{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/", "slug": "dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition", "url": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/" }, "title": "Filter Azure Policy results by both assignment and definition", "summary": "Avoid mixing compliance results from different uses of the same policy definition.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:18+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 205, "potentially_affected": "Apply this review to a compliance report intended to describe one particular assignment. Identify the definition, assignment and target scope before choosing the query filter. Keep reports spanning several assignments clearly labeled as such rather than presenting their combined results as one assignment's state.", "dse_recommendation": "DSE recommends recording the assignment identifier in the report specification and retaining it in exported results.", "primary_source": { "name": "Get policy compliance data - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft explains that a single policy definition can be used in multiple policy or initiative assignments with different scopes. Its compliance-query example therefore filters by both PolicyAssignmentId and PolicyDefinitionId to identify the intended results explicitly. Microsoft Learn.

\n

Applicability

\n

Apply this review to a compliance report intended to describe one particular assignment. Identify the definition, assignment and target scope before choosing the query filter. Keep reports spanning several assignments clearly labeled as such rather than presenting their combined results as one assignment’s state.

\n

DSE recommendation

\n

DSE recommends recording the assignment identifier in the report specification and retaining it in exported results. Have the policy owner compare the query with the actual assignment intended by the audience. Include a test case where the same definition appears in another scope, so an incomplete filter can be detected before the report is relied on.

\n

Verification

\n

Run the proposed query against the approved scope and confirm that returned records carry the expected assignment and definition identifiers. Compare it with a deliberately broader definition-only query to identify records that should be excluded. Preserve the query, scope and retrieval time with the report. Recheck the filter when assignments are replaced or reorganized.

\n

Official references

\n

Microsoft Learn: Get policy compliance data.

", "content_text": "Source facts\nMicrosoft explains that a single policy definition can be used in multiple policy or initiative assignments with different scopes. Its compliance-query example therefore filters by both PolicyAssignmentId and PolicyDefinitionId to identify the intended results explicitly. Microsoft Learn.\nApplicability\nApply this review to a compliance report intended to describe one particular assignment. Identify the definition, assignment and target scope before choosing the query filter. Keep reports spanning several assignments clearly labeled as such rather than presenting their combined results as one assignment’s state.\nDSE recommendation\nDSE recommends recording the assignment identifier in the report specification and retaining it in exported results. Have the policy owner compare the query with the actual assignment intended by the audience. Include a test case where the same definition appears in another scope, so an incomplete filter can be detected before the report is relied on.\nVerification\nRun the proposed query against the approved scope and confirm that returned records carry the expected assignment and definition identifiers. Compare it with a deliberately broader definition-only query to identify records that should be excluded. Preserve the query, scope and retrieval time with the report. Recheck the filter when assignments are replaced or reorganized.\nOfficial references\nMicrosoft Learn: Get policy compliance data.", "content_markdown": "## Source facts\n\nMicrosoft explains that a single policy definition can be used in multiple policy or initiative assignments with different scopes. Its compliance-query example therefore filters by both PolicyAssignmentId and PolicyDefinitionId to identify the intended results explicitly. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data).\n\n## Applicability\n\nApply this review to a compliance report intended to describe one particular assignment. Identify the definition, assignment and target scope before choosing the query filter. Keep reports spanning several assignments clearly labeled as such rather than presenting their combined results as one assignment’s state.\n\n## DSE recommendation\n\nDSE recommends recording the assignment identifier in the report specification and retaining it in exported results. Have the policy owner compare the query with the actual assignment intended by the audience. Include a test case where the same definition appears in another scope, so an incomplete filter can be detected before the report is relied on.\n\n## Verification\n\nRun the proposed query against the approved scope and confirm that returned records carry the expected assignment and definition identifiers. Compare it with a deliberately broader definition-only query to identify records that should be excluded. Preserve the query, scope and retrieval time with the report. Recheck the filter when assignments are replaced or reorganized.\n\n## Official references\n\n[Microsoft Learn: Get policy compliance data](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/", "url": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Filter Azure Policy results by both assignment and definition", "item": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/", "url": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/", "headline": "Filter Azure Policy results by both assignment and definition", "description": "Avoid mixing compliance results from different uses of the same policy definition.", "abstract": "Avoid mixing compliance results from different uses of the same policy definition.", "articleBody": "Source facts\nMicrosoft explains that a single policy definition can be used in multiple policy or initiative assignments with different scopes. Its compliance-query example therefore filters by both PolicyAssignmentId and PolicyDefinitionId to identify the intended results explicitly. Microsoft Learn.\nApplicability\nApply this review to a compliance report intended to describe one particular assignment. Identify the definition, assignment and target scope before choosing the query filter. Keep reports spanning several assignments clearly labeled as such rather than presenting their combined results as one assignment’s state.\nDSE recommendation\nDSE recommends recording the assignment identifier in the report specification and retaining it in exported results. Have the policy owner compare the query with the actual assignment intended by the audience. Include a test case where the same definition appears in another scope, so an incomplete filter can be detected before the report is relied on.\nVerification\nRun the proposed query against the approved scope and confirm that returned records carry the expected assignment and definition identifiers. Compare it with a deliberately broader definition-only query to identify records that should be excluded. Preserve the query, scope and retrieval time with the report. Recheck the filter when assignments are replaced or reorganized.\nOfficial references\nMicrosoft Learn: Get policy compliance data.", "datePublished": "2026-09-17T16:33:18+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Filter Azure Policy results by both assignment and definition" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 205, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Get policy compliance data - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data" } } ] } }