Azure Policy Example - full example using resource ID's passed as parameters to New-AzureRmPolicyAssignment cmdlet

AzurePolicyExample2.ps1

# Example script to using the -scope and notscope parameters for the New-AzureRmPolicyAssignment cmdlet
# script applies a policy subscription wide but also excludes specific resource groups

# Login to Azure
Connect-AzureRmAccount

# Get the subscription to assign the policy to
$subscription = Get-AzureRmSubscription -SubscriptionName "subscriptioname"
Write-Host $subscription.Id

# Create the subscription scope string in the format required
$scope = "/subscriptions/" + $subscription.id
Write-Host $scope

# Specify the resource groups to exclude 
$excludedrg1 = Get-AzureRmResourceGroup -Name "resourcegroupname1"
$excludedrg2 = Get-AzureRmResourceGroup -Name "resourcegroupname2"
# Create an array with the resource groups id's to exclude
$notScope = @($excludedrg1.ResourceId,$excludedrg2.ResourceId)

# Get the Azure Policy definition to apply
$definition = Get-AzureRmPolicyDefinition | Where-Object { $_.Properties.DisplayName -eq 'Audit secure transfer to storage accounts' }

# Assign the policy definition
New-AzureRmPolicyAssignment -Name "Audit secure transfer to storage accounts" -DisplayName "Audit secure transfer to storage accounts" -Effect "Audit" -Scope $scope -NotScope $notScope -PolicyDefinition $definition