1. Packages
  2. Packages
  3. Azure Classic
  4. API Docs
  5. policy
  6. Assignment

We recommend using Azure Native.

Viewing docs for Azure v4.42.0 (Older version)
published on Monday, Mar 9, 2026 by Pulumi
azure logo

We recommend using Azure Native.

Viewing docs for Azure v4.42.0 (Older version)
published on Monday, Mar 9, 2026 by Pulumi

    Configures the specified Policy Definition at the specified Scope. Also, Policy Set Definitions are supported.

    !> Note: The azure.policy.Assignment resource has been deprecated in favour of the azure.management.GroupPolicyAssignment, azure.core.ResourcePolicyAssignment, azure.core.ResourceGroupPolicyAssignment and azure.core.SubscriptionPolicyAssignment resources and will be removed in v3.0 of the Azure Provider.

    Example Usage

    using Pulumi;
    using Azure = Pulumi.Azure;
    
    class MyStack : Stack
    {
        public MyStack()
        {
            var exampleDefinition = new Azure.Policy.Definition("exampleDefinition", new Azure.Policy.DefinitionArgs
            {
                PolicyType = "Custom",
                Mode = "All",
                DisplayName = "my-policy-definition",
                PolicyRule = @"	{
        ""if"": {
          ""not"": {
            ""field"": ""location"",
            ""in"": ""[parameters('allowedLocations')]""
          }
        },
        ""then"": {
          ""effect"": ""audit""
        }
      }
    ",
                Parameters = @"	{
        ""allowedLocations"": {
          ""type"": ""Array"",
          ""metadata"": {
            ""description"": ""The list of allowed locations for resources."",
            ""displayName"": ""Allowed locations"",
            ""strongType"": ""location""
          }
        }
      }
    ",
            });
            var exampleResourceGroup = new Azure.Core.ResourceGroup("exampleResourceGroup", new Azure.Core.ResourceGroupArgs
            {
                Location = "West Europe",
            });
            var exampleAssignment = new Azure.Policy.Assignment("exampleAssignment", new Azure.Policy.AssignmentArgs
            {
                Scope = exampleResourceGroup.Id,
                PolicyDefinitionId = exampleDefinition.Id,
                Description = "Policy Assignment created via an Acceptance Test",
                DisplayName = "My Example Policy Assignment",
                Metadata = @"    {
        ""category"": ""General""
        }
    ",
                Parameters = @"{
      ""allowedLocations"": {
        ""value"": [ ""West Europe"" ]
      }
    }
    ",
            });
        }
    
    }
    
    package main
    
    import (
    	"fmt"
    
    	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/core"
    	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/policy"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		exampleDefinition, err := policy.NewDefinition(ctx, "exampleDefinition", &policy.DefinitionArgs{
    			PolicyType:  pulumi.String("Custom"),
    			Mode:        pulumi.String("All"),
    			DisplayName: pulumi.String("my-policy-definition"),
    			PolicyRule: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v", "	{\n", "    \"if\": {\n", "      \"not\": {\n", "        \"field\": \"location\",\n", "        \"in\": \"[parameters('allowedLocations')]\"\n", "      }\n", "    },\n", "    \"then\": {\n", "      \"effect\": \"audit\"\n", "    }\n", "  }\n")),
    			Parameters: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v", "	{\n", "    \"allowedLocations\": {\n", "      \"type\": \"Array\",\n", "      \"metadata\": {\n", "        \"description\": \"The list of allowed locations for resources.\",\n", "        \"displayName\": \"Allowed locations\",\n", "        \"strongType\": \"location\"\n", "      }\n", "    }\n", "  }\n")),
    		})
    		if err != nil {
    			return err
    		}
    		exampleResourceGroup, err := core.NewResourceGroup(ctx, "exampleResourceGroup", &core.ResourceGroupArgs{
    			Location: pulumi.String("West Europe"),
    		})
    		if err != nil {
    			return err
    		}
    		_, err = policy.NewAssignment(ctx, "exampleAssignment", &policy.AssignmentArgs{
    			Scope:              exampleResourceGroup.ID(),
    			PolicyDefinitionId: exampleDefinition.ID(),
    			Description:        pulumi.String("Policy Assignment created via an Acceptance Test"),
    			DisplayName:        pulumi.String("My Example Policy Assignment"),
    			Metadata:           pulumi.String(fmt.Sprintf("%v%v%v", "    {\n", "    \"category\": \"General\"\n", "    }\n")),
    			Parameters:         pulumi.String(fmt.Sprintf("%v%v%v%v%v", "{\n", "  \"allowedLocations\": {\n", "    \"value\": [ \"West Europe\" ]\n", "  }\n", "}\n")),
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    

    Example coming soon!

    import * as pulumi from "@pulumi/pulumi";
    import * as azure from "@pulumi/azure";
    
    const exampleDefinition = new azure.policy.Definition("exampleDefinition", {
        policyType: "Custom",
        mode: "All",
        displayName: "my-policy-definition",
        policyRule: `	{
        "if": {
          "not": {
            "field": "location",
            "in": "[parameters('allowedLocations')]"
          }
        },
        "then": {
          "effect": "audit"
        }
      }
    `,
        parameters: `	{
        "allowedLocations": {
          "type": "Array",
          "metadata": {
            "description": "The list of allowed locations for resources.",
            "displayName": "Allowed locations",
            "strongType": "location"
          }
        }
      }
    `,
    });
    const exampleResourceGroup = new azure.core.ResourceGroup("exampleResourceGroup", {location: "West Europe"});
    const exampleAssignment = new azure.policy.Assignment("exampleAssignment", {
        scope: exampleResourceGroup.id,
        policyDefinitionId: exampleDefinition.id,
        description: "Policy Assignment created via an Acceptance Test",
        displayName: "My Example Policy Assignment",
        metadata: `    {
        "category": "General"
        }
    `,
        parameters: `{
      "allowedLocations": {
        "value": [ "West Europe" ]
      }
    }
    `,
    });
    
    import pulumi
    import pulumi_azure as azure
    
    example_definition = azure.policy.Definition("exampleDefinition",
        policy_type="Custom",
        mode="All",
        display_name="my-policy-definition",
        policy_rule="""	{
        "if": {
          "not": {
            "field": "location",
            "in": "[parameters('allowedLocations')]"
          }
        },
        "then": {
          "effect": "audit"
        }
      }
    """,
        parameters="""	{
        "allowedLocations": {
          "type": "Array",
          "metadata": {
            "description": "The list of allowed locations for resources.",
            "displayName": "Allowed locations",
            "strongType": "location"
          }
        }
      }
    """)
    example_resource_group = azure.core.ResourceGroup("exampleResourceGroup", location="West Europe")
    example_assignment = azure.policy.Assignment("exampleAssignment",
        scope=example_resource_group.id,
        policy_definition_id=example_definition.id,
        description="Policy Assignment created via an Acceptance Test",
        display_name="My Example Policy Assignment",
        metadata="""    {
        "category": "General"
        }
    """,
        parameters="""{
      "allowedLocations": {
        "value": [ "West Europe" ]
      }
    }
    """)
    

    Example coming soon!

    Create Assignment Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Assignment(name: string, args: AssignmentArgs, opts?: CustomResourceOptions);
    @overload
    def Assignment(resource_name: str,
                   args: AssignmentArgs,
                   opts: Optional[ResourceOptions] = None)
    
    @overload
    def Assignment(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   policy_definition_id: Optional[str] = None,
                   scope: Optional[str] = None,
                   description: Optional[str] = None,
                   display_name: Optional[str] = None,
                   enforcement_mode: Optional[bool] = None,
                   identity: Optional[AssignmentIdentityArgs] = None,
                   location: Optional[str] = None,
                   metadata: Optional[str] = None,
                   name: Optional[str] = None,
                   not_scopes: Optional[Sequence[str]] = None,
                   parameters: Optional[str] = None)
    func NewAssignment(ctx *Context, name string, args AssignmentArgs, opts ...ResourceOption) (*Assignment, error)
    public Assignment(string name, AssignmentArgs args, CustomResourceOptions? opts = null)
    public Assignment(String name, AssignmentArgs args)
    public Assignment(String name, AssignmentArgs args, CustomResourceOptions options)
    
    type: azure:policy:Assignment
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    

    Parameters

    name string
    The unique name of the resource.
    args AssignmentArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AssignmentArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AssignmentArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AssignmentArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AssignmentArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var exampleassignmentResourceResourceFromPolicyassignment = new Azure.Policy.Assignment("exampleassignmentResourceResourceFromPolicyassignment", new()
    {
        PolicyDefinitionId = "string",
        Scope = "string",
        Description = "string",
        DisplayName = "string",
        EnforcementMode = false,
        Identity = new Azure.Policy.Inputs.AssignmentIdentityArgs
        {
            PrincipalId = "string",
            TenantId = "string",
            Type = "string",
        },
        Location = "string",
        Metadata = "string",
        Name = "string",
        NotScopes = new[]
        {
            "string",
        },
        Parameters = "string",
    });
    
    example, err := policy.NewAssignment(ctx, "exampleassignmentResourceResourceFromPolicyassignment", &policy.AssignmentArgs{
    	PolicyDefinitionId: pulumi.String("string"),
    	Scope:              pulumi.String("string"),
    	Description:        pulumi.String("string"),
    	DisplayName:        pulumi.String("string"),
    	EnforcementMode:    pulumi.Bool(false),
    	Identity: &policy.AssignmentIdentityArgs{
    		PrincipalId: pulumi.String("string"),
    		TenantId:    pulumi.String("string"),
    		Type:        pulumi.String("string"),
    	},
    	Location: pulumi.String("string"),
    	Metadata: pulumi.String("string"),
    	Name:     pulumi.String("string"),
    	NotScopes: pulumi.StringArray{
    		pulumi.String("string"),
    	},
    	Parameters: pulumi.String("string"),
    })
    
    var exampleassignmentResourceResourceFromPolicyassignment = new com.pulumi.azure.policy.Assignment("exampleassignmentResourceResourceFromPolicyassignment", com.pulumi.azure.policy.AssignmentArgs.builder()
        .policyDefinitionId("string")
        .scope("string")
        .description("string")
        .displayName("string")
        .enforcementMode(false)
        .identity(AssignmentIdentityArgs.builder()
            .principalId("string")
            .tenantId("string")
            .type("string")
            .build())
        .location("string")
        .metadata("string")
        .name("string")
        .notScopes("string")
        .parameters("string")
        .build());
    
    exampleassignment_resource_resource_from_policyassignment = azure.policy.Assignment("exampleassignmentResourceResourceFromPolicyassignment",
        policy_definition_id="string",
        scope="string",
        description="string",
        display_name="string",
        enforcement_mode=False,
        identity={
            "principal_id": "string",
            "tenant_id": "string",
            "type": "string",
        },
        location="string",
        metadata="string",
        name="string",
        not_scopes=["string"],
        parameters="string")
    
    const exampleassignmentResourceResourceFromPolicyassignment = new azure.policy.Assignment("exampleassignmentResourceResourceFromPolicyassignment", {
        policyDefinitionId: "string",
        scope: "string",
        description: "string",
        displayName: "string",
        enforcementMode: false,
        identity: {
            principalId: "string",
            tenantId: "string",
            type: "string",
        },
        location: "string",
        metadata: "string",
        name: "string",
        notScopes: ["string"],
        parameters: "string",
    });
    
    type: azure:policy:Assignment
    properties:
        description: string
        displayName: string
        enforcementMode: false
        identity:
            principalId: string
            tenantId: string
            type: string
        location: string
        metadata: string
        name: string
        notScopes:
            - string
        parameters: string
        policyDefinitionId: string
        scope: string
    

    Assignment Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Assignment resource accepts the following input properties:

    PolicyDefinitionId string
    The ID of the Policy Definition to be applied at the specified Scope.
    Scope string
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    Description string
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    DisplayName string
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    EnforcementMode bool
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    Identity AssignmentIdentity
    An identity block as defined below.
    Location string
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    Metadata string
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    Name string
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    NotScopes List<string>
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    Parameters string
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    PolicyDefinitionId string
    The ID of the Policy Definition to be applied at the specified Scope.
    Scope string
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    Description string
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    DisplayName string
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    EnforcementMode bool
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    Identity AssignmentIdentityArgs
    An identity block as defined below.
    Location string
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    Metadata string
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    Name string
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    NotScopes []string
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    Parameters string
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    policyDefinitionId String
    The ID of the Policy Definition to be applied at the specified Scope.
    scope String
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    description String
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    displayName String
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    enforcementMode Boolean
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    identity AssignmentIdentity
    An identity block as defined below.
    location String
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    metadata String
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    name String
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    notScopes List<String>
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    parameters String
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    policyDefinitionId string
    The ID of the Policy Definition to be applied at the specified Scope.
    scope string
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    description string
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    displayName string
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    enforcementMode boolean
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    identity AssignmentIdentity
    An identity block as defined below.
    location string
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    metadata string
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    name string
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    notScopes string[]
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    parameters string
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    policy_definition_id str
    The ID of the Policy Definition to be applied at the specified Scope.
    scope str
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    description str
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    display_name str
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    enforcement_mode bool
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    identity AssignmentIdentityArgs
    An identity block as defined below.
    location str
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    metadata str
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    name str
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    not_scopes Sequence[str]
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    parameters str
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    policyDefinitionId String
    The ID of the Policy Definition to be applied at the specified Scope.
    scope String
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    description String
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    displayName String
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    enforcementMode Boolean
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    identity Property Map
    An identity block as defined below.
    location String
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    metadata String
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    name String
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    notScopes List<String>
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    parameters String
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Assignment resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing Assignment Resource

    Get an existing Assignment resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AssignmentState, opts?: CustomResourceOptions): Assignment
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            description: Optional[str] = None,
            display_name: Optional[str] = None,
            enforcement_mode: Optional[bool] = None,
            identity: Optional[AssignmentIdentityArgs] = None,
            location: Optional[str] = None,
            metadata: Optional[str] = None,
            name: Optional[str] = None,
            not_scopes: Optional[Sequence[str]] = None,
            parameters: Optional[str] = None,
            policy_definition_id: Optional[str] = None,
            scope: Optional[str] = None) -> Assignment
    func GetAssignment(ctx *Context, name string, id IDInput, state *AssignmentState, opts ...ResourceOption) (*Assignment, error)
    public static Assignment Get(string name, Input<string> id, AssignmentState? state, CustomResourceOptions? opts = null)
    public static Assignment get(String name, Output<String> id, AssignmentState state, CustomResourceOptions options)
    resources:  _:    type: azure:policy:Assignment    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Description string
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    DisplayName string
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    EnforcementMode bool
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    Identity AssignmentIdentity
    An identity block as defined below.
    Location string
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    Metadata string
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    Name string
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    NotScopes List<string>
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    Parameters string
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    PolicyDefinitionId string
    The ID of the Policy Definition to be applied at the specified Scope.
    Scope string
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    Description string
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    DisplayName string
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    EnforcementMode bool
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    Identity AssignmentIdentityArgs
    An identity block as defined below.
    Location string
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    Metadata string
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    Name string
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    NotScopes []string
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    Parameters string
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    PolicyDefinitionId string
    The ID of the Policy Definition to be applied at the specified Scope.
    Scope string
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    description String
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    displayName String
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    enforcementMode Boolean
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    identity AssignmentIdentity
    An identity block as defined below.
    location String
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    metadata String
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    name String
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    notScopes List<String>
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    parameters String
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    policyDefinitionId String
    The ID of the Policy Definition to be applied at the specified Scope.
    scope String
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    description string
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    displayName string
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    enforcementMode boolean
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    identity AssignmentIdentity
    An identity block as defined below.
    location string
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    metadata string
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    name string
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    notScopes string[]
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    parameters string
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    policyDefinitionId string
    The ID of the Policy Definition to be applied at the specified Scope.
    scope string
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    description str
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    display_name str
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    enforcement_mode bool
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    identity AssignmentIdentityArgs
    An identity block as defined below.
    location str
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    metadata str
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    name str
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    not_scopes Sequence[str]
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    parameters str
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    policy_definition_id str
    The ID of the Policy Definition to be applied at the specified Scope.
    scope str
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.
    description String
    A description to use for this Policy Assignment. Changing this forces a new resource to be created.
    displayName String
    A friendly display name to use for this Policy Assignment. Changing this forces a new resource to be created.
    enforcementMode Boolean
    Can be set to 'true' or 'false' to control whether the assignment is enforced (true) or not (false). Default is 'true'.
    identity Property Map
    An identity block as defined below.
    location String
    The Azure location where this policy assignment should exist. This is required when an Identity is assigned. Changing this forces a new resource to be created.
    metadata String
    The metadata for the policy assignment. This is a JSON string representing additional metadata that should be stored with the policy assignment.
    name String
    The name of the Policy Assignment. Changing this forces a new resource to be created.
    notScopes List<String>
    A list of the Policy Assignment's excluded scopes. The list must contain Resource IDs (such as Subscriptions e.g. /subscriptions/00000000-0000-0000-000000000000 or Resource Groups e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup).
    parameters String
    Parameters for the policy definition. This field is a JSON string that maps to the Parameters field from the Policy Definition. Changing this forces a new resource to be created.
    policyDefinitionId String
    The ID of the Policy Definition to be applied at the specified Scope.
    scope String
    The Scope at which the Policy Assignment should be applied, which must be a Resource ID (such as Subscription e.g. /subscriptions/00000000-0000-0000-000000000000 or a Resource Group e.g./subscriptions/00000000-0000-0000-000000000000/resourceGroups/myResourceGroup). Changing this forces a new resource to be created.

    Supporting Types

    AssignmentIdentity, AssignmentIdentityArgs

    PrincipalId string
    The Principal ID of this Policy Assignment if type is SystemAssigned.
    TenantId string
    The Tenant ID of this Policy Assignment if type is SystemAssigned.
    Type string
    The type of Managed Identity for this Policy Assignment. Possible values are SystemAssigned (where Azure will generate a Service Principal for you).
    PrincipalId string
    The Principal ID of this Policy Assignment if type is SystemAssigned.
    TenantId string
    The Tenant ID of this Policy Assignment if type is SystemAssigned.
    Type string
    The type of Managed Identity for this Policy Assignment. Possible values are SystemAssigned (where Azure will generate a Service Principal for you).
    principalId String
    The Principal ID of this Policy Assignment if type is SystemAssigned.
    tenantId String
    The Tenant ID of this Policy Assignment if type is SystemAssigned.
    type String
    The type of Managed Identity for this Policy Assignment. Possible values are SystemAssigned (where Azure will generate a Service Principal for you).
    principalId string
    The Principal ID of this Policy Assignment if type is SystemAssigned.
    tenantId string
    The Tenant ID of this Policy Assignment if type is SystemAssigned.
    type string
    The type of Managed Identity for this Policy Assignment. Possible values are SystemAssigned (where Azure will generate a Service Principal for you).
    principal_id str
    The Principal ID of this Policy Assignment if type is SystemAssigned.
    tenant_id str
    The Tenant ID of this Policy Assignment if type is SystemAssigned.
    type str
    The type of Managed Identity for this Policy Assignment. Possible values are SystemAssigned (where Azure will generate a Service Principal for you).
    principalId String
    The Principal ID of this Policy Assignment if type is SystemAssigned.
    tenantId String
    The Tenant ID of this Policy Assignment if type is SystemAssigned.
    type String
    The type of Managed Identity for this Policy Assignment. Possible values are SystemAssigned (where Azure will generate a Service Principal for you).

    Import

    Policy Assignments can be imported using the policy name, e.g.

     $ pulumi import azure:policy/assignment:Assignment assignment1 /subscriptions/00000000-0000-0000-000000000000/providers/Microsoft.Authorization/policyAssignments/assignment1
    

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Azure Classic pulumi/pulumi-azure
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the azurerm Terraform Provider.
    azure logo

    We recommend using Azure Native.

    Viewing docs for Azure v4.42.0 (Older version)
    published on Monday, Mar 9, 2026 by Pulumi
      Try Pulumi Cloud free. Your team will thank you.