# Filter Azure Policy results by both assignment and definition

> Avoid mixing compliance results from different uses of the same policy definition.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:18+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Avoid mixing compliance results from different uses of the same policy definition.

## Potentially affected

Apply this review to a compliance report intended to describe one particular assignment. Identify the definition, assignment and target scope before choosing the query filter. Keep reports spanning several assignments clearly labeled as such rather than presenting their combined results as one assignment's state.

## DSE recommendation

DSE recommends recording the assignment identifier in the report specification and retaining it in exported results.

## Article

## Source facts

Microsoft explains that a single policy definition can be used in multiple policy or initiative assignments with different scopes. Its compliance-query example therefore filters by both PolicyAssignmentId and PolicyDefinitionId to identify the intended results explicitly. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data).

## Applicability

Apply this review to a compliance report intended to describe one particular assignment. Identify the definition, assignment and target scope before choosing the query filter. Keep reports spanning several assignments clearly labeled as such rather than presenting their combined results as one assignment’s state.

## DSE recommendation

DSE recommends recording the assignment identifier in the report specification and retaining it in exported results. Have the policy owner compare the query with the actual assignment intended by the audience. Include a test case where the same definition appears in another scope, so an incomplete filter can be detected before the report is relied on.

## Verification

Run the proposed query against the approved scope and confirm that returned records carry the expected assignment and definition identifiers. Compare it with a deliberately broader definition-only query to identify records that should be excluded. Preserve the query, scope and retrieval time with the report. Recheck the filter when assignments are replaced or reorganized.

## Official references

[Microsoft Learn: Get policy compliance data](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data).

## Primary reference

- Name: Get policy compliance data - Azure Policy | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/get-compliance-data
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Filter Azure Policy results by both assignment and definition,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-102-filter-azure-policy-results-by-both-assignment-and-definition/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.