policy_enrollments

Creates, updates, deletes, gets or lists a policy_enrollments resource.

Overview

Name	policy_enrollments
Type	Resource
Id	azure.resource.policy_enrollments

Fields

The following fields are returned by SELECT queries:

list_for_resource

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignmentScopeValidation	string	The option whether to validate the enrollment is at or under the assignment scope. Known values are: "Default" and "DoNotValidate". (Default, DoNotValidate)
description	string	The description of the policy enrollment.
displayName	string	The display name of the policy enrollment.
eTag	string	The ETag for the policy enrollment.
metadata	object	The policy enrollment metadata. Metadata is an open ended object and is typically a collection of key value pairs.
policyAssignmentId	string	The ID of the policy assignment that is being enrolled. Required.
policyAssignmentInstanceId	string	The policy assignment instance ID associated with this enrollment. The value is set to the instance ID of the policy assignment the policyAssignmentId references when the enrollment is created or updated. The format is a GUID string.
policyDefinitionReferenceIds	array	The policy definition reference IDs for policy definitions in an assigned policy set definition. These IDs correspond to a subset of policyDefinitions[*].policyDefinitionReferenceId in the policy set definition. When specified and not empty, only the referenced policy definitions will be enrolled to. Otherwise, the entire policy set is enrolled to.
resourceSelectors	array	The resource selector list to filter policies by resource properties.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignmentScopeValidation	string	The option whether to validate the enrollment is at or under the assignment scope. Known values are: "Default" and "DoNotValidate". (Default, DoNotValidate)
description	string	The description of the policy enrollment.
displayName	string	The display name of the policy enrollment.
eTag	string	The ETag for the policy enrollment.
metadata	object	The policy enrollment metadata. Metadata is an open ended object and is typically a collection of key value pairs.
policyAssignmentId	string	The ID of the policy assignment that is being enrolled. Required.
policyAssignmentInstanceId	string	The policy assignment instance ID associated with this enrollment. The value is set to the instance ID of the policy assignment the policyAssignmentId references when the enrollment is created or updated. The format is a GUID string.
policyDefinitionReferenceIds	array	The policy definition reference IDs for policy definitions in an assigned policy set definition. These IDs correspond to a subset of policyDefinitions[*].policyDefinitionReferenceId in the policy set definition. When specified and not empty, only the referenced policy definitions will be enrolled to. Otherwise, the entire policy set is enrolled to.
resourceSelectors	array	The resource selector list to filter policies by resource properties.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list_for_resource_group

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignmentScopeValidation	string	The option whether to validate the enrollment is at or under the assignment scope. Known values are: "Default" and "DoNotValidate". (Default, DoNotValidate)
description	string	The description of the policy enrollment.
displayName	string	The display name of the policy enrollment.
eTag	string	The ETag for the policy enrollment.
metadata	object	The policy enrollment metadata. Metadata is an open ended object and is typically a collection of key value pairs.
policyAssignmentId	string	The ID of the policy assignment that is being enrolled. Required.
policyAssignmentInstanceId	string	The policy assignment instance ID associated with this enrollment. The value is set to the instance ID of the policy assignment the policyAssignmentId references when the enrollment is created or updated. The format is a GUID string.
policyDefinitionReferenceIds	array	The policy definition reference IDs for policy definitions in an assigned policy set definition. These IDs correspond to a subset of policyDefinitions[*].policyDefinitionReferenceId in the policy set definition. When specified and not empty, only the referenced policy definitions will be enrolled to. Otherwise, the entire policy set is enrolled to.
resourceSelectors	array	The resource selector list to filter policies by resource properties.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignmentScopeValidation	string	The option whether to validate the enrollment is at or under the assignment scope. Known values are: "Default" and "DoNotValidate". (Default, DoNotValidate)
description	string	The description of the policy enrollment.
displayName	string	The display name of the policy enrollment.
eTag	string	The ETag for the policy enrollment.
metadata	object	The policy enrollment metadata. Metadata is an open ended object and is typically a collection of key value pairs.
policyAssignmentId	string	The ID of the policy assignment that is being enrolled. Required.
policyAssignmentInstanceId	string	The policy assignment instance ID associated with this enrollment. The value is set to the instance ID of the policy assignment the policyAssignmentId references when the enrollment is created or updated. The format is a GUID string.
policyDefinitionReferenceIds	array	The policy definition reference IDs for policy definitions in an assigned policy set definition. These IDs correspond to a subset of policyDefinitions[*].policyDefinitionReferenceId in the policy set definition. When specified and not empty, only the referenced policy definitions will be enrolled to. Otherwise, the entire policy set is enrolled to.
resourceSelectors	array	The resource selector list to filter policies by resource properties.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list_for_management_group

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignmentScopeValidation	string	The option whether to validate the enrollment is at or under the assignment scope. Known values are: "Default" and "DoNotValidate". (Default, DoNotValidate)
description	string	The description of the policy enrollment.
displayName	string	The display name of the policy enrollment.
eTag	string	The ETag for the policy enrollment.
metadata	object	The policy enrollment metadata. Metadata is an open ended object and is typically a collection of key value pairs.
policyAssignmentId	string	The ID of the policy assignment that is being enrolled. Required.
policyAssignmentInstanceId	string	The policy assignment instance ID associated with this enrollment. The value is set to the instance ID of the policy assignment the policyAssignmentId references when the enrollment is created or updated. The format is a GUID string.
policyDefinitionReferenceIds	array	The policy definition reference IDs for policy definitions in an assigned policy set definition. These IDs correspond to a subset of policyDefinitions[*].policyDefinitionReferenceId in the policy set definition. When specified and not empty, only the referenced policy definitions will be enrolled to. Otherwise, the entire policy set is enrolled to.
resourceSelectors	array	The resource selector list to filter policies by resource properties.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_for_resource	select	resource_group_name, resource_provider_namespace, parent_resource_path, resource_type, resource_name, subscription_id	$filter	Retrieves all policy enrollments that apply to a resource. This operation retrieves the list of all policy enrollments associated with the specified resource in the given resource group and subscription that match the optional given $filter. Valid values for $filter are: 'atScope()' or 'atExactScope()'. If $filter is not provided, the unfiltered list includes all policy enrollments associated with the resource, including those that apply directly or from all containing scopes, as well as any applied to resources contained within the resource. Three parameters plus the resource name are used to identify a specific resource. If the resource is not part of a parent resource (the more common case), the parent resource path should not be provided (or provided as ''). For example a web app could be specified as ({resourceProviderNamespace} == 'Microsoft.Web', {parentResourcePath} == '', {resourceType} == 'sites', {resourceName} == 'MyWebApp'). If the resource is part of a parent resource, then all parameters should be provided. For example a virtual machine DNS name could be specified as ({resourceProviderNamespace} == 'Microsoft.Compute', {parentResourcePath} == 'virtualMachines/MyVirtualMachine', {resourceType} == 'domainNames', {resourceName} == 'MyComputerName'). A convenient alternative to providing the namespace and type name separately is to provide both in the {resourceType} parameter, format: ({resourceProviderNamespace} == '', {parentResourcePath} == '', {resourceType} == 'Microsoft.Web/sites', {resourceName} == 'MyWebApp').
get	select	scope, policy_enrollment_name		Retrieves a policy enrollment. This operation retrieves a single policy enrollment, given its name and the scope it was created at.
list_for_resource_group	select	resource_group_name, subscription_id	$filter	Retrieves all policy enrollments that apply to a resource group. This operation retrieves the list of all policy enrollments associated with the given resource group in the given subscription that match the optional given $filter. Valid values for $filter are: 'atScope()' or 'atExactScope()'. If $filter is not provided, the unfiltered list includes all policy enrollments associated with the resource group, including those that apply directly or apply from containing scopes, as well as any applied to resources contained within the resource group.
list	select	subscription_id	$filter	Retrieves all policy enrollments that apply to a subscription. This operation retrieves the list of all policy enrollments associated with the given subscription that match the optional given $filter. Valid values for $filter are: 'atScope()' or 'atExactScope()'. If $filter is not provided, the unfiltered list includes all policy enrollments associated with the subscription, including those that apply directly or from management groups that contain the given subscription, as well as any applied to objects contained within the subscription.
list_for_management_group	select	management_group_id	$filter	Retrieves all policy enrollments that apply to a management group. This operation retrieves the list of all policy enrollments applicable to the management group that match the given $filter. Valid values for $filter are: 'atScope()' or 'atExactScope()'. If $filter=atScope() is provided, the returned list includes all policy enrollments that are assigned to the management group or the management group's ancestors.
create_or_update	insert	scope, policy_enrollment_name		Creates or updates a policy enrollment. This operation creates or updates a policy enrollment with the given scope and name. Policy enrollments apply to all resources contained within their scope. For example, when you create a policy enrollment at resource group scope for a policy assignment at the same or above level, the enrollment applies to all applicable resources in the resource group.
update	update	scope, policy_enrollment_name		Updates a policy enrollment. This operation updates a policy enrollment with the given scope and name.
create_or_update	replace	scope, policy_enrollment_name		Creates or updates a policy enrollment. This operation creates or updates a policy enrollment with the given scope and name. Policy enrollments apply to all resources contained within their scope. For example, when you create a policy enrollment at resource group scope for a policy assignment at the same or above level, the enrollment applies to all applicable resources in the resource group.
delete	delete	scope, policy_enrollment_name		Deletes a policy enrollment. This operation deletes a policy enrollment, given its name and the scope it was created in. The scope of a policy enrollment is the part of its ID preceding '/providers/Microsoft.Authorization/policyEnrollments/{policyEnrollmentName}'.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
management_group_id	string	The management group ID. Required.
parent_resource_path	string	The parent resource path. Use empty string if there is none. Required.
policy_enrollment_name	string	The name of the policy enrollment. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
resource_name	string	The name of the resource. Required.
resource_provider_namespace	string	The namespace of the resource provider. For example, the namespace of a virtual machine is Microsoft.Compute (from Microsoft.Compute/virtualMachines). Required.
resource_type	string	The resource type name. For example the type name of a web app is 'sites' (from Microsoft.Web/sites). Required.
scope	string	The fully qualified Azure Resource manager identifier of the resource. Required.
subscription_id	string
$filter	string	The filter to apply on the operation. Valid values for $filter are: 'atScope()' or 'atExactScope()'. If $filter is not provided, no filtering is performed. If $filter is not provided, the unfiltered list includes all policy enrollments associated with the scope, including those that apply directly or from containing scopes. If $filter=atScope() is provided, the returned list includes all policy enrollments that apply to the scope, which is everything in the unfiltered list except those applied to sub-scopes contained within the given scope. If $filter=atExactScope() is provided, the returned list only includes all policy enrollments that apply at the given scope. Default value is None.

SELECT examples

list_for_resource

Retrieves all policy enrollments that apply to a resource. This operation retrieves the list of all policy enrollments associated with the specified resource in the given resource group and subscription that match the optional given $filter. Valid values for $filter are: 'atScope()' or 'atExactScope()'. If $filter is not provided, the unfiltered list includes all policy enrollments associated with the resource, including those that apply directly or from all containing scopes, as well as any applied to resources contained within the resource. Three parameters plus the resource name are used to identify a specific resource. If the resource is not part of a parent resource (the more common case), the parent resource path should not be provided (or provided as ''). For example a web app could be specified as ({resourceProviderNamespace} == 'Microsoft.Web', {parentResourcePath} == '', {resourceType} == 'sites', {resourceName} == 'MyWebApp'). If the resource is part of a parent resource, then all parameters should be provided. For example a virtual machine DNS name could be specified as ({resourceProviderNamespace} == 'Microsoft.Compute', {parentResourcePath} == 'virtualMachines/MyVirtualMachine', {resourceType} == 'domainNames', {resourceName} == 'MyComputerName'). A convenient alternative to providing the namespace and type name separately is to provide both in the {resourceType} parameter, format: ({resourceProviderNamespace} == '', {parentResourcePath} == '', {resourceType} == 'Microsoft.Web/sites', {resourceName} == 'MyWebApp').

SELECT
id,
name,
assignmentScopeValidation,
description,
displayName,
eTag,
metadata,
policyAssignmentId,
policyAssignmentInstanceId,
policyDefinitionReferenceIds,
resourceSelectors,
systemData,
type
FROM azure.resource.policy_enrollments
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND resource_provider_namespace = '{{ resource_provider_namespace }}' -- required
AND parent_resource_path = '{{ parent_resource_path }}' -- required
AND resource_type = '{{ resource_type }}' -- required
AND resource_name = '{{ resource_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
;

get

Retrieves a policy enrollment. This operation retrieves a single policy enrollment, given its name and the scope it was created at.

SELECT
id,
name,
assignmentScopeValidation,
description,
displayName,
eTag,
metadata,
policyAssignmentId,
policyAssignmentInstanceId,
policyDefinitionReferenceIds,
resourceSelectors,
systemData,
type
FROM azure.resource.policy_enrollments
WHERE scope = '{{ scope }}' -- required
AND policy_enrollment_name = '{{ policy_enrollment_name }}' -- required
;

list_for_resource_group

Retrieves all policy enrollments that apply to a resource group. This operation retrieves the list of all policy enrollments associated with the given resource group in the given subscription that match the optional given $filter. Valid values for $filter are: 'atScope()' or 'atExactScope()'. If $filter is not provided, the unfiltered list includes all policy enrollments associated with the resource group, including those that apply directly or apply from containing scopes, as well as any applied to resources contained within the resource group.

SELECT
id,
name,
assignmentScopeValidation,
description,
displayName,
eTag,
metadata,
policyAssignmentId,
policyAssignmentInstanceId,
policyDefinitionReferenceIds,
resourceSelectors,
systemData,
type
FROM azure.resource.policy_enrollments
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
;

list

Retrieves all policy enrollments that apply to a subscription. This operation retrieves the list of all policy enrollments associated with the given subscription that match the optional given $filter. Valid values for $filter are: 'atScope()' or 'atExactScope()'. If $filter is not provided, the unfiltered list includes all policy enrollments associated with the subscription, including those that apply directly or from management groups that contain the given subscription, as well as any applied to objects contained within the subscription.

SELECT
id,
name,
assignmentScopeValidation,
description,
displayName,
eTag,
metadata,
policyAssignmentId,
policyAssignmentInstanceId,
policyDefinitionReferenceIds,
resourceSelectors,
systemData,
type
FROM azure.resource.policy_enrollments
WHERE subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
;

list_for_management_group

Retrieves all policy enrollments that apply to a management group. This operation retrieves the list of all policy enrollments applicable to the management group that match the given $filter. Valid values for $filter are: 'atScope()' or 'atExactScope()'. If $filter=atScope() is provided, the returned list includes all policy enrollments that are assigned to the management group or the management group's ancestors.

SELECT
id,
name,
assignmentScopeValidation,
description,
displayName,
eTag,
metadata,
policyAssignmentId,
policyAssignmentInstanceId,
policyDefinitionReferenceIds,
resourceSelectors,
systemData,
type
FROM azure.resource.policy_enrollments
WHERE management_group_id = '{{ management_group_id }}' -- required
AND $filter = '{{ $filter }}'
;

INSERT examples

create_or_update

Creates or updates a policy enrollment. This operation creates or updates a policy enrollment with the given scope and name. Policy enrollments apply to all resources contained within their scope. For example, when you create a policy enrollment at resource group scope for a policy assignment at the same or above level, the enrollment applies to all applicable resources in the resource group.

INSERT INTO azure.resource.policy_enrollments (
properties,
eTag,
scope,
policy_enrollment_name
)
SELECT 
'{{ properties }}',
'{{ eTag }}',
'{{ scope }}',
'{{ policy_enrollment_name }}'
RETURNING
id,
name,
eTag,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: policy_enrollments
props:
  - name: scope
    value: "{{ scope }}"
    description: Required parameter for the policy_enrollments resource.
  - name: policy_enrollment_name
    value: "{{ policy_enrollment_name }}"
    description: Required parameter for the policy_enrollments resource.
  - name: properties
    description: |
      The properties of the policy enrollment.
    value:
      policyAssignmentId: "{{ policyAssignmentId }}"
      policyAssignmentInstanceId: "{{ policyAssignmentInstanceId }}"
      policyDefinitionReferenceIds:
        - "{{ policyDefinitionReferenceIds }}"
      displayName: "{{ displayName }}"
      description: "{{ description }}"
      metadata: "{{ metadata }}"
      assignmentScopeValidation: "{{ assignmentScopeValidation }}"
      resourceSelectors:
        - name: "{{ name }}"
          selectors: "{{ selectors }}"
  - name: eTag
    value: "{{ eTag }}"
    description: |
      The ETag for the policy enrollment.

UPDATE examples

update

Updates a policy enrollment. This operation updates a policy enrollment with the given scope and name.

UPDATE azure.resource.policy_enrollments
SET 
properties = '{{ properties }}'
WHERE 
scope = '{{ scope }}' --required
AND policy_enrollment_name = '{{ policy_enrollment_name }}' --required
RETURNING
id,
name,
eTag,
properties,
systemData,
type;

REPLACE examples

create_or_update

Creates or updates a policy enrollment. This operation creates or updates a policy enrollment with the given scope and name. Policy enrollments apply to all resources contained within their scope. For example, when you create a policy enrollment at resource group scope for a policy assignment at the same or above level, the enrollment applies to all applicable resources in the resource group.

REPLACE azure.resource.policy_enrollments
SET 
properties = '{{ properties }}',
eTag = '{{ eTag }}'
WHERE 
scope = '{{ scope }}' --required
AND policy_enrollment_name = '{{ policy_enrollment_name }}' --required
RETURNING
id,
name,
eTag,
properties,
systemData,
type;

DELETE examples

delete

Deletes a policy enrollment. This operation deletes a policy enrollment, given its name and the scope it was created in. The scope of a policy enrollment is the part of its ID preceding '/providers/Microsoft.Authorization/policyEnrollments/{policyEnrollmentName}'.

DELETE FROM azure.resource.policy_enrollments
WHERE scope = '{{ scope }}' --required
AND policy_enrollment_name = '{{ policy_enrollment_name }}' --required
;