Identify the Azure Policy which is linked to a Policy Assignment

Hi Chris Pretorius
I have reached out to you in a private message

Thankyou

Hi Chris Pretorius
One Definition can have many Assignments.
Definition Name: Require a tag on resource groups

Assignment Display Name: Require a tag on resource groups: Workload Name

You are seeing different, because the person who assigned this has given different name in policy assignment.

Please find the below script to export all definitions associated with policy assignment.

 <#
.SYNOPSIS
    This script retrieves non-compliant resources from all Azure subscriptions.
.DESCRIPTION
    - Connects to Azure using Connect-AzAccount.
    - Retrieves a list of all Azure subscriptions.
    - Iterates through each subscription to fetch non-compliant resources.
    - Fetches associated policy details, including Policy Definition Name and Initiative Display Name.
    - Outputs results in a sorted format.
    - Saves the compliance report to a CSV file.
.NOTES
    - Requires Az PowerShell Module.
    - User must have appropriate permissions to retrieve policy compliance data.
#>
# Login with Connect-AzAccount if not using Cloud Shell
Connect-AzAccount
# Initialize an empty array for storing non-compliant resources
$vmArray = @()
# Get all Azure subscriptions
$azureSubscriptions = Get-AzSubscription
# Loop through each subscription
foreach ($subscription in $azureSubscriptions) {
    # Set the Azure context to the current subscription
    Set-AzContext -SubscriptionId $subscription.Id
    # Get non-compliant resources for the current subscription
    $nonCompliantResources = Get-AzPolicyState | Where-Object { $_.ComplianceState -eq "NonCompliant" }
    # Output the count of non-compliant resources for the current subscription
    Write-Host "Subscription: $($subscription.Name) - Non-Compliant Resources: $($nonCompliantResources.Count)"
    # Retrieve and process non-compliant resources
    foreach ($resource in $nonCompliantResources) {
        $resourceName = $resource.resourceId.Split('/')[-1]
        $resourceType = $resource.resourceType
        $complianceState = $resource.complianceState
        $resourceGroup = $resource.resourceGroup
        $resourceLocation = $resource.resourceLocation
        $policyDefinitionName = $resource.PolicyDefinitionReferenceId
        $PolicyAssignmentName = $resource.PolicyAssignmentName
        $InitiativeId = $resource.PolicySetDefinitionId  # Get Initiative ID
        $InitiativeName = $resource.PolicySetDefinitionName  # Short Initiative Name
        # Retrieve Initiative Display Name
        $InitiativeDisplayName = $null
        if ($InitiativeId) {
            $initiativeDetails = Get-AzPolicySetDefinition -Id $InitiativeId -ErrorAction SilentlyContinue
            if ($initiativeDetails) {
                $InitiativeDisplayName = $initiativeDetails.Properties.DisplayName
            }
        }
        # Store resource details in an object
        $vmArray += New-Object PSObject -Property @{
            PolicyDefinitionName  = $policyDefinitionName
            InitiativeDisplayName = $InitiativeDisplayName  # Adding the Display Name
            ComplianceState       = $complianceState
            SubscriptionName      = $subscription.Name
            ResourceGroup         = $resourceGroup
            ResourceName          = $resourceName
            ResourceType          = $resourceType
            ResourceLocation      = $resourceLocation
        }
    }
}
# Sort and Export the results to a CSV file
$vmArray | Sort-Object PolicyDefinitionName, InitiativeDisplayName, ComplianceState, SubscriptionName, ResourceGroup, ResourceName, ResourceType, ResourceLocation | Export-CSV -Path ".\compliance.csv" -NoTypeInformation
Write-Host "Compliance report exported to compliance.csv"

 Please find the Output.

Yes, there is a 1:1 relationship between an assignment and a definition reference, but one definition can be assigned many times with different parameters.

Please let me know if you face any challenge here, I can help you to resolve this issue further

If the comment was helpful, please click "Upvote"

Hi Naveena, thank you for providing the code.

I've successfully run it and, looking at the generated csv file data, it displays Subscription-level information. Are you able to advise what I need to change to have this run at Management level? All the policies are assigned at MG level, so would need to set the scope here.

Regards,

Chris

Hello Chris Pretorius
Just want to check if the above Comment worked for you or else please let us know if any help, we are always here to help whenever you need us.

If the comment is helpful, please click "Upvote it"

Thankyou

Hello Chris Pretorius
Have you had a chance to work on the script mentioned above?