Policy Definitions - Get Built In

Service:: Policy

API Version:: 2025-11-01

This operation retrieves the built-in policy definition with the given name.

GET https://management.azure.com/providers/Microsoft.Authorization/policyDefinitions/{policyDefinitionName}?api-version=2025-11-01

URI Parameters

Name	In	Required	Type	Description
policyDefinitionName	path	True	string pattern: ^[^<>%&:\?.+/][^<>*%&:\?.+/ ]+$	The name of the built-in policy definition to get.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Responses

Name	Type	Description
200 OK	PolicyDefinition	Azure operation completed successfully.
Other Status Codes	ErrorResponse	An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Retrieve a built-in policy definition

Sample request

HTTP

GET https://management.azure.com/providers/Microsoft.Authorization/policyDefinitions/7433c107-6db4-4ad1-b57a-a76dce0154a1?api-version=2025-11-01

Sample response

Status code:: 200

{
  "name": "7433c107-6db4-4ad1-b57a-a76dce0154a1",
  "type": "Microsoft.Authorization/policyDefinitions",
  "id": "/providers/Microsoft.Authorization/policyDefinitions/7433c107-6db4-4ad1-b57a-a76dce0154a1",
  "properties": {
    "description": "This policy enables you to specify a set of storage account SKUs that your organization can deploy.",
    "displayName": "Allowed storage account SKUs",
    "mode": "All",
    "parameters": {
      "listOfAllowedSKUs": {
        "type": "Array",
        "metadata": {
          "description": "The list of SKUs that can be specified for storage accounts.",
          "displayName": "Allowed SKUs",
          "strongType": "StorageSKUs"
        }
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "equals": "Microsoft.Storage/storageAccounts",
            "field": "type"
          },
          {
            "not": {
              "field": "Microsoft.Storage/storageAccounts/sku.name",
              "in": "[parameters('listOfAllowedSKUs')]"
            }
          }
        ]
      },
      "then": {
        "effect": "Deny"
      }
    },
    "policyType": "BuiltIn",
    "version": "1.2.1",
    "versions": [
      "1.2.1",
      "1.0.0"
    ]
  }
}

Definitions

Name	Description
createdByType	The type of identity that created the resource.
ErrorAdditionalInfo	The resource management error additional info.
ErrorDetail	The error detail.
ErrorResponse	Error response
ExternalEvaluationEndpointSettings	The settings of an external endpoint providing evaluation results.
ExternalEvaluationEnforcementSettings	The details of the source of external evaluation results required by the policy during enforcement evaluation.
ParameterDefinitionsValue	The definition of a parameter that can be provided to the policy.
ParameterDefinitionsValueMetadata	General metadata for the parameter.
ParameterType	The data type of the parameter.
PolicyDefinition	The policy definition.
PolicyType	The type of policy definition. Possible values are NotSpecified, BuiltIn, Custom, and Static.
systemData	Metadata pertaining to creation and last modification of the resource.

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ErrorDetail

Object

The error detail.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	ErrorDetail[]	The error details.
message	string	The error message.
target	string	The error target.

ErrorResponse

Object

Error response

Name	Type	Description
error	ErrorDetail	The error object.

ExternalEvaluationEndpointSettings

Object

The settings of an external endpoint providing evaluation results.

Name	Type	Description
details		The details of the endpoint.
kind	string	The kind of the endpoint.

ExternalEvaluationEnforcementSettings

Object

The details of the source of external evaluation results required by the policy during enforcement evaluation.

Name	Type	Description
endpointSettings	ExternalEvaluationEndpointSettings	The settings of an external endpoint providing evaluation results.
missingTokenAction	string	What to do when evaluating an enforcement policy that requires an external evaluation and the token is missing. Possible values are Audit and Deny and language expressions are supported.
resultLifespan	string	The lifespan of the endpoint invocation result after which it's no longer valid. Value is expected to follow the ISO 8601 duration format and language expressions are supported.
roleDefinitionIds	string[]	An array of the role definition Ids the assignment's MSI will need in order to invoke the endpoint.

ParameterDefinitionsValue

Object

The definition of a parameter that can be provided to the policy.

Name	Type	Description
allowedValues	AllowedValues[]	The allowed values for the parameter.
defaultValue		The default value for the parameter if no value is provided.
metadata	ParameterDefinitionsValueMetadata	General metadata for the parameter.
schema		Provides validation of parameter inputs during assignment using a self-defined JSON schema. This property is only supported for object-type parameters and follows the Json.NET Schema 2019-09 implementation. You can learn more about using schemas at https://json-schema.org/ and test draft schemas at https://www.jsonschemavalidator.net/.
type	ParameterType	The data type of the parameter.

ParameterDefinitionsValueMetadata

Object

General metadata for the parameter.

Name	Type	Description
assignPermissions	boolean	Set to true to have Azure portal create role assignments on the resource ID or resource scope value of this parameter during policy assignment. This property is useful in case you wish to assign permissions outside the assignment scope.
description	string	The description of the parameter.
displayName	string	The display name for the parameter.
strongType	string	Used when assigning the policy definition through the portal. Provides a context aware list of values for the user to choose from.

ParameterType

Enumeration

The data type of the parameter.

Value	Description
String	The string parameter type.
Array	The array parameter type.
Object	The object parameter type.
Boolean	The boolean parameter type.
Integer	The integer parameter type.
Float	The float parameter type.
DateTime	The date-time parameter type.