Filter Azure Policy results by both assignment and definition

Source facts

Microsoft explains that a single policy definition can be used in multiple policy or initiative assignments with different scopes. Its compliance-query example therefore filters by both PolicyAssignmentId and PolicyDefinitionId to identify the intended results explicitly. Microsoft Learn.

Applicability

Apply this review to a compliance report intended to describe one particular assignment. Identify the definition, assignment and target scope before choosing the query filter. Keep reports spanning several assignments clearly labeled as such rather than presenting their combined results as one assignment’s state.

DSE recommendation

DSE recommends recording the assignment identifier in the report specification and retaining it in exported results. Have the policy owner compare the query with the actual assignment intended by the audience. Include a test case where the same definition appears in another scope, so an incomplete filter can be detected before the report is relied on.

Verification

Run the proposed query against the approved scope and confirm that returned records carry the expected assignment and definition identifiers. Compare it with a deliberately broader definition-only query to identify records that should be excluded. Preserve the query, scope and retrieval time with the report. Recheck the filter when assignments are replaced or reorganized.

Official references

Microsoft Learn: Get policy compliance data.