Microsoft.Authorization policyExemptions

• Latest
• 2026-01-01-preview
• 2025-12-01-preview
• 2024-12-01-preview
• 2022-07-01-preview
• 2020-07-01-preview

Bicep resource definition

The policyExemptions resource type can be deployed with operations that target:

• Tenant - See tenant deployment commands* Management groups - See management group deployment commands* Subscription - See subscription deployment commands* Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Authorization/policyExemptions resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Authorization/policyExemptions@2026-01-01-preview' = {
 scope: resourceSymbolicName or scope
 name: 'string'
 properties: {
 assignmentScopeValidation: 'string'
 description: 'string'
 displayName: 'string'
 exemptionCategory: 'string'
 expiresOn: 'string'
 metadata: any(...)
 policyAssignmentId: 'string'
 policyDefinitionReferenceIds: [
 'string'
 ]
 resourceSelectors: [
 {
 name: 'string'
 selectors: [
 {
 in: [
 'string'
 ]
 kind: 'string'
 notIn: [
 'string'
 ]
 }
 ]
 }
 ]
 }
}

Property Values

Microsoft.Authorization/policyExemptions

PolicyExemptionProperties

ResourceSelector

Selector

Usage Examples

Bicep Samples

A basic example of deploying Policy Exemption.

targetScope = 'subscription'

param resourceName string = 'acctest0001'
param location string = 'eastus'

resource policyAssignment 'Microsoft.Authorization/policyAssignments@2022-06-01' = {
 name: resourceName
 location: 'westeurope'
 scope: subscription()
 properties: {
 displayName: ''
 enforcementMode: 'Default'
 policyDefinitionId: policyDefinition.id
 scope: subscription().id
 }
}

resource policyDefinition 'Microsoft.Authorization/policyDefinitions@2021-06-01' = {
 name: resourceName
 properties: {
 description: ''
 displayName: 'my-policy-definition'
 mode: 'All'
 parameters: {
 allowedLocations: {
 metadata: {
 description: 'The list of allowed locations for resources.'
 displayName: 'Allowed locations'
 strongType: 'location'
 }
 type: 'Array'
 }
 }
 policyRule: {
 if: {
 not: {
 field: 'location'
 in: /* ERROR: Unparsed HCL syntax in LiteralNode */ {}
 }
 }
 then: {
 effect: 'audit'
 }
 }
 policyType: 'Custom'
 }
}

resource policyExemption 'Microsoft.Authorization/policyExemptions@2020-07-01-preview' = {
 name: resourceName
 scope: subscription()
 properties: {
 exemptionCategory: 'Mitigated'
 policyAssignmentId: policyAssignment.id
 policyDefinitionReferenceIds: []
 }
}

ARM template resource definition

The policyExemptions resource type can be deployed with operations that target:

• Tenant - See tenant deployment commands* Management groups - See management group deployment commands* Subscription - See subscription deployment commands* Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Authorization/policyExemptions resource, add the following JSON to your template.

{
 "type": "Microsoft.Authorization/policyExemptions",
 "apiVersion": "2026-01-01-preview",
 "name": "string",
 "properties": {
 "assignmentScopeValidation": "string",
 "description": "string",
 "displayName": "string",
 "exemptionCategory": "string",
 "expiresOn": "string",
 "metadata": {},
 "policyAssignmentId": "string",
 "policyDefinitionReferenceIds": [ "string" ],
 "resourceSelectors": [
 {
 "name": "string",
 "selectors": [
 {
 "in": [ "string" ],
 "kind": "string",
 "notIn": [ "string" ]
 }
 ]
 }
 ]
 }
}

Property Values

Microsoft.Authorization/policyExemptions

PolicyExemptionProperties

ResourceSelector

Selector

Usage Examples

Terraform (AzAPI provider) resource definition

The policyExemptions resource type can be deployed with operations that target:

• Tenant* Management groups* Subscription* Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Authorization/policyExemptions resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
 type = "Microsoft.Authorization/policyExemptions@2026-01-01-preview"
 name = "string"
 parent_id = "string"
 body = {
 properties = {
 assignmentScopeValidation = "string"
 description = "string"
 displayName = "string"
 exemptionCategory = "string"
 expiresOn = "string"
 metadata = ?
 policyAssignmentId = "string"
 policyDefinitionReferenceIds = [
 "string"
 ]
 resourceSelectors = [
 {
 name = "string"
 selectors = [
 {
 in = [
 "string"
 ]
 kind = "string"
 notIn = [
 "string"
 ]
 }
 ]
 }
 ]
 }
 }
}

Property Values

Microsoft.Authorization/policyExemptions

PolicyExemptionProperties

ResourceSelector

Selector

Usage Examples

Terraform Samples

A basic example of deploying Policy Exemption.

terraform {
 required_providers {
 azapi = {
 source = "Azure/azapi"
 }
 azurerm = {
 source = "hashicorp/azurerm"
 }
 }
}

provider "azurerm" {
 features {
 }
}

provider "azapi" {
 skip_provider_registration = false
}

variable "resource_name" {
 type = string
 default = "acctest0001"
}

variable "location" {
 type = string
 default = "eastus"
}

data "azurerm_client_config" "current" {
}

data "azapi_resource" "subscription" {
 type = "Microsoft.Resources/subscriptions@2021-01-01"
 resource_id = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
 response_export_values = ["*"]
}

resource "azapi_resource" "policyDefinition" {
 type = "Microsoft.Authorization/policyDefinitions@2021-06-01"
 parent_id = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
 name = var.resource_name
 body = {
 properties = {
 description = ""
 displayName = "my-policy-definition"
 mode = "All"
 parameters = {
 allowedLocations = {
 metadata = {
 description = "The list of allowed locations for resources."
 displayName = "Allowed locations"
 strongType = "location"
 }
 type = "Array"
 }
 }
 policyRule = {
 if = {
 not = {
 field = "location"
 in = "[parameters('allowedLocations')]"
 }
 }
 then = {
 effect = "audit"
 }
 }
 policyType = "Custom"
 }
 }
 schema_validation_enabled = false
 response_export_values = ["*"]
}

resource "azapi_resource" "policyAssignment" {
 type = "Microsoft.Authorization/policyAssignments@2022-06-01"
 parent_id = data.azapi_resource.subscription.id
 name = var.resource_name
 location = "westeurope"
 identity {
 type = "SystemAssigned"
 identity_ids = []
 }
 body = {
 properties = {
 displayName = ""
 enforcementMode = "Default"
 policyDefinitionId = azapi_resource.policyDefinition.id
 scope = data.azapi_resource.subscription.id
 }
 }
 schema_validation_enabled = false
 response_export_values = ["*"]
}

resource "azapi_resource" "policyExemption" {
 type = "Microsoft.Authorization/policyExemptions@2020-07-01-preview"
 parent_id = data.azapi_resource.subscription.id
 name = var.resource_name
 body = {
 properties = {
 exemptionCategory = "Mitigated"
 policyAssignmentId = azapi_resource.policyAssignment.id
 policyDefinitionReferenceIds = [
 ]
 }
 }
 schema_validation_enabled = false
 response_export_values = ["*"]
}