Share via

Azure policy - how to apply a policy on specific resources

MarcVanderhaegen 306 Reputation points
2026-06-02T07:39:03.2+00:00

Hello,

I would like to test the new CIS Security Benchmarks for Windows Server by deploying the policy but only on a few resources. (arc onboarded machines)
How is this possible ?
In the Basics of the policy assignment, you can choose the scope but you can only select a susbcription and a resource group, you can not select specific resources.
On the contrary, in the Exclusions, you can go down from subscription to specific resources.

So what I try is selecting my resource group and in the exclusion selecting on all the resources from the resource group except my few test machines.

Unfortunately this doesn't work; when selecting Review+Create I get an error message 'The request contant could not be read. Internal Error : request body too large'
I am sure it come from the fact that I have 16836 resources in the exclusions.
Here is a screenshot :
User's image

But even if it was working i would be the right way to do it because if a new resource was added to the resource group it would automatically get the policy as it wouldn't have been added to the exclusions.

So what is the best way to achieve this ?

Thanks for your help

Marc

Azure Policy
Azure Policy

An Azure service that is used to implement corporate governance and standards at scale for Azure resources.

Answer accepted by question author

Bharath Y P 9,645 Reputation points Microsoft External Staff Moderator
2026-06-02T10:43:07.7633333+00:00

Hello MarcVanderhaegen, thank you for your update, Currently, Azure Policy doesn’t support dynamic scoping similar to Azure Update Manager. Policy assignments are based on a static scope model (management group, subscription, resource group, or resource), and dynamic grouping of resources based on filters like tags isn’t supported at assignment time.Azure Update Manager uses a different approach, where scopes can be dynamically evaluated at runtime based on defined criteria, which provides more flexibility for operational tasks such as patching.

Currently, this capability is not available in Azure Policy. Policy assignments are based on a static scope model (management group, subscription, resource group, or individual resource), and dynamic scoping similar to Azure Update Manager is not supported today.

However, your feedback is valid and aligns with a known feature gap, and similar enhancements are being tracked internally.

In the meantime, we encourage you to share this requirement directly with the product team through the Azure Feedback Portal. Your input helps drive product improvements and prioritize new features. You can submit your feedback here: Azure Feedback Portal

Thank you for taking the time to provide this valuable suggestion.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.