How do I disable specific policies in a definition set?

[bonardi]

Hello,

I am stuck with the following scenario and I can't seem to resolve it.

• I have 1 setDefinitions with 20 policies targeting an MGT to be applied from this level.
• I need certain policies in that SetDefinitons to be Disabled on specific subscriptions.
• The subscriptions are on a sublevel of the MGT that the SetDefinitons point to.

I have checked the options but the Override field would not work.
Has anyone encountered this scenario?

The alternative of creating exemption would not work for me because I don't want to keep adding those resources in the compliance report.

Thanks for your help!

[PKoningGas]

If you have made the effect of the policies in the set available as a parameter of the policy set, then you could just override the effect when assigning the policyset with "Disabled" using the parameter
Do you have an example of the policyset you're working with?

[bonardi]

Hello PKoningGas,
Thank you for your time and reply.

In my scenario it is the ‘AUDIT-VMS-AllowedImages’ policy that I need to set as disabled in some specific subscriptions and the rest of the policies inside the SetDefinitions to be applied in a normal way in those same subscriptions.

An example of SetDefinitions would be as follows.

{
    "name": "Policies-AUDIT",
    "properties": {
        "displayName": "Policies-AUDIT",
        "description": "Policy Set enrolls Policies-AUDIT",
        "metadata": {
            "version": "1.0.0"
        },         
        "parameters": {
            "effect": { // Global
                "type": "string",
                "metadata": {
                    "displayName": "Effect",
                    "description": "Definition of the effect of the azure policy on the policies."
                },
                "allowedValues": [
                    "Audit",
                    "Disabled"
                ],
                "defaultValue": "Audit"
            },
            "allowedGalleryIds": {
                "type": "Array",
                "metadata": {
                    "description": "List of allowed Azure Compute gallery IDs.",
                    "displayName": "Allowed Gallery IDs"
                },
                "defaultValue": [
                    "/subscriptions/xxxxxxxxxxxxxxxxxxx/resourceGroups/xxxxxxxxxxx-rsg-01/providers/Microsoft.Compute/galleries/Gallery"
                ]       
            },
            "allowedSKUs_CGS": {
                "type": "Array",
                "metadata": {
                "displayName": "Allowed SKUs",
                "description": "The list of SKUs that can be specified when deploying models"
                },
                "defaultValue": [
                    "Standard",
                    "ProvisionedManaged"
                ]
            }                                                    
        },
        "policyDefinitionGroups": [
            {
                "name": "Group01",
                "category": "Group",
                "displayName": "Group01",
                "description": "Policies related to Group01",
                "additionalMetadataId": null
            },
            {
                "name": "Group02",
                "category": "Group",
                "displayName": "Group02",
                "description": "Policies related to Group02",
                "additionalMetadataId": null
            }                                                                                                                                                                                                                                                
        ],                
        "policyDefinitions": [
          {
            "policyDefinitionReferenceId": "AUDIT-CGS-AllowedSKU",
            "policyDefinitionName": "AUDIT-CGS-AllowedSKU",
            "groupNames": ["Group01"],
            "parameters": {
              "effect": {
                "value": "[parameters('effect')]"
              },
              "allowedSKUs_CGS": {
                "value": "[parameters('allowedSKUs_CGS')]"
              }
            }
          },
          {
            "policyDefinitionReferenceId": "AUDIT-VMS-AllowedImages",
            "policyDefinitionName": "AUDIT-VMS-AllowedImages",
            "groupNames": ["Group02"],
            "parameters": {
              "effect": {
                "value": "[parameters('effect')]"
              },
              "allowedGalleryIds": {
                "value": "[parameters('allowedGalleryIds')]"
              }
            }
          }
        ]
    }
}

An example of how I would do the assignments would be like this.

{
  "$schema": "https://raw.githubusercontent.com/Azure/enterprise-azure-policy-as-code/main/Schemas/policy-assignment-schema.json",
  "nodeName": "/MGT",  
  "definitionEntryList": [
    {
      "policySetName": "Policies-AUDIT",
      "assignment": {
        "name": "Policies-AUDIT",
        "displayName": "Policies-AUDIT",
        "description": "Assignment for Policies-AUDIT"
      }
    }        
  ],
  "children": [
    {
      "nodeName": "MGT",
      "scope": {
        "EPAC-DEV-Standard": [
          "/providers/Microsoft.Management/managementGroups/xxxxxxx"
        ]
      },
      "notScopes": {
        "EPAC-DEV-Standard": [
          "/providers/Microsoft.Management/managementGroups/xxxxxxxx" // SandBox
        ]
      },     
      "enforcementMode": "Default",
      "parameters": {
        "allowedGalleryIds": [
          "/subscriptions/xxxxxxxxxxxxxxxxxxx/resourceGroups/xxxxxxxxxxx-rsg-01/providers/Microsoft.Compute/galleries/Gallery"
        ],
        "allowedSKUs_CGS": [
          "Standard",
          "ProvisionedManaged"          
        ]
      }           
    }    
  ]
}

I tried to use the override parameter but I couldn't get it to work, maybe because of the structure of assignemnts...

Thanks.