New-AzPolicyDefinition

Module:

Az.Resources Module

Creates or updates a policy definition.

New-AzPolicyDefinition
 -Name <String>
 -Policy <String>
 [-DisplayName <String>]
 [-Description <String>]
 [-Metadata <String>]
 [-Parameter <String>]
 [-Mode <String>]
 [-Version <String>]
 [-ExternalEvaluationEnforcementSettingMissingTokenAction <String>]
 [-ExternalEvaluationEnforcementSettingResultLifespan <String>]
 [-ExternalEvaluationEnforcementSettingRoleDefinitionId <String[]>]
 [-EndpointSettingKind <String>]
 [-EndpointSettingDetail <String>]
 [-DefaultProfile <PSObject>]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

New-AzPolicyDefinition
 -Name <String>
 -ManagementGroupName <String>
 -Policy <String>
 [-DisplayName <String>]
 [-Description <String>]
 [-Metadata <String>]
 [-Parameter <String>]
 [-Mode <String>]
 [-Version <String>]
 [-ExternalEvaluationEnforcementSettingMissingTokenAction <String>]
 [-ExternalEvaluationEnforcementSettingResultLifespan <String>]
 [-ExternalEvaluationEnforcementSettingRoleDefinitionId <String[]>]
 [-EndpointSettingKind <String>]
 [-EndpointSettingDetail <String>]
 [-DefaultProfile <PSObject>]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

New-AzPolicyDefinition
 -Name <String>
 -SubscriptionId <String>
 -Policy <String>
 [-DisplayName <String>]
 [-Description <String>]
 [-Metadata <String>]
 [-Parameter <String>]
 [-Mode <String>]
 [-Version <String>]
 [-ExternalEvaluationEnforcementSettingMissingTokenAction <String>]
 [-ExternalEvaluationEnforcementSettingResultLifespan <String>]
 [-ExternalEvaluationEnforcementSettingRoleDefinitionId <String[]>]
 [-EndpointSettingKind <String>]
 [-EndpointSettingDetail <String>]
 [-DefaultProfile <PSObject>]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

The New-AzPolicyDefinition cmdlet creates or updates a policy definition that includes a policy rule JSON format.

{
 "if": {
 "field": "location",
 "notIn": ["eastus", "westus", "centralus"]
 },
 "then": {
 "effect": "audit"
 }
}

New-AzPolicyDefinition -Name 'LocationDefinition' -Policy C:\LocationPolicy.json

This command creates a policy definition named LocationDefinition that contains the policy rule specified in C:\LocationPolicy.json. Example content for the LocationPolicy.json file is provided above. Three file content formats are supported: 1. Policy rule only (example above). 2. Policy properties object. This format is displayed in the portal when editing a policy definition and may include parameters. 3. Full policy object. This format is generated by the Azure Policy export function and may include parameters.

Note: Values provided on the command line (e.g. parameters, metadata) override corresponding values present in the file.

{
 "if": {
 "field": "location",
 "notIn": "[parameters('listOfAllowedLocations')]"
 },
 "then": {
 "effect": "audit"
 }
}
New-AzPolicyDefinition -Name 'LocationDefinition' -Policy C:\LocationPolicy.json -Parameter '{ "listOfAllowedLocations": { "type": "array" } }'

This command creates a policy definition named LocationDefinition that contains the policy rule specified in C:\LocationPolicy.json. The parameter definition for the policy rule is provided inline.

New-AzPolicyDefinition -Name 'VMPolicyDefinition' -ManagementGroupName Dept42 -DisplayName 'Virtual Machine policy definition' -Policy '{"if":{"field":"type","equals":"Microsoft.Compute/virtualMachines"},"then":{"effect":"deny"}}'

This command creates a policy definition named VMPolicyDefinition in management group Dept42. The command specifies the policy as a string in valid JSON format.

New-AzPolicyDefinition -Name 'VMPolicyDefinition' -Metadata '{"category":"Virtual Machine"}' -Policy '{"if":{"field":"type","equals":"Microsoft.Compute/virtualMachines"},"then":{"effect":"deny"}}' | Format-List

This command creates a policy definition named VMPolicyDefinition with metadata indicating its category is "Virtual Machine". The command specifies the policy as a string in valid JSON format.

New-AzPolicyDefinition -Name 'TagsPolicyDefinition' -Policy '{"if":{"value":"[less(length(field(''tags'')), 3)]","equals":true},"then":{"effect":"deny"}}' -Mode Indexed

This command creates a policy definition named TagsPolicyDefinition with mode "Indexed" indicating the policy should be evaluated only for resource types that support tags and location.

New-AzPolicyDefinition -Name 'VMPolicyDefinition' -Policy '{"if":{"field":"type","equals":"Microsoft.Compute/virtualMachines"},"then":{"effect":"deny"}}' -Version '2.0.0'

This command creates a policy definition named VMPolicyDefinition with incremented version 2.0.0. The command specifies the policy as a string in valid JSON format.

New-AzPolicyDefinition -Name 'InvokePolicy' -Policy '{"if":{"value":"[claims().isValid]","equals":false},"then":{"effect":"deny"}}' -EndpointSettingKind 'CoinFlip' -ExternalEvaluationEnforcementSettingRoleDefinitionId @( "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" )

This command creates a policy definition named InvokePolicy with external evaluation enforcement settings to call the CoinFlip endpoint, which requires the specified role definition.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.