Microsoft.Authorization policyAssignments

• Latest
• 2026-06-01
• 2026-01-01-preview
• 2025-12-01-preview
• 2025-11-01
• 2025-03-01
• 2025-01-01
• 2024-05-01
• 2024-04-01
• 2023-04-01
• 2022-06-01
• 2021-06-01
• 2020-09-01
• 2020-03-01
• 2019-09-01
• 2019-06-01
• 2019-01-01
• 2018-05-01
• 2018-03-01
• 2017-06-01-preview
• 2016-12-01
• 2016-04-01
• 2015-11-01
• 2015-10-01-preview

Bicep resource definition

The policyAssignments resource type can be deployed with operations that target:

• Tenant - See tenant deployment commands* Management groups - See management group deployment commands* Subscription - See subscription deployment commands* Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Authorization/policyAssignments resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Authorization/policyAssignments@2026-06-01' = {
 scope: resourceSymbolicName or scope
 identity: {
 type: 'string'
 userAssignedIdentities: {
 {customized property}: {}
 }
 }
 location: 'string'
 name: 'string'
 properties: {
 assignmentType: 'string'
 definitionVersion: 'string'
 description: 'string'
 displayName: 'string'
 enforcementMode: 'string'
 metadata: any(...)
 nonComplianceMessages: [
 {
 message: 'string'
 policyDefinitionReferenceId: 'string'
 }
 ]
 notScopes: [
 'string'
 ]
 overrides: [
 {
 kind: 'string'
 selectors: [
 {
 in: [
 'string'
 ]
 kind: 'string'
 notIn: [
 'string'
 ]
 progress: int
 }
 ]
 value: 'string'
 }
 ]
 parameters: {
 {customized property}: {
 value: any(...)
 }
 }
 policyDefinitionId: 'string'
 resourceSelectors: [
 {
 name: 'string'
 selectors: [
 {
 in: [
 'string'
 ]
 kind: 'string'
 notIn: [
 'string'
 ]
 progress: int
 }
 ]
 }
 ]
 selfServeExemptionSettings: {
 enabled: bool
 policyDefinitionReferenceIds: [
 'string'
 ]
 }
 }
}

Property Values

Microsoft.Authorization/policyAssignments

Identity

IdentityUserAssignedIdentities

NonComplianceMessage

Override

ParameterValuesValue

PolicyAssignmentProperties

PolicyAssignmentPropertiesParameters

ResourceSelector

Selector

SelfServeExemptionSettings

UserAssignedIdentitiesValue

Usage Examples

Bicep Samples

A basic example of deploying Policy Assignment.

targetScope = 'subscription'

param resourceName string = 'acctest0001'
param location string = 'eastus'

resource policyAssignment 'Microsoft.Authorization/policyAssignments@2022-06-01' = {
 name: resourceName
 scope: subscription()
 properties: {
 displayName: ''
 enforcementMode: 'Default'
 parameters: {
 listOfAllowedLocations: {
 value: [
 'West Europe'
 'West US 2'
 'East US 2'
 ]
 }
 }
 policyDefinitionId: policyDefinition.id
 scope: subscription().id
 }
}

resource policyDefinition 'Microsoft.Authorization/policyDefinitions@2021-06-01' = {
 name: resourceName
 properties: {
 description: ''
 displayName: 'my-policy-definition'
 mode: 'All'
 parameters: {
 allowedLocations: {
 metadata: {
 description: 'The list of allowed locations for resources.'
 displayName: 'Allowed locations'
 strongType: 'location'
 }
 type: 'Array'
 }
 }
 policyRule: {
 if: {
 not: {
 field: 'location'
 in: /* ERROR: Unparsed HCL syntax in LiteralNode */ {}
 }
 }
 then: {
 effect: 'audit'
 }
 }
 policyType: 'Custom'
 }
}

Azure Verified Modules

The following Azure Verified Modules can be used to deploy this resource type.

Azure Quickstart Samples

The following Azure Quickstart templates contain Bicep samples for deploying this resource type.

ARM template resource definition

The policyAssignments resource type can be deployed with operations that target:

• Tenant - See tenant deployment commands* Management groups - See management group deployment commands* Subscription - See subscription deployment commands* Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Authorization/policyAssignments resource, add the following JSON to your template.

{
 "type": "Microsoft.Authorization/policyAssignments",
 "apiVersion": "2026-06-01",
 "name": "string",
 "identity": {
 "type": "string",
 "userAssignedIdentities": {
 "{customized property}": {
 }
 }
 },
 "location": "string",
 "properties": {
 "assignmentType": "string",
 "definitionVersion": "string",
 "description": "string",
 "displayName": "string",
 "enforcementMode": "string",
 "metadata": {},
 "nonComplianceMessages": [
 {
 "message": "string",
 "policyDefinitionReferenceId": "string"
 }
 ],
 "notScopes": [ "string" ],
 "overrides": [
 {
 "kind": "string",
 "selectors": [
 {
 "in": [ "string" ],
 "kind": "string",
 "notIn": [ "string" ],
 "progress": "int"
 }
 ],
 "value": "string"
 }
 ],
 "parameters": {
 "{customized property}": {
 "value": {}
 }
 },
 "policyDefinitionId": "string",
 "resourceSelectors": [
 {
 "name": "string",
 "selectors": [
 {
 "in": [ "string" ],
 "kind": "string",
 "notIn": [ "string" ],
 "progress": "int"
 }
 ]
 }
 ],
 "selfServeExemptionSettings": {
 "enabled": "bool",
 "policyDefinitionReferenceIds": [ "string" ]
 }
 }
}

Property Values

Microsoft.Authorization/policyAssignments

Identity

IdentityUserAssignedIdentities

NonComplianceMessage

Override

ParameterValuesValue

PolicyAssignmentProperties

PolicyAssignmentPropertiesParameters

ResourceSelector

Selector

SelfServeExemptionSettings

UserAssignedIdentitiesValue

Usage Examples

Azure Quickstart Templates

The following Azure Quickstart templates deploy this resource type.

Terraform (AzAPI provider) resource definition

The policyAssignments resource type can be deployed with operations that target:

• Tenant* Management groups* Subscription* Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Authorization/policyAssignments resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
 type = "Microsoft.Authorization/policyAssignments@2026-06-01"
 name = "string"
 parent_id = "string"
 identity {
 type = "string"
 identity_ids = [
 "string"
 ]
 }
 location = "string"
 body = {
 properties = {
 assignmentType = "string"
 definitionVersion = "string"
 description = "string"
 displayName = "string"
 enforcementMode = "string"
 metadata = ?
 nonComplianceMessages = [
 {
 message = "string"
 policyDefinitionReferenceId = "string"
 }
 ]
 notScopes = [
 "string"
 ]
 overrides = [
 {
 kind = "string"
 selectors = [
 {
 in = [
 "string"
 ]
 kind = "string"
 notIn = [
 "string"
 ]
 progress = int
 }
 ]
 value = "string"
 }
 ]
 parameters = {
 {customized property} = {
 value = ?
 }
 }
 policyDefinitionId = "string"
 resourceSelectors = [
 {
 name = "string"
 selectors = [
 {
 in = [
 "string"
 ]
 kind = "string"
 notIn = [
 "string"
 ]
 progress = int
 }
 ]
 }
 ]
 selfServeExemptionSettings = {
 enabled = bool
 policyDefinitionReferenceIds = [
 "string"
 ]
 }
 }
 }
}

Property Values

Microsoft.Authorization/policyAssignments

Identity

IdentityUserAssignedIdentities

NonComplianceMessage

Override

ParameterValuesValue

PolicyAssignmentProperties

PolicyAssignmentPropertiesParameters

ResourceSelector

Selector

SelfServeExemptionSettings

UserAssignedIdentitiesValue

Usage Examples

Terraform Samples

A basic example of deploying Policy Assignment.

terraform {
 required_providers {
 azapi = {
 source = "Azure/azapi"
 }
 azurerm = {
 source = "hashicorp/azurerm"
 }
 }
}

provider "azurerm" {
 features {
 }
}

provider "azapi" {
 skip_provider_registration = false
}

variable "resource_name" {
 type = string
 default = "acctest0001"
}

variable "location" {
 type = string
 default = "eastus"
}

data "azurerm_client_config" "current" {
}

data "azapi_resource" "subscription" {
 type = "Microsoft.Resources/subscriptions@2021-01-01"
 resource_id = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
 response_export_values = ["*"]
}

resource "azapi_resource" "policyDefinition" {
 type = "Microsoft.Authorization/policyDefinitions@2021-06-01"
 parent_id = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
 name = var.resource_name
 body = {
 properties = {
 description = ""
 displayName = "my-policy-definition"
 mode = "All"
 parameters = {
 allowedLocations = {
 metadata = {
 description = "The list of allowed locations for resources."
 displayName = "Allowed locations"
 strongType = "location"
 }
 type = "Array"
 }
 }
 policyRule = {
 if = {
 not = {
 field = "location"
 in = "[parameters('allowedLocations')]"
 }
 }
 then = {
 effect = "audit"
 }
 }
 policyType = "Custom"
 }
 }
 schema_validation_enabled = false
 response_export_values = ["*"]
}

resource "azapi_resource" "policyAssignment" {
 type = "Microsoft.Authorization/policyAssignments@2022-06-01"
 parent_id = data.azapi_resource.subscription.id
 name = var.resource_name
 body = {
 properties = {
 displayName = ""
 enforcementMode = "Default"
 parameters = {
 listOfAllowedLocations = {
 value = [
 "West Europe",
 "West US 2",
 "East US 2",
 ]
 }
 }
 policyDefinitionId = azapi_resource.policyDefinition.id
 scope = data.azapi_resource.subscription.id
 }
 }
 schema_validation_enabled = false
 response_export_values = ["*"]
}