az policy set-definition

Manage policy set definitions.

Manage policy set definitions, which are collections of policy definitions.

Commands

Name	Description	Type	Status
az policy set-definition create	Create a policy set definition.	Core	GA
az policy set-definition delete	Delete a policy set definition.	Core	GA
az policy set-definition list	Retrieve policy set definitions.	Core	GA
az policy set-definition show	Retrieve a policy set definition.	Core	GA
az policy set-definition update	Update a policy set definition.	Core	GA

az policy set-definition create

Edit

Create a policy set definition.

Create a policy set definition in the given subscription or management group with the given name and other properties.

az policy set-definition create --name
                                [--definition-groups]
                                [--definitions]
                                [--description]
                                [--display-name]
                                [--management-group]
                                [--metadata]
                                [--params]
                                [--version]

Examples

Create a policy set definition

az policy set-definition create -n readOnlyStorage --definitions '[ { 'policyDefinitionId': '/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/{policyDefinitionName}' } ]'

Create a policy set definition with parameters

az policy set-definition create -n readOnlyStorage --definitions "[ { 'policyDefinitionId': '/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/{policyDefinitionName}', 'parameters': { 'storageSku': { 'value': '[parameters(\'requiredSku\')]' } } }]" --params "{ 'requiredSku': { 'type': 'String' } }"

Create a policy set definition in a subscription

az policy set-definition create -n readOnlyStorage --subscription {subscriptionName} --definitions "[ { 'policyDefinitionId': '/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/{policyDefinitionName}' } ]"

Create a policy set definition with policy definition groups

az policy set-definition create -n computeRequirements --definitions "[ { 'policyDefinitionId ': '/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/storagePolicy', 'groupNames': [ 'CostSaving', 'Organizational' ] }, { 'policyDefinitionId': '/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/tagPolicy', 'groupNames': [ 'Organizational' ] } ]" --definition-groups "[{ 'name': 'CostSaving' }, { 'name': 'Organizational' } ]"

Required Parameters

--name -n

The name of the policy set definition.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--definition-groups

The metadata describing groups of policy definition references within the policy set definition. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--definitions

An array of policy definition references. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--description

Policy set definition description.

Property	Value
Parameter group:	Properties Arguments

--display-name

The display name of the policy set definition.

Property	Value
Parameter group:	Properties Arguments

--management-group

The management group.

--metadata

The policy set definition metadata. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--params -p

The policy set definition parameter definitions. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--version

The policy set definition version.

Property	Value
Parameter group:	Properties Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy set-definition delete

Edit

Breaking change

Behavior will change in a future release of the resource commands. Bypassing the confirmation prompt will require providing the -y switch.

Delete a policy set definition.

Delete the policy set definition in the given subscription or management group with the given name.

az policy set-definition delete --name
                                [--management-group]

Examples

Delete a policy set definition

az policy set-definition delete --management-group myMg --name MyPolicySetDefinition

Required Parameters

--name -n

The name of the policy set definition.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--management-group

The management group.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy set-definition list

Edit

Retrieve policy set definitions.

Retrieve the list of all policy set definitions in the given subscription or management group.

az policy set-definition list [--expand]
                              [--filter]
                              [--management-group]
                              [--max-items]
                              [--next-token]

Examples

List policy set definitions

az policy set-definition list

List policy set definitions at management group level

az policy set-definition list --management-group MyManagementGroup

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--expand

Additional properties to include in output.

--filter

Filter list results.

--management-group

The management group.

--max-items

Total number of items to return in the command's output. If the total number of items available is more than the value specified, a token is provided in the command's output. To resume pagination, provide the token value in --next-token argument of a subsequent command.

Property	Value
Parameter group:	Pagination Arguments

--next-token

Token to specify where to start paginating. This is the token value from a previously truncated response.

Property	Value
Parameter group:	Pagination Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy set-definition show

Edit

Retrieve a policy set definition.

Retrieve and show the details of the policy set definition in the given subscription or management group with the given name.

az policy set-definition show --name
                              [--expand]
                              [--management-group]

Examples

Retrieve a policy set definition at management group level

az policy set-definition show --management-group MyManagementGroup --name CostManagement

Retrieve a policy set definition

az policy set-definition show --name CostManagement

Required Parameters

--name -n

The name of the policy set definition.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--expand

Additional properties to include in output.

--management-group

The management group.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az policy set-definition update

Edit

Update a policy set definition.

Update the policy set definition in the given subscription or management group with the given name by applying the given properties.

az policy set-definition update --name
                                [--add]
                                [--definition-groups]
                                [--definitions]
                                [--description]
                                [--display-name]
                                [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                                [--management-group]
                                [--metadata]
                                [--params]
                                [--remove]
                                [--set]
                                [--version]

Examples

Update a policy set definition

az policy set-definition update --definitions '[ { 'policyDefinitionId': '/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/storagePolicy' } ]' --name MyPolicySetDefinition

Update the groups and definitions within a policy set definition

az policy set-definition update -n computeRequirements --definitions "[ { 'policyDefinitionId': '/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/storagePolicy', 'groupNames': [ 'CostSaving', 'Organizational' ] }, { 'policyDefinitionId': '/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyDefinitions/tagPolicy', 'groupNames': [ 'Organizational' ] } ]" --definition-groups "[{ 'name': 'CostSaving' }, { 'name': 'Organizational' } ]"

Required Parameters

--name -n

The name of the policy set definition.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

Property	Value
Parameter group:	Generic Update Arguments

--definition-groups

The metadata describing groups of policy definition references within the policy set definition. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--definitions

An array of policy definition references. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--description

Policy set definition description.

Property	Value
Parameter group:	Properties Arguments

--display-name

The display name of the policy set definition.

Property	Value
Parameter group:	Properties Arguments

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Property	Value
Parameter group:	Generic Update Arguments
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--management-group

The management group.

--metadata

The policy set definition metadata. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--params -p

The policy set definition parameter definitions. Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

Property	Value
Parameter group:	Generic Update Arguments

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

Property	Value
Parameter group:	Generic Update Arguments

--version

The policy set definition version.

Property	Value
Parameter group:	Properties Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

Feedback

Was this page helpful?

Share via

az policy set-definition

Commands

az policy set-definition create

Examples

Required Parameters

Optional Parameters

az policy set-definition delete

Examples

Required Parameters

Optional Parameters

az policy set-definition list

Examples

Optional Parameters

az policy set-definition show

Examples

Required Parameters

Optional Parameters

az policy set-definition update

Examples

Required Parameters

Optional Parameters

Feedback