{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/",
        "slug": "dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/"
        },
        "title": "Reconcile remediation permissions after changing an Azure Policy definition",
        "summary": "Editing roleDefinitionIds does not automatically update the existing assignment identity's grants.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:26:02+00:00",
        "modified_at": "2026-09-10T02:01:55+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 228,
        "potentially_affected": "Azure Policy assignments using deployIfNotExists or modify remediation.",
        "dse_recommendation": "Compare revised role requirements with actual identity grants before retrying remediation.",
        "primary_source": {
            "name": "Remediate non-compliant resources - Azure Policy | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Azure Policy remediation uses the managed identity associated with the assignment to deploy or modify resources. A policy definition lists required roles in roleDefinitionIds, but changing that definition does not automatically update the assignment or its associated identity.</p>\n<p>The portal can grant required roles when creating the identity. Later edits to roleDefinitionIds still require manually granting the new permissions, even when using the portal. SDK-created assignments and resources accessed outside the assignment scope are additional cases requiring manual permission review. <a href=\"https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Identify the exact assignment, its identity, the revised policy definition and every resource scope involved. Treat a compliance evaluation and the permission to perform remediation as separate observations.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends including an identity-grant comparison in policy-definition change review. Explain each added permission and grant only the necessary scope through the authorized access process. Do not repeatedly rerun remediation or grant broad ownership merely because the updated definition lists a role that the identity does not actually possess.</p>\n<h2>Verification</h2>\n<p>For an approved representative resource, inspect the identity&#8217;s effective assignments and run a bounded remediation. Compare deployment or modification results with the revised requirement. Retain the policy revision, identity identifier, grant scope and outcome together. Verify the intended resource state afterward rather than accepting a successful access change as proof that remediation completed.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Remediate non-compliant resources</a>. Source retrieved September 9, 2026.</p>",
        "content_text": "Source facts\nAzure Policy remediation uses the managed identity associated with the assignment to deploy or modify resources. A policy definition lists required roles in roleDefinitionIds, but changing that definition does not automatically update the assignment or its associated identity.\nThe portal can grant required roles when creating the identity. Later edits to roleDefinitionIds still require manually granting the new permissions, even when using the portal. SDK-created assignments and resources accessed outside the assignment scope are additional cases requiring manual permission review. Microsoft Learn.\nApplicability\nIdentify the exact assignment, its identity, the revised policy definition and every resource scope involved. Treat a compliance evaluation and the permission to perform remediation as separate observations.\nDSE recommendation\nDSE recommends including an identity-grant comparison in policy-definition change review. Explain each added permission and grant only the necessary scope through the authorized access process. Do not repeatedly rerun remediation or grant broad ownership merely because the updated definition lists a role that the identity does not actually possess.\nVerification\nFor an approved representative resource, inspect the identity’s effective assignments and run a bounded remediation. Compare deployment or modification results with the revised requirement. Retain the policy revision, identity identifier, grant scope and outcome together. Verify the intended resource state afterward rather than accepting a successful access change as proof that remediation completed.\nOfficial references\nMicrosoft Learn: Remediate non-compliant resources. Source retrieved September 9, 2026.",
        "content_markdown": "## Source facts\n\nAzure Policy remediation uses the managed identity associated with the assignment to deploy or modify resources. A policy definition lists required roles in roleDefinitionIds, but changing that definition does not automatically update the assignment or its associated identity.\n\nThe portal can grant required roles when creating the identity. Later edits to roleDefinitionIds still require manually granting the new permissions, even when using the portal. SDK-created assignments and resources accessed outside the assignment scope are additional cases requiring manual permission review. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources).\n\n## Applicability\n\nIdentify the exact assignment, its identity, the revised policy definition and every resource scope involved. Treat a compliance evaluation and the permission to perform remediation as separate observations.\n\n## DSE recommendation\n\nDSE recommends including an identity-grant comparison in policy-definition change review. Explain each added permission and grant only the necessary scope through the authorized access process. Do not repeatedly rerun remediation or grant broad ownership merely because the updated definition lists a role that the identity does not actually possess.\n\n## Verification\n\nFor an approved representative resource, inspect the identity’s effective assignments and run a bounded remediation. Compare deployment or modification results with the revised requirement. Retain the policy revision, identity identifier, grant scope and outcome together. Verify the intended resource state afterward rather than accepting a successful access change as proof that remediation completed.\n\n## Official references\n\n[Microsoft Learn: Remediate non-compliant resources](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources). Source retrieved September 9, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Reconcile remediation permissions after changing an Azure Policy definition",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/",
                "headline": "Reconcile remediation permissions after changing an Azure Policy definition",
                "description": "Editing roleDefinitionIds does not automatically update the existing assignment identity's grants.",
                "abstract": "Editing roleDefinitionIds does not automatically update the existing assignment identity's grants.",
                "articleBody": "Source facts\nAzure Policy remediation uses the managed identity associated with the assignment to deploy or modify resources. A policy definition lists required roles in roleDefinitionIds, but changing that definition does not automatically update the assignment or its associated identity.\nThe portal can grant required roles when creating the identity. Later edits to roleDefinitionIds still require manually granting the new permissions, even when using the portal. SDK-created assignments and resources accessed outside the assignment scope are additional cases requiring manual permission review. Microsoft Learn.\nApplicability\nIdentify the exact assignment, its identity, the revised policy definition and every resource scope involved. Treat a compliance evaluation and the permission to perform remediation as separate observations.\nDSE recommendation\nDSE recommends including an identity-grant comparison in policy-definition change review. Explain each added permission and grant only the necessary scope through the authorized access process. Do not repeatedly rerun remediation or grant broad ownership merely because the updated definition lists a role that the identity does not actually possess.\nVerification\nFor an approved representative resource, inspect the identity’s effective assignments and run a bounded remediation. Compare deployment or modification results with the revised requirement. Retain the policy revision, identity identifier, grant scope and outcome together. Verify the intended resource state afterward rather than accepting a successful access change as proof that remediation completed.\nOfficial references\nMicrosoft Learn: Remediate non-compliant resources. Source retrieved September 9, 2026.",
                "datePublished": "2026-09-10T00:26:02+00:00",
                "dateModified": "2026-09-10T02:01:55+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Reconcile remediation permissions after changing an Azure Policy definition"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 228,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Remediate non-compliant resources - Azure Policy | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources"
                }
            }
        ]
    }
}