Skip to content

Commit 20978d4

Browse files
Enhance exemption structure documentation with resource selectors
Added details about supported resource selectors in policy exemptions.
1 parent b8f7930 commit 20978d4

1 file changed

Lines changed: 9 additions & 1 deletion

File tree

articles/governance/policy/concepts/exemption-structure.md

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,15 @@ Exemptions support an optional property `resourceSelectors` that works the same
118118
}
119119
```
120120

121-
Regions can be added or removed from the `resourceLocation` list in the example. Resource selectors allow for greater flexibility of where and how exemptions can be created and managed.
121+
The follow resource selectors `kinds` are supported in the policy exemptions object:
122+
- resourceLocation: This property is used to select resources based on their type. Can't be used in the same resource selector as resourceWithoutLocation.
123+
- resourceType: This property is used to select resources based on their type.
124+
- resourceWithoutLocation: This property is used to select resources at the subscription level that don't have a location. Currently only supports subscriptionLevelResources. Can't be used in the same resource selector as resourceLocation.
125+
- in: The list of allowed values for the specified kind. Can't be used with notIn. Can contain up to 50 values.
126+
- notIn: The list of not-allowed values for the specified kind. Can't be used with in. Can contain up to 50 values.
127+
- userPrincipalId: the list of the allowed user object IDs can be exempt in the request. This can be associated with an individual user, an MSI, or a service principal.
128+
- groupPrincipalId: the list of the allowed security group IDs can be exempt in the request. A resource selector can contain multiple selectors. To be applicable to a resource selector, a resource must meet requirements specified by all its selectors. Further, up to 10 resourceSelectors can be specified in a single assignment. In-scope resources are evaluated when they satisfy any one of these resource selectors.
129+
122130

123131
### Identity based exemptions (preview)
124132

0 commit comments

Comments
 (0)