Azure Policy definitions and initiatives are created at either a subscription or management-group location. That location constrains where they can be assigned: a subscription-level definition can serve only resources within that subscription. A management-group definition can serve its descendant management groups and subscriptions. Microsoft directs authors planning assignments across several subscriptions to place the definition at a management group containing all of them. Microsoft Learn.
\nUse this design check before creating a shared custom definition. Its storage location and a later assignment’s scope are separate choices; begin with the subscriptions that actually need the definition instead of selecting whichever subscription happens to be active in the portal.
\nMap intended assignment subscriptions to their hierarchy before selecting the definition’s storage location. Ask the governance owner to identify the common containing management group when multiple subscriptions must consume it. Keep intended reuse distinct from broad enforcement: making a definition available to descendants is not an instruction to assign it everywhere. Record the chosen location with the definition owner and expected consumers.
\nInspect the created definition’s resource identifier and compare its location with the planned hierarchy. During an approved nonproduction rollout, confirm that intended assignment scopes can reference that definition. Investigate an unavailable sibling scope as a placement issue before copying the definition into several independently maintained versions. Revisit the mapping when subscriptions are reorganized, and preserve any unresolved scope mismatch in the deployment review.
\nMicrosoft Learn: Azure Policy definition structure and location. Source reviewed September 9, 2026.
", "content_text": "Source facts\nAzure Policy definitions and initiatives are created at either a subscription or management-group location. That location constrains where they can be assigned: a subscription-level definition can serve only resources within that subscription. A management-group definition can serve its descendant management groups and subscriptions. Microsoft directs authors planning assignments across several subscriptions to place the definition at a management group containing all of them. Microsoft Learn.\nApplicability\nUse this design check before creating a shared custom definition. Its storage location and a later assignment’s scope are separate choices; begin with the subscriptions that actually need the definition instead of selecting whichever subscription happens to be active in the portal.\nDSE recommendation\nMap intended assignment subscriptions to their hierarchy before selecting the definition’s storage location. Ask the governance owner to identify the common containing management group when multiple subscriptions must consume it. Keep intended reuse distinct from broad enforcement: making a definition available to descendants is not an instruction to assign it everywhere. Record the chosen location with the definition owner and expected consumers.\nVerification\nInspect the created definition’s resource identifier and compare its location with the planned hierarchy. During an approved nonproduction rollout, confirm that intended assignment scopes can reference that definition. Investigate an unavailable sibling scope as a placement issue before copying the definition into several independently maintained versions. Revisit the mapping when subscriptions are reorganized, and preserve any unresolved scope mismatch in the deployment review.\nOfficial references\nMicrosoft Learn: Azure Policy definition structure and location. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Policy definitions and initiatives are created at either a subscription or management-group location. That location constrains where they can be assigned: a subscription-level definition can serve only resources within that subscription. A management-group definition can serve its descendant management groups and subscriptions. Microsoft directs authors planning assignments across several subscriptions to place the definition at a management group containing all of them. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-basics).\n\n## Applicability\n\nUse this design check before creating a shared custom definition. Its storage location and a later assignment’s scope are separate choices; begin with the subscriptions that actually need the definition instead of selecting whichever subscription happens to be active in the portal.\n\n## DSE recommendation\n\nMap intended assignment subscriptions to their hierarchy before selecting the definition’s storage location. Ask the governance owner to identify the common containing management group when multiple subscriptions must consume it. Keep intended reuse distinct from broad enforcement: making a definition available to descendants is not an instruction to assign it everywhere. Record the chosen location with the definition owner and expected consumers.\n\n## Verification\n\nInspect the created definition’s resource identifier and compare its location with the planned hierarchy. During an approved nonproduction rollout, confirm that intended assignment scopes can reference that definition. Investigate an unavailable sibling scope as a placement issue before copying the definition into several independently maintained versions. Revisit the mapping when subscriptions are reorganized, and preserve any unresolved scope mismatch in the deployment review.\n\n## Official references\n\n[Microsoft Learn: Azure Policy definition structure and location](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-basics). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-528-locate-a-custom-policy-definition-where-its-intended-subscriptions-can-use-it/", "url": "https://update.dsesecurity.com/updates/dse-20260909-528-locate-a-custom-policy-definition-where-its-intended-subscriptions-can-use-it/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-528-locate-a-custom-policy-definition-where-its-intended-subscriptions-can-use-it/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Locate a custom policy definition where its intended subscriptions can use it", "item": "https://update.dsesecurity.com/updates/dse-20260909-528-locate-a-custom-policy-definition-where-its-intended-subscriptions-can-use-it/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-528-locate-a-custom-policy-definition-where-its-intended-subscriptions-can-use-it/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-528-locate-a-custom-policy-definition-where-its-intended-subscriptions-can-use-it/", "url": "https://update.dsesecurity.com/updates/dse-20260909-528-locate-a-custom-policy-definition-where-its-intended-subscriptions-can-use-it/", "headline": "Locate a custom policy definition where its intended subscriptions can use it", "description": "Can a policy definition stored in one subscription be assigned to resources in a sibling subscription?", "abstract": "Can a policy definition stored in one subscription be assigned to resources in a sibling subscription?", "articleBody": "Source facts\nAzure Policy definitions and initiatives are created at either a subscription or management-group location. That location constrains where they can be assigned: a subscription-level definition can serve only resources within that subscription. A management-group definition can serve its descendant management groups and subscriptions. Microsoft directs authors planning assignments across several subscriptions to place the definition at a management group containing all of them. Microsoft Learn.\nApplicability\nUse this design check before creating a shared custom definition. Its storage location and a later assignment’s scope are separate choices; begin with the subscriptions that actually need the definition instead of selecting whichever subscription happens to be active in the portal.\nDSE recommendation\nMap intended assignment subscriptions to their hierarchy before selecting the definition’s storage location. Ask the governance owner to identify the common containing management group when multiple subscriptions must consume it. Keep intended reuse distinct from broad enforcement: making a definition available to descendants is not an instruction to assign it everywhere. Record the chosen location with the definition owner and expected consumers.\nVerification\nInspect the created definition’s resource identifier and compare its location with the planned hierarchy. During an approved nonproduction rollout, confirm that intended assignment scopes can reference that definition. Investigate an unavailable sibling scope as a placement issue before copying the definition into several independently maintained versions. Revisit the mapping when subscriptions are reorganized, and preserve any unresolved scope mismatch in the deployment review.\nOfficial references\nMicrosoft Learn: Azure Policy definition structure and location. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:23:08+00:00", "dateModified": "2026-09-10T02:11:18+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-528-locate-a-custom-policy-definition-where-its-intended-subscriptions-can-use-it/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-528-locate-a-custom-policy-definition-where-its-intended-subscriptions-can-use-it/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Locate a custom policy definition where its intended subscriptions can use it" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 251, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Details of Azure Policy definition structure basics - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-basics" } } ] } }