Flexible policy assignment scope

.pipelines/policy.yml

@@ -98,6 +98,7 @@ stages:
         description: 'Assign Policy Set'
         deployTemplates: [AKS, DefenderForCloud, LogAnalytics, Network, Tags]
         deployOperation: ${{ variables['deployOperation'] }}
+        policyAssignmentManagementGroupScope: $(var-topLevelManagementGroupName)
         workingDir: $(System.DefaultWorkingDirectory)/policy/custom/assignments
 
   - job: BuiltInPolicyJob
@@ -119,4 +120,6 @@ stages:
         description: 'Assign Policy Set'
         deployTemplates: [asb, cis-msft-130, location, nist80053r4, nist80053r5, pbmm, hitrust-hipaa, fedramp-moderate]
         deployOperation: ${{ variables['deployOperation'] }}
+        policyAssignmentManagementGroupScope: $(var-topLevelManagementGroupName)
         workingDir: $(System.DefaultWorkingDirectory)/policy/builtin/assignments
+

.pipelines/templates/steps/assign-policy.yml

@@ -18,6 +18,8 @@ parameters:
     values:
       - create
       - what-if
+  - name: policyAssignmentManagementGroupScope
+    type: string
   - name: workingDir
     type: string
 
@@ -34,24 +36,29 @@ steps:
         $(var-bashPreInjectScript)
 
         echo "Populating templated parameters in ${{ policy }}.parameters.json"
-        sed -i 's~{{var-topLevelManagementGroupName}}~$(var-topLevelManagementGroupName)~g' ${{ policy }}.parameters.json
 
-        sed -i 's~{{var-logging-logAnalyticsWorkspaceResourceId}}~$(var-logging-logAnalyticsWorkspaceResourceId)~g' ${{ policy }}.parameters.json
-        sed -i 's~{{var-logging-logAnalyticsWorkspaceId}}~$(var-logging-logAnalyticsWorkspaceId)~g' ${{ policy }}.parameters.json
-        sed -i 's~{{var-logging-logAnalyticsResourceGroupName}}~$(var-logging-logAnalyticsResourceGroupName)~g' ${{ policy }}.parameters.json
-        sed -i 's~{{var-logging-logAnalyticsRetentionInDays}}~$(var-logging-logAnalyticsRetentionInDays)~g' ${{ policy }}.parameters.json
+        cp ${{ policy }}.parameters.json ${{ policy }}.populated.parameters.json
+
+        sed -i 's~{{var-topLevelManagementGroupName}}~$(var-topLevelManagementGroupName)~g' ${{ policy }}.populated.parameters.json
+
+        sed -i 's~{{var-logging-logAnalyticsWorkspaceResourceId}}~$(var-logging-logAnalyticsWorkspaceResourceId)~g' ${{ policy }}.populated.parameters.json
+        sed -i 's~{{var-logging-logAnalyticsWorkspaceId}}~$(var-logging-logAnalyticsWorkspaceId)~g' ${{ policy }}.populated.parameters.json
+        sed -i 's~{{var-logging-logAnalyticsResourceGroupName}}~$(var-logging-logAnalyticsResourceGroupName)~g' ${{ policy }}.populated.parameters.json
+        sed -i 's~{{var-logging-logAnalyticsRetentionInDays}}~$(var-logging-logAnalyticsRetentionInDays)~g' ${{ policy }}.populated.parameters.json
 
-        sed -i 's~{{var-logging-diagnosticSettingsforNetworkSecurityGroupsStoragePrefix}}~$(var-logging-diagnosticSettingsforNetworkSecurityGroupsStoragePrefix)~g' ${{ policy }}.parameters.json
+        sed -i 's~{{var-logging-diagnosticSettingsforNetworkSecurityGroupsStoragePrefix}}~$(var-logging-diagnosticSettingsforNetworkSecurityGroupsStoragePrefix)~g' ${{ policy }}.populated.parameters.json
+
+        sed -i 's~{{var-policyAssignmentManagementGroupId}}~${{ parameters.policyAssignmentManagementGroupScope }}~g' ${{ policy }}.populated.parameters.json
 
-        cat ${{ policy }}.parameters.json ; echo
+        cat ${{ policy }}.populated.parameters.json ; echo
 
-        echo "Deploying ${{ policy }}.bicep using ${{ parameters.deployOperation}} operation..."
+        echo "Deploying ${{ policy }}.bicep using ${{ parameters.deployOperation}} operation at ${{ parameters.policyAssignmentManagementGroupScope }} scope ..."
 
         az deployment mg ${{ parameters.deployOperation }} \
           --location $(deploymentRegion) \
-          --management-group-id $(var-topLevelManagementGroupName) \
+          --management-group-id ${{ parameters.policyAssignmentManagementGroupScope }} \
           --template-file ${{ policy }}.bicep \
-          --parameters ${{ policy }}.parameters.json
+          --parameters ${{ policy }}.populated.parameters.json
 
         $(var-bashPostInjectScript)
       workingDirectory: ${{ parameters.workingDir }}

docs/policy/authoring-guide.md

@@ -284,7 +284,7 @@ The built-in policy sets are used as-is to ensure future improvements from Azure
         "contentVersion": "1.0.0.0",
         "parameters": {
             "policyAssignmentManagementGroupId": {
-                "value": "{{var-topLevelManagementGroupName}}"
+                "value": "{{var-policyAssignmentManagementGroupId}}"
             },
             "enforcementMode": {
                 "value": "Default"
@@ -307,7 +307,7 @@ The built-in policy sets are used as-is to ensure future improvements from Azure
         "contentVersion": "1.0.0.0",
         "parameters": {
             "policyAssignmentManagementGroupId": {
-                "value": "{{var-topLevelManagementGroupName}}"
+                "value": "{{var-policyAssignmentManagementGroupId}}"
             },
             "enforcementMode": {
                 "value": "Default"
@@ -827,7 +827,7 @@ When there are deployment errors:
               "value": "{{var-topLevelManagementGroupName}}"
           },
           "policyAssignmentManagementGroupId": {
-              "value": "{{var-topLevelManagementGroupName}}"
+              "value": "{{var-policyAssignmentManagementGroupId}}"
           },
           "enforcementMode": {
               "value": "Default"
@@ -853,7 +853,7 @@ When there are deployment errors:
                 "value": "{{var-topLevelManagementGroupName}}"
             },
             "policyAssignmentManagementGroupId": {
-                "value": "{{var-topLevelManagementGroupName}}"
+                "value": "{{var-policyAssignmentManagementGroupId}}"
             },
             "enforcementMode": {
                 "value": "Default"

docs/policy/readme.md

@@ -41,6 +41,7 @@ Azure DevOps Pipeline ([.pipelines/policy.yml](../../.pipelines/policy.yml)) is
         description: 'Assign Policy Set'
         deployTemplates: [asb, cis-msft-130, location, nist80053r4, nist80053r5, pbmm, hitrust-hipaa, fedramp-moderate]
         deployOperation: ${{ variables['deployOperation'] }}
+        policyAssignmentManagementGroupScope: $(var-topLevelManagementGroupName)
         workingDir: $(System.DefaultWorkingDirectory)/policy/builtin/assignments
 ```
 
@@ -101,6 +102,7 @@ Azure DevOps Pipeline ([.pipelines/policy.yml](../../.pipelines/policy.yml)) is
         description: 'Define Policy Set'
         deployTemplates: [AKS, DefenderForCloud, LogAnalytics, Network, DNSPrivateEndpoints, Tags]
         deployOperation: ${{ variables['deployOperation'] }}
+        policyAssignmentManagementGroupScope: $(var-topLevelManagementGroupName)
         workingDir: $(System.DefaultWorkingDirectory)/policy/custom/definitions/policyset
 ```
 
@@ -130,6 +132,7 @@ Azure DevOps Pipeline ([.pipelines/policy.yml](../../.pipelines/policy.yml)) is
         description: 'Assign Policy Set'
         deployTemplates: [AKS, DefenderForCloud, LogAnalytics, Network, Tags]
         deployOperation: ${{ variables['deployOperation'] }}
+        policyAssignmentManagementGroupScope: $(var-topLevelManagementGroupName)
         workingDir: $(System.DefaultWorkingDirectory)/policy/custom/assignments
 ```
 
@@ -157,6 +160,7 @@ Parameters can be templated using the syntax `{{PARAMETER_NAME}}`.  Following pa
 | {{var-logging-logAnalyticsResourceGroupName}} | Environment configuration file such as [config/variables/CanadaESLZ-main.yml](../../config/variables/CanadaESLZ-main.yml)  | `pubsec-central-logging-rg`
 | {{var-logging-logAnalyticsRetentionInDays}} | Environment configuration file such as [config/variables/CanadaESLZ-main.yml](../../config/variables/CanadaESLZ-main.yml) | `730`
 | {{var-logging-diagnosticSettingsforNetworkSecurityGroupsStoragePrefix}} | Environment configuration file such as [config/variables/CanadaESLZ-main.yml](../../config/variables/CanadaESLZ-main.yml)  | `pubsecnsg`
+| {{var-policyAssignmentManagementGroupId}} | The management group scope for policy assignment. | `pubsec`
 
 ---
 

policy/builtin/assignments/asb.parameters.json

@@ -3,7 +3,7 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/builtin/assignments/cis-msft-130.parameters.json

@@ -3,7 +3,7 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/builtin/assignments/fedramp-moderate.parameters.json

@@ -3,7 +3,7 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/builtin/assignments/hitrust-hipaa.parameters.json

@@ -3,7 +3,7 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/builtin/assignments/location.parameters.json

@@ -3,7 +3,7 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/builtin/assignments/nist80053r4.parameters.json

@@ -3,7 +3,7 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/builtin/assignments/nist80053r5.parameters.json

@@ -3,7 +3,7 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/builtin/assignments/pbmm.parameters.json

@@ -3,7 +3,7 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/custom/assignments/AKS.parameters.json

@@ -6,7 +6,7 @@
             "value": "{{var-topLevelManagementGroupName}}"
         },
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/custom/assignments/DDoS.parameters.json

@@ -6,7 +6,7 @@
             "value": "{{var-topLevelManagementGroupName}}"
         },
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/custom/assignments/DNSPrivateEndpoints.parameters.json

@@ -6,7 +6,7 @@
             "value": "{{var-topLevelManagementGroupName}}"
         },
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/custom/assignments/DefenderForCloud.parameters.json

@@ -6,7 +6,7 @@
             "value": "{{var-topLevelManagementGroupName}}"
         },
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/custom/assignments/LogAnalytics.parameters.json

@@ -6,7 +6,7 @@
             "value": "{{var-topLevelManagementGroupName}}"
         },
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/custom/assignments/Network.parameters.json

@@ -6,7 +6,7 @@
             "value": "{{var-topLevelManagementGroupName}}"
         },
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"

policy/custom/assignments/Tags.parameters.json

@@ -6,7 +6,7 @@
             "value": "{{var-topLevelManagementGroupName}}"
         },
         "policyAssignmentManagementGroupId": {
-            "value": "{{var-topLevelManagementGroupName}}"
+            "value": "{{var-policyAssignmentManagementGroupId}}"
         },
         "enforcementMode": {
             "value": "Default"