New-AzPolicyDefinition

Module:

Az.Resources Module

Creates a policy definition.

Syntax

NameParameterSet (Default)

New-AzPolicyDefinition
    -Name <String>
    -Policy <String>
    [-DisplayName <String>]
    [-Description <String>]
    [-Metadata <String>]
    [-Parameter <String>]
    [-Mode <PolicyDefinitionMode>]
    [-ApiVersion <String>]
    [-Pre]
    [-DefaultProfile <IAzureContextContainer>]
    [-InformationAction <ActionPreference>]
    [-InformationVariable <String>]
    [<CommonParameters>]

ManagementGroupNameParameterSet

New-AzPolicyDefinition
    -Name <String>
    -Policy <String>
    -ManagementGroupName <String>
    [-DisplayName <String>]
    [-Description <String>]
    [-Metadata <String>]
    [-Parameter <String>]
    [-Mode <PolicyDefinitionMode>]
    [-ApiVersion <String>]
    [-Pre]
    [-DefaultProfile <IAzureContextContainer>]
    [-InformationAction <ActionPreference>]
    [-InformationVariable <String>]
    [<CommonParameters>]

SubscriptionIdParameterSet

New-AzPolicyDefinition
    -Name <String>
    -Policy <String>
    -SubscriptionId <Guid>
    [-DisplayName <String>]
    [-Description <String>]
    [-Metadata <String>]
    [-Parameter <String>]
    [-Mode <PolicyDefinitionMode>]
    [-ApiVersion <String>]
    [-Pre]
    [-DefaultProfile <IAzureContextContainer>]
    [-InformationAction <ActionPreference>]
    [-InformationVariable <String>]
    [<CommonParameters>]

Description

The New-AzPolicyDefinition cmdlet creates a policy definition that includes a policy rule in JavaScript Object Notation (JSON) format.

Examples

Example 1: Create a policy definition by using a policy file

{
   "if": {
      "field": "location",
      "notIn": ["eastus", "westus", "centralus"]
   },
   "then": {
      "effect": "audit"
   }
}

PS C:\> New-AzPolicyDefinition -Name 'LocationDefinition' -Policy C:\LocationPolicy.json

This command creates a policy definition named LocationDefinition that contains the policy rule specified in C:\LocationPolicy.json. Example content for the LocationPolicy.json file is provided above.

Example 2: Create a parameterized policy definition using inline parameters

{
   "if": {
      "field": "location",
      "notIn": "[parameters('listOfAllowedLocations')]"
   },
   "then": {
      "effect": "audit"
   }
}

PS C:\> New-AzPolicyDefinition -Name 'LocationDefinition' -Policy C:\LocationPolicy.json -Parameter '{ "listOfAllowedLocations": { "type": "array" } }'

This command creates a policy definition named LocationDefinition that contains the policy rule specified in C:\LocationPolicy.json. The parameter definition for the policy rule is provided inline.

Example 3: Create a policy definition inline in a management group

PS C:\> New-AzPolicyDefinition -Name 'VMPolicyDefinition' -ManagementGroupName Dept42 -DisplayName 'Virtual Machine policy definition' -Policy '{"if":{"source":"action","equals":"Microsoft.Compute/virtualMachines/write"},"then":{"effect":"deny"}}'

This command creates a policy definition named VMPolicyDefinition in management group Dept42. The command specifies the policy as a string in valid JSON format.

Example 4: Create a policy definition inline with metadata

PS C:\> New-AzPolicyDefinition -Name 'VMPolicyDefinition' -Metadata '{"Category":"Virtual Machine"}' -Policy '{"if":{"source":"action","equals":"Microsoft.Compute/virtualMachines/write"},"then":{"effect":"deny"}}'


Name               : VMPolicyDefinition
ResourceId         : /subscriptions/a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1/providers/Microsoft.Authorization/policyDefinitions/VMPolicyDefinition
ResourceName       : VMPolicyDefinition
ResourceType       : Microsoft.Authorization/policyDefinitions
SubscriptionId     : aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e
Properties         : @{displayName=VMPolicyDefinition; policyType=Custom; mode=All; metadata=; policyRule=}
PolicyDefinitionId : /subscriptions/a0a0a0a0-bbbb-cccc-dddd-e1e1e1e1e1e1/providers/Microsoft.Authorization/policyDefinitions/VMPolicyDefinition

This command creates a policy definition named VMPolicyDefinition with metadata indicating its category is "Virtual Machine". The command specifies the policy as a string in valid JSON format.

Parameters

-ApiVersion

Specifies the version of the resource provider API to use. If you do not specify a version, this cmdlet uses the latest available version.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DefaultProfile

The credentials, account, tenant, and subscription used for communication with azure

Parameter properties

Type:	IAzureContextContainer
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	AzContext, AzureCredential

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Description

Specifies a description for the policy definition.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-DisplayName

Specifies a display name for the policy definition.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-InformationAction

Specifies how this cmdlet responds to an information event. The acceptable values for this parameter are:

• Continue
• Ignore
• Inquire
• SilentlyContinue
• Stop
• Suspend

Parameter properties

Type:	ActionPreference
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	infa

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-InformationVariable

Specifies an information variable.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	iv

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ManagementGroupName

The name of the management group of the new policy definition.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

ManagementGroupNameParameterSet

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-Metadata

The metadata for policy definition. This can either be a path to a file name containing the metadata, or the metadata as string

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-Mode

The mode of the policy definition

Parameter properties

Type:	Nullable<T>[PolicyDefinitionMode]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-Name

Specifies a name for the policy definition.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-Parameter

The parameters declaration for policy definition. This can either be a path to a file name containing the parameters declaration, or the parameters declaration as string.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-Policy

Specifies a policy rule for the policy definition. You can specify the path of a .json file or a string that contains the policy in JSON format.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-Pre

Indicates that this cmdlet considers pre-release API versions when it automatically determines which version to use.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-SubscriptionId

The subscription ID of the new policy definition.

Parameter properties

Type:	Nullable<T>[Guid]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

SubscriptionIdParameterSet

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Related Links

• Get-AzPolicyDefinition
• Remove-AzPolicyDefinition
• Set-AzPolicyDefinition