Add support for Identity-based exemptions

[cjtous1]

Is your feature request related to a problem? Please describe.
Announced at Ignite last week and mentioned in this blog: https://techcommunity.microsoft.com/blog/azuregovernanceandmanagementblog/azure-governance--ignite-2025/4471112

Recording of the session where they mention the feature: https://ignite.microsoft.com/en-US/sessions/BRK169

Describe the solution you'd like
Could you please add support for identity-based exemptions in EPAC.
A sample payload is shown in the presentation.

[apybar]

@cjtous1 - We'll get this fast tracked, tested and released asap.

[cjtous1]

@apybar : Any update on this feature? We'd like to try out this feature in our environment.

[apybar]

@cjtous1 - do you have it enrolled in your tenant?

I'm waiting for it to be enabled in my tenant - I requested private preview and still have not received it

[cjtous1]

Well, according to the blog post it is a public preview... So I assumed you did not need to request access to it.

[apybar]

@cjtous1 - Sorry yes it was Public Preview - but I do believe you actually did need to request it. I did it back before Ignite even happened and its been pending for a while now.

Let me look into it and I'll get back to you today.

[apybar]

@cjtous1 - I have no idea what I was doing before. I swear I found either the private preview or maybe it was the public required a sign up - but I was confused.

Regardless...

I was able to successfully create the exemption with the current version of EPAC (v11.0.10)

It already uses the latest preview API for exemption which is needed to make the Identity Based exemptions.

Based on the slide during Ignite that had the example I was able to put it into my exemption.jsonc like this:

{
    "$schema": "https://raw.githubusercontent.com/Azure/enterprise-azure-policy-as-code/main/Schemas/policy-exemption-schema.json",
    "exemptions": [
        {
            "name": "JSON IDENTITY EXEMPTION",
            "displayName": "Descriptive name displayed on portal",
            "description": "More details",
            "exemptionCategory": "Waiver",
            "expiresOn": "",
            "scopes": [
                "/subscriptions/0000-0000-0000-0000"
            ],
            "policyAssignmentId": "/providers/Microsoft.Management/managementGroups/0000-0000-0000-0000/providers/Microsoft.Authorization/policyAssignments/mypolicyID",
            "resourceSelectors": [
                {
                    "name": "AllowedUsers",
                    "selectors": [
                        {
                            "kind": "userPrincipalId",
                            "in": ["0000-0000-0000-0000"]
                        }
                    ]
                }
            ]
        }
    ]
}

And this successfully went through.

However, in the UI, it shows up weird:

I can see the Resource Selector but the UI doesn't support the kind "userPrinciaplId" - also upon testing it against a user I created and who I made the exemption for, I was not able to successfully get around the Azure Policy I made the exemption for.

You're welcome to try it on your end, but for now it looks like its still a work in progress from the product side even being in Public Preview (maybe one of the reasons it was not demo'd)

[apybar]

Also I created the exemption via PowerShell and using REST API commands and same thing. So this isn't an EPAC issue, its the exemption component.

[apybar]

All of the product team is OOO today - once they get back I'll try to ping them and ask if there is something I'm doing wrong or if they have a better ETA of it working as expected. @cjtous1

[cjtous1]

OK, thanks for the update!

[apybar]

@cjtous1 - spoke with some members from the product team today, there is some shifting in roles and responsibilities. Therefore, a bit hard to get a direct answer from someone.

Specifically for the identity exemptions, they said that private preview should be working right now and allow the creation of identity-based exemptions via the API. I told them how I tested and it didn't work and submitted to them access to my tenant to review.

I'll give you a heads up on their response once they look at it.

[cjtous1]

@apybar Just poking, any news from the product team?

[apybar]

@cjtous1 - nope
The quarterly call is next Thursday. I'll bring it up on that call. I think its public if you don't have the invite I can find it for you.