This New-AzPolicyEnrollment cmdlet creates a policy enrollment with the given scope and name.
Policy enrollments apply to all resources contained within their scope.
For example, when you create a policy enrollment at resource group scope for a policy assignment at the same or above level, the enrollment applies to all applicable resources in the resource group.
Examples
Example 1: Policy enrollment at subscription scope
The first command gets a subscription named Subscription01 by using the Get-AzSubscription cmdlet and stores it in the $Subscription variable.
The second command gets the policy assignment named VirtualMachinePolicyAssignment by using the Get-AzPolicyAssignment cmdlet and stores it in the $Assignment variable.
The assignment must have EnforcementMode set to Enroll.
The final command creates the policy enrollment for the assignment in $Assignment at the level of the subscription identified by the subscription scope string.
Example 2: Policy enrollment at management group scope
$ManagementGroup = Get-AzManagementGroup -GroupName 'AManagementGroup'
$Assignment = Get-AzPolicyAssignment -Name 'VirtualMachinePolicyAssignment'
New-AzPolicyEnrollment -Name 'VirtualMachinePolicyEnrollment' -PolicyAssignmentId $Assignment.Id -Scope $ManagementGroup.Id -Description 'Enrollment for VM policy at MG level'
The first command gets a management group named AManagementGroup by using the Get-AzManagementGroup cmdlet and stores it in the $ManagementGroup variable.
The second command gets the policy assignment named VirtualMachinePolicyAssignment by using the Get-AzPolicyAssignment cmdlet and stores it in the $Assignment variable.
The assignment must have EnforcementMode set to Enroll.
The final command creates the policy enrollment for the assignment in $Assignment at the management group scope identified by the Id property of $ManagementGroup.
Example 3: Policy enrollment with resource selector
The first command gets the subscription that the enrollment will be created at, the currently used one.
The second command gets the policy assignment named VirtualMachinePolicyAssignment by using the Get-AzPolicyAssignment cmdlet and stores it in the $Assignment variable.
The third command creates a resource selector object that limits the enrollment to resources located in East US or East US 2 and stores it in the $ResourceSelector variable.
The final command creates the policy enrollment for the assignment in $Assignment with the resource selector specified by $ResourceSelector.
Parameters
-AssignmentScopeValidation
The option whether to validate the enrollment is at or under the assignment scope.
The DefaultProfile parameter is not functional.
Use the SubscriptionId parameter when available if executing the cmdlet against a different subscription.
When the associated policy assignment is for a policy set (initiative), this can be used to specify the policy definition reference IDs for policy definitions in the policy set that should be enrolled to.
These IDs correspond to a subset of policyDefinitions[*].policyDefinitionReferenceId in the policy set definition.
When specified and not empty, only the referenced policy definitions will be enrolled to.
Otherwise, the entire policy set is enrolled to.
The scope of the policy enrollment.
Valid scopes are: management group (format: '/providers/Microsoft.Management/managementGroups/{managementGroup}'), subscription (format: '/subscriptions/{subscriptionId}'), resource group (format: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}'), or resource (format: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/[{parentResourcePath}/]{resourceType}/{resourceName}')
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
about_CommonParameters.
The source for this content can be found on GitHub, where you can also create and review issues and pull requests. For more information, see our contributor guide.
