Azure policy notscope powershell

Question

Hi,
I'm investigating implementing Azure policy using powershell and can successfully do this, apart from adding exclusions. I can retrieve current existing exclusions, but not add them. I've read through the documentation, but don't seem to be able to locate any information about this, only doing a manual update via the portal?

I've tried using the -NotScope parameter with Set-AzPolicyAssignment with RG names I want to exclude, but get an error :

Set-AzPolicyAssignment : InvalidCreatePolicyAssignmentRequest : The policy assignment
'xxxxxxxxxxxxxxxxxx' not scopes 'testRG' must all be below the policy assignment's scope

Any point in the right direction would be greatly appreciated!

Thanks,
Marc

Answer 1

@McCarthy, Marc (IT Cyber Security, Group CIO) - Thanks for reaching out.

The error message you are receiving is correct. Whatever is defined with the -NotScope parameter must be within the Scope that is defined.

For example, if the policy is applied to a resource group, then exceptions can only be applied to resources within that resource group.

This is a service level limitation and not a limitation with Azure PowerShell. The same limitation applies to Azure CLI and the Azure portal.

Hope that helps.

If the above response helped, please feel free to "Accept as Answer" so it can be beneficial to the community.