:Assignment
properties:
description: string
displayName: string
enforcementMode: false
identity:
principalId: string
tenantId: string
type: string
location: string
metadata: string
name: string
notScopes:
- string
parameters: string
policyDefinitionId: string
scope: string
Assignment Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The Assignment resource accepts the following input properties:
- Policy
Definition stringId - The ID of the Policy Definition to be applied at the specified Scope.
- Scope string
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created. - Description string
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- Display
Name string - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- Enforcement
Mode bool - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- Identity
Assignment
Identity - An
identityblock as defined below. - Location string
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- Metadata string
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- Name string
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- Not
Scopes List<string> - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - Parameters string
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- Policy
Definition stringId - The ID of the Policy Definition to be applied at the specified Scope.
- Scope string
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created. - Description string
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- Display
Name string - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- Enforcement
Mode bool - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- Identity
Assignment
Identity Args - An
identityblock as defined below. - Location string
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- Metadata string
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- Name string
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- Not
Scopes []string - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - Parameters string
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- policy
Definition StringId - The ID of the Policy Definition to be applied at the specified Scope.
- scope String
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created. - description String
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- display
Name String - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- enforcement
Mode Boolean - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- identity
Assignment
Identity - An
identityblock as defined below. - location String
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- metadata String
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- name String
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- not
Scopes List<String> - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - parameters String
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- policy
Definition stringId - The ID of the Policy Definition to be applied at the specified Scope.
- scope string
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created. - description string
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- display
Name string - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- enforcement
Mode boolean - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- identity
Assignment
Identity - An
identityblock as defined below. - location string
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- metadata string
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- name string
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- not
Scopes string[] - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - parameters string
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- policy_
definition_ strid - The ID of the Policy Definition to be applied at the specified Scope.
- scope str
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created. - description str
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- display_
name str - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- enforcement_
mode bool - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- identity
Assignment
Identity Args - An
identityblock as defined below. - location str
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- metadata str
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- name str
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- not_
scopes Sequence[str] - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - parameters str
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- policy
Definition StringId - The ID of the Policy Definition to be applied at the specified Scope.
- scope String
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created. - description String
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- display
Name String - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- enforcement
Mode Boolean - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- identity Property Map
- An
identityblock as defined below. - location String
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- metadata String
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- name String
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- not
Scopes List<String> - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - parameters String
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
Outputs
All input properties are implicitly available as output properties. Additionally, the Assignment resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing Assignment Resource
Get an existing Assignment resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: AssignmentState, opts?: CustomResourceOptions): Assignment@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
description: Optional[str] = None,
display_name: Optional[str] = None,
enforcement_mode: Optional[bool] = None,
identity: Optional[AssignmentIdentityArgs] = None,
location: Optional[str] = None,
metadata: Optional[str] = None,
name: Optional[str] = None,
not_scopes: Optional[Sequence[str]] = None,
parameters: Optional[str] = None,
policy_definition_id: Optional[str] = None,
scope: Optional[str] = None) -> Assignmentfunc GetAssignment(ctx *Context, name string, id IDInput, state *AssignmentState, opts ...ResourceOption) (*Assignment, error)public static Assignment Get(string name, Input<string> id, AssignmentState? state, CustomResourceOptions? opts = null)public static Assignment get(String name, Output<String> id, AssignmentState state, CustomResourceOptions options)resources: _: type: azure:policy:Assignment get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Description string
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- Display
Name string - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- Enforcement
Mode bool - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- Identity
Assignment
Identity - An
identityblock as defined below. - Location string
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- Metadata string
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- Name string
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- Not
Scopes List<string> - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - Parameters string
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- Policy
Definition stringId - The ID of the Policy Definition to be applied at the specified Scope.
- Scope string
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
- Description string
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- Display
Name string - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- Enforcement
Mode bool - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- Identity
Assignment
Identity Args - An
identityblock as defined below. - Location string
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- Metadata string
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- Name string
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- Not
Scopes []string - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - Parameters string
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- Policy
Definition stringId - The ID of the Policy Definition to be applied at the specified Scope.
- Scope string
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
- description String
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- display
Name String - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- enforcement
Mode Boolean - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- identity
Assignment
Identity - An
identityblock as defined below. - location String
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- metadata String
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- name String
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- not
Scopes List<String> - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - parameters String
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- policy
Definition StringId - The ID of the Policy Definition to be applied at the specified Scope.
- scope String
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
- description string
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- display
Name string - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- enforcement
Mode boolean - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- identity
Assignment
Identity - An
identityblock as defined below. - location string
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- metadata string
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- name string
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- not
Scopes string[] - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - parameters string
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- policy
Definition stringId - The ID of the Policy Definition to be applied at the specified Scope.
- scope string
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
- description str
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- display_
name str - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- enforcement_
mode bool - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- identity
Assignment
Identity Args - An
identityblock as defined below. - location str
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- metadata str
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- name str
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- not_
scopes Sequence[str] - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - parameters str
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- policy_
definition_ strid - The ID of the Policy Definition to be applied at the specified Scope.
- scope str
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
- description String
- A description to use for this Policy Assignment. Changing this forces a new resource to be created.
- display
Name String - A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
- enforcement
Mode Boolean - Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
- identity Property Map
- An
identityblock as defined below. - location String
- The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
- metadata String
- The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
- name String
- The name of the Policy Assignment. Changing this forces a new resource to be created.
- not
Scopes List<String> - A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g.
/subscriptions/00000000-0000-0000-000000000000or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). - parameters String
- Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
- policy
Definition StringId - The ID of the Policy Definition to be applied at the specified Scope.
- scope String
- The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g.
/subscriptions/00000000-0000-0000-000000000000or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
Supporting Types
AssignmentIdentity, AssignmentIdentityArgs
- Principal
Id string - The Principal ID of this Policy Assignment if
typeisSystemAssigned. - Tenant
Id string - The Tenant ID of this Policy Assignment if
typeisSystemAssigned. - Type string
- The type of Managed Identity for this Policy Assignment. Possible values are
SystemAssigned(where Azure will generate a Service Principal for you).
- Principal
Id string - The Principal ID of this Policy Assignment if
typeisSystemAssigned. - Tenant
Id string - The Tenant ID of this Policy Assignment if
typeisSystemAssigned. - Type string
- The type of Managed Identity for this Policy Assignment. Possible values are
SystemAssigned(where Azure will generate a Service Principal for you).
- principal
Id String - The Principal ID of this Policy Assignment if
typeisSystemAssigned. - tenant
Id String - The Tenant ID of this Policy Assignment if
typeisSystemAssigned. - type String
- The type of Managed Identity for this Policy Assignment. Possible values are
SystemAssigned(where Azure will generate a Service Principal for you).
- principal
Id string - The Principal ID of this Policy Assignment if
typeisSystemAssigned. - tenant
Id string - The Tenant ID of this Policy Assignment if
typeisSystemAssigned. - type string
- The type of Managed Identity for this Policy Assignment. Possible values are
SystemAssigned(where Azure will generate a Service Principal for you).
- principal_
id str - The Principal ID of this Policy Assignment if
typeisSystemAssigned. - tenant_
id str - The Tenant ID of this Policy Assignment if
typeisSystemAssigned. - type str
- The type of Managed Identity for this Policy Assignment. Possible values are
SystemAssigned(where Azure will generate a Service Principal for you).
- principal
Id String - The Principal ID of this Policy Assignment if
typeisSystemAssigned. - tenant
Id String - The Tenant ID of this Policy Assignment if
typeisSystemAssigned. - type String
- The type of Managed Identity for this Policy Assignment. Possible values are
SystemAssigned(where Azure will generate a Service Principal for you).
Import
Policy Assignments can be imported using the policy name, e.g.
$ pulumi import azure:policy/assignment:Assignment assignment1 /subscriptions/00000000-0000-0000-000000000000/providers/Microsoft.Authorization/policyAssignments/assignment1
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Azure Classic pulumi/pulumi-azure
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
azurermTerraform Provider.
We recommend using Azure Native.
published on Monday, Mar 9, 2026 by Pulumi
