Azure / Azure/azure-cli

Can't pass list of policy definition IDs into 'az policy exemption create' command

Open
#21,158 3 comments 0 reactions 1 assignee Claimed by @zhoxing-ms View on GitHub
feature-request Policy
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Describe the bug**
You can't seem to (or it's not clear how to) provide a list of policy definition IDs using the `--policy-definition-reference-ids parameter` for the `az policy exemption create` command.

**To Reproduce**

1. Assign the `NIST SP 800-53 Rev. 5` policy initiative to a management group
2. Run the below command, substituting your own values for policy assignment ID, scope, etc

NOTE: I've used commas as a delimiter in this example, but I've also tried spaces and semi-colons

```
az policy exemption create \
-n "testExemption" \
--display-name "test exemption" \
--policy-assignment "/providers/Microsoft.Management/managementGroups//providers/Microsoft.Authorization/policyAssignments/" \
--policy-definition-reference-ids "4ec52d6d-beb7-40c4-9a9e-fe753254690e,702dd420-7fcc-42c5-afe8-4026edd20fe0,0a370ff3-6cab-4e85-8995-295fd854c5b8,6fac406b-40ca-413b-bf8e-0bf964659c25" \
--exemption-category "mitigated" \
--scope "/providers/Microsoft.Management/managementGroups/" \
--description "test"
```

observe the following error message:
```
(InvalidPolicyDefinitionReference) The policy exemption 'testExemption' create request is invalid. The specified policy definition reference id '4ec52d6d-beb7-40c4-9a9e-fe753254690e,702dd420-7fcc-42c5-afe8-4026edd20fe0,0a370ff3-6cab-4e85-8995-295fd854c5b8,6fac406b-40ca-413b-bf8e-0bf964659c25' is invalid.
```

**Expected behavior**

The policy exemption would be created against the list of provided policy definition IDs for the policy set assignment.

If this is possible and not a bug, the [docs](https://docs.microsoft.com/en-us/cli/azure/policy/exemption?view=azure-cli-latest#az-policy-exemption-create) should make it clear what the format of the parameter should be. e.g. space-delimited, comma-delimited, etc.

The REST API takes a list, so I would expect this to as well: https://docs.microsoft.com/en-us/rest/api/policy/policy-exemptions/create-or-update#request-body

**Environment summary**

Mac, but happens on Linux as well:
```
azure-cli 2.27.2 *

core 2.27.2 *
telemetry 1.0.6

Python location '/usr/local/Cellar/azure-cli/2.27.2/libexec/bin/python'
Extensions directory '/Users/timw/.azure/cliextensions'

Python (Darwin) 3.9.6 (default, Jun 29 2021, 05:25:02)
[Clang 12.0.5 (clang-1205.0.22.9)]
```

**Additional context**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.