Policy deployment to Subscription rather than Management Group

[awoodsimpson]

Could someone assist with the changes I need to make to policies.bicep?

I've deployed to subscription with this:

targetScope = 'subscription'

@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' })
/@description('Provide a prefix (max 10 characters, unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"')
@maxlength(10)
param topLevelManagementGroupPrefix string = 'alz'/
param subscriptionId string = '---****-***'

@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"')
param location string = deployment().location

@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'')
param scope string = subscriptionResourceId('/subscriptions', subscriptionId)

// Extract the environment name to dynamically determine which policies to deploy.
var cloudEnv = environment().name

// Default deployment locations used in templates
var defaultDeploymentLocationByCloudType = {
AzureCloud: 'uksouth'
AzureChinaCloud: 'chinaeast2'
AzureUSGovernment: 'usgovvirginia'
}

// Used to identify template variables used in the templates for replacement.
var templateVars = {
scope: '/subscriptions/---****-***/providers'

But to me it's not changing the definition Id's in the policysetdefinitions

New-AzSubscriptionDeployment : 16:00:06 - The deployment 'deploy' failed with error(s). Showing 1 out of 1 error(s).
Status Message: The policy set definition 'Deploy-Diagnostics-LogAnalytics' request is invalid. Policy definitions should be specified
only at or above the policy set definition's scope. The following policy definitions are invalid: 'Deploy-Diagnostics-AVDScalingPlans,De
ploy-Diagnostics-WVDAppGroup,Deploy-Diagnostics-WVDWorkspace,Deploy-Diagnostics-WVDHostPools,Deploy-Diagnostics-ACI,Deploy-Diagnostics-A

Could some one help please?

[jtracey93]

Hey these are designed to be deployed to a management group scope only. As per our ALZ/ESLZ guidance.

You will need to amend the policy definition IDs of the initiatives which are also deployed via the policies.bicep file.

We would highly suggest just deploying to management group scope or checking out the ALZ Bicep repo https://aka.ms/alz/bicep

[awoodsimpson]

Thanks @jtracey93, I totally agree. I've just got a requirement for them to be targeted at the subscription scope so each subscription can have it's logs directed at individual log analytics workspaces.

Not to worry though, I will keep having a go at this.