rage.fail

azure-mg-policy-assignment-artifact

explicit azure emits HasPolicy

match (record)

{ "field": "properties.scope == managementGroup", "resource_type": "Microsoft.Authorization/policyAssignments" }

emit

source type	`*`
target type	`Policy`
source	`<management group node>`
target	`<Azure Policy assignment Policy node (OrganizationPolicy subtype)>`

Narrative

{mg.name} has Azure Policy assignment {policy.name} (inherits to the subtree).

Raw rule rules/explicit/azure-mgmtgroups.yaml

id: azure-mg-policy-assignment-artifact
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.Authorization/policyAssignments
  field: properties.scope == managementGroup
emit:
  source_type: '*'
  target_type: Policy
  source: <management group node>
  target: <Azure Policy assignment Policy node (OrganizationPolicy subtype)>
  api_source: Microsoft.Authorization/policyAssignments list at MG scope
  evidence_field: properties.policyDefinitionId
  note: Inherits down the whole subtree; owners of descendants cannot bypass it. A deny-effect assignment
    suppresses the create/write actions it denies -> those edges BLOCKED. Feeds derived azure-mg-modify-policy-guardrail
    + hierarchy-chains guardrail-removal-upgrades-blocked.
  narrative: '{mg.name} has Azure Policy assignment {policy.name} (inherits to the subtree).'