Policy assignment where Management Group structure by product team

[a8ree]

We have a Management Group structure that looks like this

Our policies differ by environment and ideally we'd like to be able to include a subscription in the assignment scope using its name
i.e. Dev gets dev policies

I can't see anything in EPAC that allows a wildcard to be used in scoping assignments

I'm thinking that I will need to script the a replacement of assignment scope outside EPAC - unless there is a feature I'm missing?

[bonardi]

Hello,

I'm not sure, but maybe it could be useful to target the Root at GlobalSettings level and then in the assignment inside the Scope target the different MGT levels that are DEV.

The result would be that you would have 1 Assignment file for each environment.

• Assginment-DEV.json: Scope; finance-dev and Platform-Dev
• Assignment-PRO.json: Scope; finance-PRO and Platform-PRO

An alternative would be that in the policies you would manage it by the environment tag to know if that policy is applied or not.

[mclgoerg]

@a8ree We’re encountering a similar setup and facing the same issue. Did you find a workaround or solution for your situation?

@bonardi Are you referring to having multiple assignment files or multiple policy set definitions for different stages?
I’m uncertain how to configure the global settings in this scenario. Previously, my “deploymentRootScope” was the root management group. However, if there’s only one set definition at the root level and multiple assignments for each stage, the deployment fails because it can’t remove the assignments from other stages.