PowerShell / REST Microsoft Azure: Get-AzPolicyStateSummary?

Dultus, UserMod Light ByDultus, UserMod Light

Good morning!

I would like to report the current status of policy compliance in a subscription.

So I pull the following data:

 $azState = Get-AzPolicyStateSummary -SubscriptionId $subscriptionId    $exportObject.Compliance.TotalRessources = $azState.Results.ResourceDetails[0].Count + $azState.Results.ResourceDetails[1].Count + $azState.Results.ResourceDetails[2].Count    $exportObject.Compliance.CompliantRessources = $azState.Results.ResourceDetails[0].Count    $exportObject.Compliance.NonCompliantRessources = $azState.Results.ResourceDetails[1].Count    $exportObject.Compliance.Exceptions = $azState.Results.ResourceDetails[2].Count    $exportObject.Compliance.Percentage = [math]::Round((1.0 - $exportObject.Compliance.NonCompliantRessources / ($exportObject.Compliance.CompliantRessources + $exportObject.Compliance.NonCompliantRessources + $exportObject.Compliance.Exceptions)) * 100)

This allows me to successfully obtain the resource compliance in percent, the total number of resources as well as the breakdown of how many are compliant, non-compliant and 'other'.

The problem, however, is that I can't access the non-compliant initiatives and non-compliant policies. The values, no matter how I access them, never seem to match these values. I either get significantly lower or significantly higher values.

Does anyone have any idea how I can filter the data correctly or, for example, get the correct data via the Graph API?

(1 votes)
Loading...

Similar Posts

My newly purchased laptop already has only 92% battery power left. Can I complain?

Bysmurak

Hello, I bought a "Lenovo Ideapad Gaming 3" laptop at Mediamarkt (in Austria) last week. Since they were out of stock, I opted for the display model, which offered a modest 3% discount. I bought it, but at the time I didn't know that the battery had already gone through over 100 charge cycles and…

Subscribe
Notify of
4 Answers
Oldest
Newest Most Voted
Inline Feedbacks
View all comments
TheDoessler623
TheDoessler623
1 year ago

Hi.

Resources from “Get-AzPolicyStateSummary” are listed at the level of policy definitions and initiative level, not at the level of individual resources.

But have no time for more intensive research.

I’d make a point.

foreach ($result in $azState.Results)
{
    if ($result.InitiativeId -ne $null)
    {
        # Compliance für Initiatives
    }
    elseif ($result.PolicyDefinitionName -ne $null)
    {
        # Compliance für Policies
    }
}
0
Dultus, UserMod Light
Author
Dultus, UserMod Light
1 year ago
Reply to  TheDoessler623

I’ve already tried with a filter;

$policyStates = Get-AzPolicyState -SubscriptionId $subscriptionId -Filter "IsCompliant eq false"
$nonCompliantPolicyInitiatives = $policyStates | Where-Object { $_.PolicySetDefinitionId -ne $null } | Select-Object -Unique PolicySetDefinitionId
$nonCompliantPolicies = $policyStates | Where-Object { $_.PolicyDefinitionId -ne $null } | Select-Object -Unique PolicyDefinitionId

Unfortunately leads to the “false values” mentioned.

0
TheDoessler623
TheDoessler623
1 year ago
Reply to  Dultus, UserMod Light

Hmm ok, maybe I can help later

1
Dultus, UserMod Light
Author
Dultus, UserMod Light
1 year ago

Would of course be optimal.

Thank you.

0