policy_exemptions

Creates, updates, deletes, gets or lists a policy_exemptions resource.

Overview

Name	policy_exemptions
Type	Resource
Id	azure.resource.policy_exemptions

Fields

The following fields are returned by SELECT queries:

list_for_resource

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignmentScopeValidation	string	The option whether validate the exemption is at or under the assignment scope. Known values are: "Default" and "DoNotValidate". (Default, DoNotValidate)
description	string	The description of the policy exemption.
displayName	string	The display name of the policy exemption.
exemptionCategory	string	The policy exemption category. Possible values are Waiver and Mitigated. Required. Known values are: "Waiver" and "Mitigated". (Waiver, Mitigated)
expiresOn	string (date-time)	The expiration date and time (in UTC ISO 8601 format yyyy-MM-ddTHH:mm:ssZ) of the policy exemption.
metadata	object	The policy exemption metadata. Metadata is an open ended object and is typically a collection of key value pairs.
policyAssignmentId	string	The ID of the policy assignment that is being exempted. Required.
policyDefinitionReferenceIds	array	The policy definition reference ID list when the associated policy assignment is an assignment of a policy set definition.
resourceSelectors	array	The resource selector list to filter policies by resource properties.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignmentScopeValidation	string	The option whether validate the exemption is at or under the assignment scope. Known values are: "Default" and "DoNotValidate". (Default, DoNotValidate)
description	string	The description of the policy exemption.
displayName	string	The display name of the policy exemption.
exemptionCategory	string	The policy exemption category. Possible values are Waiver and Mitigated. Required. Known values are: "Waiver" and "Mitigated". (Waiver, Mitigated)
expiresOn	string (date-time)	The expiration date and time (in UTC ISO 8601 format yyyy-MM-ddTHH:mm:ssZ) of the policy exemption.
metadata	object	The policy exemption metadata. Metadata is an open ended object and is typically a collection of key value pairs.
policyAssignmentId	string	The ID of the policy assignment that is being exempted. Required.
policyDefinitionReferenceIds	array	The policy definition reference ID list when the associated policy assignment is an assignment of a policy set definition.
resourceSelectors	array	The resource selector list to filter policies by resource properties.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list_for_resource_group

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignmentScopeValidation	string	The option whether validate the exemption is at or under the assignment scope. Known values are: "Default" and "DoNotValidate". (Default, DoNotValidate)
description	string	The description of the policy exemption.
displayName	string	The display name of the policy exemption.
exemptionCategory	string	The policy exemption category. Possible values are Waiver and Mitigated. Required. Known values are: "Waiver" and "Mitigated". (Waiver, Mitigated)
expiresOn	string (date-time)	The expiration date and time (in UTC ISO 8601 format yyyy-MM-ddTHH:mm:ssZ) of the policy exemption.
metadata	object	The policy exemption metadata. Metadata is an open ended object and is typically a collection of key value pairs.
policyAssignmentId	string	The ID of the policy assignment that is being exempted. Required.
policyDefinitionReferenceIds	array	The policy definition reference ID list when the associated policy assignment is an assignment of a policy set definition.
resourceSelectors	array	The resource selector list to filter policies by resource properties.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignmentScopeValidation	string	The option whether validate the exemption is at or under the assignment scope. Known values are: "Default" and "DoNotValidate". (Default, DoNotValidate)
description	string	The description of the policy exemption.
displayName	string	The display name of the policy exemption.
exemptionCategory	string	The policy exemption category. Possible values are Waiver and Mitigated. Required. Known values are: "Waiver" and "Mitigated". (Waiver, Mitigated)
expiresOn	string (date-time)	The expiration date and time (in UTC ISO 8601 format yyyy-MM-ddTHH:mm:ssZ) of the policy exemption.
metadata	object	The policy exemption metadata. Metadata is an open ended object and is typically a collection of key value pairs.
policyAssignmentId	string	The ID of the policy assignment that is being exempted. Required.
policyDefinitionReferenceIds	array	The policy definition reference ID list when the associated policy assignment is an assignment of a policy set definition.
resourceSelectors	array	The resource selector list to filter policies by resource properties.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list_for_management_group

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
assignmentScopeValidation	string	The option whether validate the exemption is at or under the assignment scope. Known values are: "Default" and "DoNotValidate". (Default, DoNotValidate)
description	string	The description of the policy exemption.
displayName	string	The display name of the policy exemption.
exemptionCategory	string	The policy exemption category. Possible values are Waiver and Mitigated. Required. Known values are: "Waiver" and "Mitigated". (Waiver, Mitigated)
expiresOn	string (date-time)	The expiration date and time (in UTC ISO 8601 format yyyy-MM-ddTHH:mm:ssZ) of the policy exemption.
metadata	object	The policy exemption metadata. Metadata is an open ended object and is typically a collection of key value pairs.
policyAssignmentId	string	The ID of the policy assignment that is being exempted. Required.
policyDefinitionReferenceIds	array	The policy definition reference ID list when the associated policy assignment is an assignment of a policy set definition.
resourceSelectors	array	The resource selector list to filter policies by resource properties.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_for_resource	select	resource_group_name, resource_provider_namespace, parent_resource_path, resource_type, resource_name, subscription_id	$filter	Retrieves all policy exemptions that apply to a resource. This operation retrieves the list of all policy exemptions associated with the specified resource in the given resource group and subscription that match the optional given $filter. Valid values for $filter are: 'atScope()', 'atExactScope()', 'excludeExpired()' or 'policyAssignmentId eq '{value}''. If $filter is not provided, the unfiltered list includes all policy exemptions associated with the resource, including those that apply directly or from all containing scopes, as well as any applied to resources contained within the resource. Three parameters plus the resource name are used to identify a specific resource. If the resource is not part of a parent resource (the more common case), the parent resource path should not be provided (or provided as ''). For example a web app could be specified as ({resourceProviderNamespace} == 'Microsoft.Web', {parentResourcePath} == '', {resourceType} == 'sites', {resourceName} == 'MyWebApp'). If the resource is part of a parent resource, then all parameters should be provided. For example a virtual machine DNS name could be specified as ({resourceProviderNamespace} == 'Microsoft.Compute', {parentResourcePath} == 'virtualMachines/MyVirtualMachine', {resourceType} == 'domainNames', {resourceName} == 'MyComputerName'). A convenient alternative to providing the namespace and type name separately is to provide both in the {resourceType} parameter, format: ({resourceProviderNamespace} == '', {parentResourcePath} == '', {resourceType} == 'Microsoft.Web/sites', {resourceName} == 'MyWebApp').
get	select	scope, policy_exemption_name		Retrieves a policy exemption. This operation retrieves a single policy exemption, given its name and the scope it was created at.
list_for_resource_group	select	resource_group_name, subscription_id	$filter	Retrieves all policy exemptions that apply to a resource group. This operation retrieves the list of all policy exemptions associated with the given resource group in the given subscription that match the optional given $filter. Valid values for $filter are: 'atScope()', 'atExactScope()', 'excludeExpired()' or 'policyAssignmentId eq '{value}''. If $filter is not provided, the unfiltered list includes all policy exemptions associated with the resource group, including those that apply directly or apply from containing scopes, as well as any applied to resources contained within the resource group.
list	select	subscription_id	$filter	Retrieves all policy exemptions that apply to a subscription. This operation retrieves the list of all policy exemptions associated with the given subscription that match the optional given $filter. Valid values for $filter are: 'atScope()', 'atExactScope()', 'excludeExpired()' or 'policyAssignmentId eq '{value}''. If $filter is not provided, the unfiltered list includes all policy exemptions associated with the subscription, including those that apply directly or from management groups that contain the given subscription, as well as any applied to objects contained within the subscription.
list_for_management_group	select	management_group_id	$filter	Retrieves all policy exemptions that apply to a management group. This operation retrieves the list of all policy exemptions applicable to the management group that match the given $filter. Valid values for $filter are: 'atScope()', 'atExactScope()', 'excludeExpired()' or 'policyAssignmentId eq '{value}''. If $filter=atScope() is provided, the returned list includes all policy exemptions that are assigned to the management group or the management group's ancestors.
create_or_update	insert	scope, policy_exemption_name		Creates or updates a policy exemption. This operation creates or updates a policy exemption with the given scope and name. Policy exemptions apply to all resources contained within their scope. For example, when you create a policy exemption at resource group scope for a policy assignment at the same or above level, the exemption exempts to all applicable resources in the resource group.
update	update	scope, policy_exemption_name		Updates a policy exemption. This operation updates a policy exemption with the given scope and name.
create_or_update	replace	scope, policy_exemption_name		Creates or updates a policy exemption. This operation creates or updates a policy exemption with the given scope and name. Policy exemptions apply to all resources contained within their scope. For example, when you create a policy exemption at resource group scope for a policy assignment at the same or above level, the exemption exempts to all applicable resources in the resource group.
delete	delete	scope, policy_exemption_name		Deletes a policy exemption. This operation deletes a policy exemption, given its name and the scope it was created in. The scope of a policy exemption is the part of its ID preceding '/providers/Microsoft.Authorization/policyExemptions/{policyExemptionName}'.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
management_group_id	string	The management group ID. Required.
parent_resource_path	string	The parent resource path. Use empty string if there is none. Required.
policy_exemption_name	string	The name of the policy exemption to get. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
resource_name	string	The name of the resource. Required.
resource_provider_namespace	string	The namespace of the resource provider. For example, the namespace of a virtual machine is Microsoft.Compute (from Microsoft.Compute/virtualMachines). Required.
resource_type	string	The resource type name. For example the type name of a web app is 'sites' (from Microsoft.Web/sites). Required.
scope	string	The fully qualified Azure Resource manager identifier of the resource. Required.
subscription_id	string
$filter	string	The filter to apply on the operation. Valid values for $filter are: 'atScope()', 'atExactScope()', 'excludeExpired()' or 'policyAssignmentId eq '{value}''. If $filter is not provided, no filtering is performed. If $filter is not provided, the unfiltered list includes all policy exemptions associated with the scope, including those that apply directly or apply from containing scopes. If $filter=atScope() is provided, the returned list only includes all policy exemptions that apply to the scope, which is everything in the unfiltered list except those applied to sub scopes contained within the given scope. If $filter=atExactScope() is provided, the returned list only includes all policy exemptions that at the given scope. If $filter=excludeExpired() is provided, the returned list only includes all policy exemptions that either haven't expired or didn't set expiration date. If $filter=policyAssignmentId eq '{value}' is provided. the returned list only includes all policy exemptions that are associated with the give policyAssignmentId. Default value is None.

SELECT examples

list_for_resource

Retrieves all policy exemptions that apply to a resource. This operation retrieves the list of all policy exemptions associated with the specified resource in the given resource group and subscription that match the optional given $filter. Valid values for $filter are: 'atScope()', 'atExactScope()', 'excludeExpired()' or 'policyAssignmentId eq '{value}''. If $filter is not provided, the unfiltered list includes all policy exemptions associated with the resource, including those that apply directly or from all containing scopes, as well as any applied to resources contained within the resource. Three parameters plus the resource name are used to identify a specific resource. If the resource is not part of a parent resource (the more common case), the parent resource path should not be provided (or provided as ''). For example a web app could be specified as ({resourceProviderNamespace} == 'Microsoft.Web', {parentResourcePath} == '', {resourceType} == 'sites', {resourceName} == 'MyWebApp'). If the resource is part of a parent resource, then all parameters should be provided. For example a virtual machine DNS name could be specified as ({resourceProviderNamespace} == 'Microsoft.Compute', {parentResourcePath} == 'virtualMachines/MyVirtualMachine', {resourceType} == 'domainNames', {resourceName} == 'MyComputerName'). A convenient alternative to providing the namespace and type name separately is to provide both in the {resourceType} parameter, format: ({resourceProviderNamespace} == '', {parentResourcePath} == '', {resourceType} == 'Microsoft.Web/sites', {resourceName} == 'MyWebApp').

SELECT
id,
name,
assignmentScopeValidation,
description,
displayName,
exemptionCategory,
expiresOn,
metadata,
policyAssignmentId,
policyDefinitionReferenceIds,
resourceSelectors,
systemData,
type
FROM azure.resource.policy_exemptions
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND resource_provider_namespace = '{{ resource_provider_namespace }}' -- required
AND parent_resource_path = '{{ parent_resource_path }}' -- required
AND resource_type = '{{ resource_type }}' -- required
AND resource_name = '{{ resource_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
;

get

Retrieves a policy exemption. This operation retrieves a single policy exemption, given its name and the scope it was created at.

SELECT
id,
name,
assignmentScopeValidation,
description,
displayName,
exemptionCategory,
expiresOn,
metadata,
policyAssignmentId,
policyDefinitionReferenceIds,
resourceSelectors,
systemData,
type
FROM azure.resource.policy_exemptions
WHERE scope = '{{ scope }}' -- required
AND policy_exemption_name = '{{ policy_exemption_name }}' -- required
;

list_for_resource_group

Retrieves all policy exemptions that apply to a resource group. This operation retrieves the list of all policy exemptions associated with the given resource group in the given subscription that match the optional given $filter. Valid values for $filter are: 'atScope()', 'atExactScope()', 'excludeExpired()' or 'policyAssignmentId eq '{value}''. If $filter is not provided, the unfiltered list includes all policy exemptions associated with the resource group, including those that apply directly or apply from containing scopes, as well as any applied to resources contained within the resource group.

SELECT
id,
name,
assignmentScopeValidation,
description,
displayName,
exemptionCategory,
expiresOn,
metadata,
policyAssignmentId,
policyDefinitionReferenceIds,
resourceSelectors,
systemData,
type
FROM azure.resource.policy_exemptions
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
;

list

Retrieves all policy exemptions that apply to a subscription. This operation retrieves the list of all policy exemptions associated with the given subscription that match the optional given $filter. Valid values for $filter are: 'atScope()', 'atExactScope()', 'excludeExpired()' or 'policyAssignmentId eq '{value}''. If $filter is not provided, the unfiltered list includes all policy exemptions associated with the subscription, including those that apply directly or from management groups that contain the given subscription, as well as any applied to objects contained within the subscription.

SELECT
id,
name,
assignmentScopeValidation,
description,
displayName,
exemptionCategory,
expiresOn,
metadata,
policyAssignmentId,
policyDefinitionReferenceIds,
resourceSelectors,
systemData,
type
FROM azure.resource.policy_exemptions
WHERE subscription_id = '{{ subscription_id }}' -- required
AND $filter = '{{ $filter }}'
;

list_for_management_group

Retrieves all policy exemptions that apply to a management group. This operation retrieves the list of all policy exemptions applicable to the management group that match the given $filter. Valid values for $filter are: 'atScope()', 'atExactScope()', 'excludeExpired()' or 'policyAssignmentId eq '{value}''. If $filter=atScope() is provided, the returned list includes all policy exemptions that are assigned to the management group or the management group's ancestors.

SELECT
id,
name,
assignmentScopeValidation,
description,
displayName,
exemptionCategory,
expiresOn,
metadata,
policyAssignmentId,
policyDefinitionReferenceIds,
resourceSelectors,
systemData,
type
FROM azure.resource.policy_exemptions
WHERE management_group_id = '{{ management_group_id }}' -- required
AND $filter = '{{ $filter }}'
;

INSERT examples

create_or_update

Creates or updates a policy exemption. This operation creates or updates a policy exemption with the given scope and name. Policy exemptions apply to all resources contained within their scope. For example, when you create a policy exemption at resource group scope for a policy assignment at the same or above level, the exemption exempts to all applicable resources in the resource group.

INSERT INTO azure.resource.policy_exemptions (
properties,
scope,
policy_exemption_name
)
SELECT 
'{{ properties }}',
'{{ scope }}',
'{{ policy_exemption_name }}'
RETURNING
id,
name,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: policy_exemptions
props:
  - name: scope
    value: "{{ scope }}"
    description: Required parameter for the policy_exemptions resource.
  - name: policy_exemption_name
    value: "{{ policy_exemption_name }}"
    description: Required parameter for the policy_exemptions resource.
  - name: properties
    description: |
      Properties for the policy exemption.
    value:
      policyAssignmentId: "{{ policyAssignmentId }}"
      policyDefinitionReferenceIds:
        - "{{ policyDefinitionReferenceIds }}"
      exemptionCategory: "{{ exemptionCategory }}"
      expiresOn: "{{ expiresOn }}"
      displayName: "{{ displayName }}"
      description: "{{ description }}"
      metadata: "{{ metadata }}"
      resourceSelectors:
        - name: "{{ name }}"
          selectors: "{{ selectors }}"
      assignmentScopeValidation: "{{ assignmentScopeValidation }}"

UPDATE examples

update

Updates a policy exemption. This operation updates a policy exemption with the given scope and name.

UPDATE azure.resource.policy_exemptions
SET 
properties = '{{ properties }}'
WHERE 
scope = '{{ scope }}' --required
AND policy_exemption_name = '{{ policy_exemption_name }}' --required
RETURNING
id,
name,
properties,
systemData,
type;

REPLACE examples

create_or_update

Creates or updates a policy exemption. This operation creates or updates a policy exemption with the given scope and name. Policy exemptions apply to all resources contained within their scope. For example, when you create a policy exemption at resource group scope for a policy assignment at the same or above level, the exemption exempts to all applicable resources in the resource group.

REPLACE azure.resource.policy_exemptions
SET 
properties = '{{ properties }}'
WHERE 
scope = '{{ scope }}' --required
AND policy_exemption_name = '{{ policy_exemption_name }}' --required
RETURNING
id,
name,
properties,
systemData,
type;

DELETE examples

delete

Deletes a policy exemption. This operation deletes a policy exemption, given its name and the scope it was created in. The scope of a policy exemption is the part of its ID preceding '/providers/Microsoft.Authorization/policyExemptions/{policyExemptionName}'.

DELETE FROM azure.resource.policy_exemptions
WHERE scope = '{{ scope }}' --required
AND policy_exemption_name = '{{ policy_exemption_name }}' --required
;