az policy enrollment

Manage policy enrollments.

Policy enrollments specify resources that a policy assignment on 'Enroll' mode applies to.

Commands

Name	Description	Type	Status
az policy enrollment create	Create a policy enrollment.	Core	GA
az policy enrollment delete	Delete a policy enrollment.	Core	GA
az policy enrollment list	Retrieve all applicable policy enrollments.	Core	GA
az policy enrollment show	Retrieve a policy enrollment.	Core	GA
az policy enrollment update	Update a policy enrollment.	Core	GA

az policy enrollment create

Create a policy enrollment.

Create a policy enrollment with the given name and scope. Policy enrollments apply a policy assignment to resources within their scope. For example, when you create a policy enrollment at resource group scope for a policy assignment at the same or higher scope level, the enrollment applies to all applicable resources in the resource group, optionally filtering which policy definitions or resources are included.

az policy enrollment create [--acquire-policy-token]
                            [--assignment-scope-validation {Default, DoNotValidate}]
                            [--change-reference]
                            [--description]
                            [--display-name]
                            [--metadata]
                            [--name]
                            [--policy-assignment]
                            [--policy-definition-reference-ids]
                            [--resource-group]
                            [--resource-selectors]
                            [--scope]

Examples

Create a policy enrollment in default subscription

az policy enrollment create -n enrollTestVm --policy-assignment "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyAssignments/limitVMSku"

Create a policy enrollment in the resource group

az policy enrollment create -n enrollTestVm --policy-assignment "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyAssignments/limitVMSku" --resource-group MyResourceGroup

Create a policy enrollment in the management group

az policy enrollment create -n enrollTestVm --policy-assignment "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyAssignments/limitVMSku" --scope "/providers/Microsoft.Management/managementGroups/{managementGroupName}"

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--assignment-scope-validation -v

The option whether to validate the enrollment is at or under the assignment scope.

Property	Value
Parameter group:	Properties Arguments
Accepted values:	Default, DoNotValidate

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--description

The description of the policy enrollment.

Property	Value
Parameter group:	Properties Arguments

--display-name

The display name of the policy enrollment.

Property	Value
Parameter group:	Properties Arguments

--metadata

The policy enrollment metadata. Metadata is an open ended object and is typically a collection of key value pairs. Support shorthand-syntax(full value only), json-file and yaml-file.

Property	Value
Parameter group:	Properties Arguments

--name -n

The name of the policy enrollment.

--policy-assignment -a

The policy assignment to enroll.

Property	Value
Parameter group:	Properties Arguments

--policy-definition-reference-ids -r

The policy definition reference IDs. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-selectors

The resource selector list to filter policies by resource properties. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--scope

The fully qualified Azure Resource manager identifier of the resource.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy enrollment delete

Delete a policy enrollment.

Delete the policy enrollment with the given name and scope.

az policy enrollment delete --name
                            [--acquire-policy-token]
                            [--change-reference]
                            [--resource-group]
                            [--scope]
                            [--yes]

Examples

Delete a policy enrollment

az policy enrollment delete --name MyPolicyEnrollment --resource-group "myResourceGroup"

Required Parameters

--name -n

The name of the policy enrollment.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scope

The fully qualified Azure Resource manager identifier of the resource.

--yes -y

Do not prompt for confirmation.

Property	Value
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy enrollment list

Retrieve all applicable policy enrollments.

Retrieve the list of all policy enrollments applicable to the given resource group, subscription or management group.

az policy enrollment list [--disable-scope-strict-match {0, 1, f, false, n, no, t, true, y, yes}]
                          [--filter]
                          [--management-group]
                          [--max-items]
                          [--next-token]
                          [--resource-group]
                          [--scope]

Examples

List policy enrollments for management group

az policy enrollment list --management-group DevOrg --filter atScopeAndBelow()

List policy enrollments for resource group

az policy enrollment list --resource-group TestResourceGroup

List policy enrollments for subscription

az policy enrollment list

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--disable-scope-strict-match -d

Include policy enrollments either inherited from parent scopes or at child scopes.

Property	Value
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--filter

Filter list results.

--management-group

The management group.

--max-items

Total number of items to return in the command's output. If the total number of items available is more than the value specified, a token is provided in the command's output. To resume pagination, provide the token value in --next-token argument of a subsequent command.

Property	Value
Parameter group:	Pagination Arguments

--next-token

Token to specify where to start paginating. This is the token value from a previously truncated response.

Property	Value
Parameter group:	Pagination Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scope

Scope at which to list applicable policy enrollments. If scope is not provided, the scope will be the implied or specified subscription.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy enrollment show

Retrieve a policy enrollment.

Retrieve and show the details of the policy enrollment with the given name and scope.

az policy enrollment show --name
                          [--resource-group]
                          [--scope]

Examples

Show a policy enrollment

az policy enrollment show --name MyPolicyEnrollment --resource-group "myResourceGroup"

Required Parameters

--name -n

The name of the policy enrollment.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scope

The fully qualified Azure Resource manager identifier of the resource.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy enrollment update

Update a policy enrollment.

Update the policy enrollment with the given name and scope by applying the given property values.

az policy enrollment update --name
                            [--acquire-policy-token]
                            [--add]
                            [--assignment-scope-validation {Default, DoNotValidate}]
                            [--change-reference]
                            [--description]
                            [--display-name]
                            [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                            [--metadata]
                            [--policy-assignment]
                            [--policy-definition-reference-ids]
                            [--remove]
                            [--resource-group]
                            [--resource-selectors]
                            [--scope]
                            [--set]

Examples

Update a policy enrollment in a resource group

az policy enrollment update -n enrollTestVM --display-name "Updated display name" --resource-group myResourceGroup

Update a policy enrollment at scope

az policy enrollment update -n enrollTestVM --description "This enrollment is very cool." --scope "/providers/Microsoft.Management/managementGroups/{managementGroupName}"

Required Parameters

--name -n

The name of the policy enrollment.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

Property	Value
Parameter group:	Generic Update Arguments

--assignment-scope-validation -v

The option whether to validate the enrollment is at or under the assignment scope.

Property	Value
Parameter group:	Properties Arguments
Accepted values:	Default, DoNotValidate

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--description

The description of the policy enrollment.

Property	Value
Parameter group:	Properties Arguments

--display-name

The display name of the policy enrollment.

Property	Value
Parameter group:	Properties Arguments

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Property	Value
Parameter group:	Generic Update Arguments
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--metadata

The policy enrollment metadata. Metadata is an open ended object and is typically a collection of key value pairs. Support shorthand-syntax(full value only), json-file and yaml-file.

Property	Value
Parameter group:	Properties Arguments

--policy-assignment -a

The policy assignment to enroll.

Property	Value
Parameter group:	Properties Arguments

--policy-definition-reference-ids -r

The policy definition reference IDs. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

Property	Value
Parameter group:	Generic Update Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--resource-selectors

The resource selector list to filter policies by resource properties. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--scope

The fully qualified Azure Resource manager identifier of the resource.

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

Property	Value
Parameter group:	Generic Update Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False