How to assign built in policy initiative, like NIST 800-171, in Bicep

[viktarz]

Hello, I am trying to automate compliance policy initiative assignments with Bicep and cannot figure it out.
I was following this doc to create an assignment:
https://docs.microsoft.com/en-us/azure/templates/microsoft.authorization/policyassignments?tabs=bicep

targetScope = 'subscription'

param location string = 'eastUS'
var rgName = 'Demo-RG'

resource mainRg 'Microsoft.Resources/resourceGroups@2021-04-01' = {
  name: rgName
  location: location
}

resource nist 'Microsoft.Authorization/policyAssignments@2021-06-01' = {
  name: '800-171-Bicep'
  scope: mainRg
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    policyDefinitionId: 'NIST SP 800-171 R2'
    displayName: '800-171 Bicep Assigned Policy'
    enforcementMode: 'Default'
    parameters: {
      membersToExcludeInLocalAdministratorsGroup: 'guest'
      membersToIncludeInLocalAdministratorsGroup: 'eAdmin'
      logAnalyticsWorkspaceIDForVMAgents: '999x6x99-9999-XXXX-XX99-99X9999X999X'
    }
  }
}

I am getting multiple errors in parameters and scope, but cannot fine a better guidance or example. My error messages:

• The root resource scope must match that of the Bicep file. To deploy a resource to a different root scope, use a module.
• The property "membersToExcludeInLocalAdministratorsGroup" expected a value of type "ParameterValuesValue" but the provided value is of type "'guest'".
• The property "membersToIncludeInLocalAdministratorsGroup" expected a value of type "ParameterValuesValue" but the provided value is of type "'eAdmin'".
• The property "logAnalyticsWorkspaceIDForVMAgents" expected a value of type "ParameterValuesValue" but the provided value is of type "'999x6x99-9999-XXXX-XX99-99X9999X999X'".

[azMantas]

When assigning a policy I believe that each parameter has to be provided as object, something like

parameters: {
      Param1: {
        value: 'myValue1'
      }
      Param2:{
        Value: 'myValue2'
    }

P.s. As I am on mobile phone I can't test does it work or not, but I think you got an idea;)

[brwilkinson]

I can confirm the above.

Here is some discovery on this topic.

param (
    [ValidateSet(2, 4, 5)]
    [int]$policyVersion = 2,
    
    [string]$policyName = 'NIST SP.+'
)
Get-AzPolicySetDefinition |
    Where-Object { $_.properties.DisplayName -match "$policyName $policyVersion" } |
    ForEach-Object {
        Write-Verbose -Message "$($_.properties.displayName)`n`t$($_.resourceid)" -Verbose
        $params = $_.properties.Parameters
        $params | Get-Member -MemberType NoteProperty | ForEach-Object {
            
            $value = $params.($_.Name)

            [pscustomobject]@{
                Name          = $_.Name
                type          = $value.type
                Allowedvalues = $value.allowedvalues
                Defaultvalues = $value.defaultvalue
                displayName   = $value.metadata.displayName
                deprecated    = $value.metadata.deprecated
                description   = $value.metadata.description
            }
        }
    } | Sort-Object Defaultvalues | Out-GridView

VERBOSE: NIST SP 800-171 Rev. 2
/providers/Microsoft.Authorization/policySetDefinitions/03055927-78bd-4236-86c0-f36125a10dc9

param workspaceId string = '0941c6dd-9ab6-4a99-b1b7-0fd5b2ea6ffe'

param policySetInfo object = {
  name: 'NIST SP 800-171 Rev. 2'
  id: '03055927-78bd-4236-86c0-f36125a10dc9'
}

// targetScope = 'managementGroup'
targetScope = 'subscription'

resource policyAssignment 'Microsoft.Authorization/policyAssignments@2020-09-01' = {
  name: 'policyAssignment-${replace(policySetInfo.name, ' ', '')}'
  properties: {
    displayName: policySetInfo.name
    description: policySetInfo.name
    enforcementMode: 'DoNotEnforce'
    policyDefinitionId: '/providers/Microsoft.Authorization/policySetDefinitions/${policySetInfo.id}'
    parameters: {
      membersToExcludeInLocalAdministratorsGroup: {
        value: 'adtest'
      }
      membersToIncludeInLocalAdministratorsGroup: {
        value: 'adall'
      }
      logAnalyticsWorkspaceIDForVMAgents: {
        value: workspaceId
      }
    }
  }
  scope: subscription()
  location: deployment().location
  identity: {
    type: 'SystemAssigned'
  }
}

output assignment object = policyAssignment

[brwilkinson]

Hi @viktarz were you able to confirm if @azMantas solution works for you?

[viktarz]

Yes, this is great! I was able to assign the policy. Thanks @brwilkinson and @azMantas!