PolicyAssignment

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-azure-policy/json-schema/microsoft-azure-policy-policy-assignment-schema.json",
  "title": "PolicyAssignment",
  "description": "The policy assignment.",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-azure-policy-openapi.yml#/components/schemas/PolicyAssignment",
  "type": "object",
  "properties": {
    "properties": {
      "$ref": "#/$defs/PolicyAssignmentProperties"
    },
    "id": {
      "type": "string",
      "description": "The ID of the policy assignment.",
      "readOnly": true
    },
    "type": {
      "type": "string",
      "description": "The type of the policy assignment.",
      "readOnly": true
    },
    "name": {
      "type": "string",
      "description": "The name of the policy assignment.",
      "readOnly": true
    },
    "location": {
      "type": "string",
      "description": "The location of the policy assignment. Only required when utilizing managed identity."
    },
    "identity": {
      "$ref": "#/$defs/Identity"
    },
    "systemData": {
      "$ref": "#/$defs/systemData"
    }
  },
  "x-ms-azure-resource": true,
  "$defs": {
    "Identity": {
      "type": "object",
      "properties": {
        "principalId": {
          "readOnly": true,
          "type": "string",
          "description": "The principal ID of the resource identity.  This property will only be provided for a system assigned identity"
        },
        "tenantId": {
          "readOnly": true,
          "type": "string",
          "description": "The tenant ID of the resource identity.  This property will only be provided for a system assigned identity"
        },
        "type": {
          "type": "string",
          "description": "The identity type. This is the only required field when adding a system or user assigned identity to a resource.",
          "enum": [
            "SystemAssigned",
            "UserAssigned",
            "None"
          ],
          "x-ms-enum": {
            "name": "ResourceIdentityType",
            "modelAsString": false,
            "values": [
              {
                "value": "SystemAssigned",
                "description": "Indicates that a system assigned identity is associated with the resource."
              },
              {
                "value": "UserAssigned",
                "description": "Indicates that a system assigned identity is associated with the resource."
              },
              {
                "value": "None",
                "description": "Indicates that no identity is associated with the resource or that the existing identity should be removed."
              }
            ]
          }
        },
        "userAssignedIdentities": {
          "type": "object",
          "additionalProperties": {
            "type": "object",
            "x-ms-client-name": "userAssignedIdentitiesValue",
            "properties": {
              "principalId": {
                "readOnly": true,
                "type": "string",
                "description": "The principal id of user assigned identity."
              },
              "clientId": {
                "readOnly": true,
                "type": "string",
                "description": "The client id of user assigned identity."
              }
            }
          },
          "description": "The user identity associated with the policy. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'."
        }
      },
      "description": "Identity for the resource.  Policy assignments support a maximum of one identity.  That is either a system assigned identity or a single user assigned identity."
    },
    "NonComplianceMessage": {
      "type": "object",
      "properties": {
        "message": {
          "type": "string",
          "description": "A message that describes why a resource is non-compliant with the policy. This is shown in 'deny' error messages and on resource's non-compliant compliance results."
        },
        "policyDefinitionReferenceId": {
          "type": "string",
          "description": "The policy definition reference ID within a policy set definition the message is intended for. This is only applicable if the policy assignment assigns a policy set definition. If this is not provided the message applies to all policies assigned by this policy assignment."
        }
      },
      "required": [
        "message"
      ],
      "description": "A message that describes why a resource is non-compliant with the policy. This is shown in 'deny' error messages and on resource's non-compliant compliance results."
    },
    "Override": {
      "description": "The policy property value override.",
      "type": "object",
      "properties": {
        "kind": {
          "type": "string",
          "description": "The override kind.",
          "enum": [
            "policyEffect",
            "definitionVersion"
          ],
          "x-ms-enum": {
            "name": "OverrideKind",
            "modelAsString": true,
            "values": [
              {
                "value": "policyEffect",
                "description": "It will override the policy effect type."
              },
              {
                "value": "definitionVersion",
                "description": "It will override the definition version property value of the policy assignment."
              }
            ]
          }
        },
        "value": {
          "type": "string",
          "description": "The value to override the policy property."
        },
        "selectors": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Selector"
          },
          "x-ms-identifiers": [],
          "description": "The list of the selector expressions."
        }
      }
    },
    "ParameterValues": {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/ParameterValuesValue"
      },
      "description": "The parameter values for the policy rule. The keys are the parameter names."
    },
    "ParameterValuesValue": {
      "type": "object",
      "properties": {
        "value": {
          "description": "The value of the parameter."
        }
      },
      "description": "The value of a parameter."
    },
    "PolicyAssignmentProperties": {
      "type": "object",
      "properties": {
        "displayName": {
          "type": "string",
          "description": "The display name of the policy assignment."
        },
        "policyDefinitionId": {
          "type": "string",
          "description": "The ID of the policy definition or policy set definition being assigned."
        },
        "definitionVersion": {
          "type": "string",
          "description": "The version of the policy definition to use."
        },
        "latestDefinitionVersion": {
          "type": "string",
          "description": "The latest version of the policy definition available. This is only present if requested via the $expand query parameter.",
          "readOnly": true
        },
        "effectiveDefinitionVersion": {
          "type": "string",
          "description": "The effective version of the policy definition in use. This is only present if requested via the $expand query parameter.",
          "readOnly": true
        },
        "scope": {
          "type": "string",
          "description": "The scope for the policy assignment.",
          "readOnly": true
        },
        "notScopes": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The policy's excluded scopes."
        },
        "parameters": {
          "$ref": "#/$defs/ParameterValues"
        },
        "description": {
          "type": "string",
          "description": "This message will be part of response in case of policy violation."
        },
        "metadata": {
          "type": "object",
          "description": "The policy assignment metadata. Metadata is an open ended object and is typically a collection of key value pairs."
        },
        "enforcementMode": {
          "type": "string",
          "description": "The policy assignment enforcement mode. Possible values are Default, DoNotEnforce, and Enroll",
          "enum": [
            "Default",
            "DoNotEnforce",
            "Enroll"
          ],
          "x-ms-enum": {
            "name": "enforcementMode",
            "modelAsString": true,
            "values": [
              {
                "value": "Default",
                "description": "The policy effect is enforced during resource creation or update."
              },
              {
                "value": "DoNotEnforce",
                "description": "The policy effect is not enforced during resource creation or update."
              },
              {
                "value": "Enroll",
                "description": "The policy effect is not enforced during resource creation or update until the resource or scope of the resource is enrolled to the assignment instance. Enrollment occurs upon deployment of the policy enrollment resource."
              }
            ]
          },
          "default": "Default"
        },
        "nonComplianceMessages": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/NonComplianceMessage"
          },
          "x-ms-identifiers": [
            "message",
            "policyDefinitionReferenceId"
          ],
          "description": "The messages that describe why a resource is non-compliant with the policy."
        },
        "resourceSelectors": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/ResourceSelector"
          },
          "x-ms-identifiers": [],
          "description": "The resource selector list to filter policies by resource properties."
        },
        "overrides": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Override"
          },
          "x-ms-identifiers": [],
          "description": "The policy property value override."
        },
        "assignmentType": {
          "type": "string",
          "description": "The type of policy assignment. Possible values are NotSpecified, System, SystemHidden, and Custom. Immutable.",
          "enum": [
            "NotSpecified",
            "System",
            "SystemHidden",
            "Custom"
          ],
          "x-ms-enum": {
            "name": "assignmentType",
            "modelAsString": true
          }
        },
        "instanceId": {
          "type": "string",
          "description": "The instance ID of the policy assignment. This ID only and always changes when the assignment is deleted and recreated.",
          "readOnly": true
        }
      },
      "description": "The policy assignment properties."
    },
    "ResourceSelector": {
      "description": "The resource selector to filter policies by resource properties.",
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "The name of the resource selector."
        },
        "selectors": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Selector"
          },
          "x-ms-identifiers": [],
          "description": "The list of the selector expressions."
        }
      }
    },
    "Selector": {
      "description": "The selector expression.",
      "type": "object",
      "properties": {
        "kind": {
          "type": "string",
          "description": "The selector kind.",
          "enum": [
            "resourceLocation",
            "resourceType",
            "resourceWithoutLocation",
            "policyDefinitionReferenceId"
          ],
          "x-ms-enum": {
            "name": "SelectorKind",
            "modelAsString": true,
            "values": [
              {
                "value": "resourceLocation",
                "description": "The selector kind to filter policies by the resource location."
              },
              {
                "value": "resourceType",
                "description": "The selector kind to filter policies by the resource type."
              },
              {
                "value": "resourceWithoutLocation",
                "description": "The selector kind to filter policies by the resource without location."
              },
              {
                "value": "policyDefinitionReferenceId",
                "description": "The selector kind to filter policies by the policy definition reference ID."
              }
            ]
          }
        },
        "in": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The list of values to filter in."
        },
        "notIn": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The list of values to filter out."
        }
      }
    },
    "systemData": {
      "type": "object",
      "description": "Metadata pertaining to creation and last modification of the resource.",
      "properties": {
        "createdBy": {
          "type": "string",
          "description": "The identity that created the resource."
        },
        "createdByType": {
          "type": "string",
          "description": "The type of identity that created the resource.",
          "enum": [
            "User",
            "Application",
            "ManagedIdentity",
            "Key"
          ],
          "x-ms-enum": {
            "name": "createdByType",
            "modelAsString": true
          }
        },
        "createdAt": {
          "type": "string",
          "format": "date-time",
          "description": "The timestamp of resource creation (UTC)."
        },
        "lastModifiedBy": {
          "type": "string",
          "description": "The identity that last modified the resource."
        },
        "lastModifiedByType": {
          "type": "string",
          "description": "The type of identity that last modified the resource.",
          "enum": [
            "User",
            "Application",
            "ManagedIdentity",
            "Key"
          ],
          "x-ms-enum": {
            "name": "createdByType",
            "modelAsString": true
          }
        },
        "lastModifiedAt": {
          "type": "string",
          "format": "date-time",
          "description": "The timestamp of resource last modification (UTC)"
        }
      },
      "readOnly": true
    }
  }
}