policy assignment great eastern

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Azure Policy assignment structure

• 8 contributors

Policy assignments are used by Azure Policy to define which resources are assigned which policies or initiatives. The policy assignment can determine the values of parameters for that group of resources at assignment time, making it possible to reuse policy definitions that address the same resource properties with different needs for compliance.

For more information on Azure Policy scope, see Understand scope in Azure Policy .

You use JavaScript Object Notation (JSON) to create a policy assignment. The policy assignment contains elements for:

• display name
• description
• resource selectors
• enforcement mode
• excluded scopes
• policy definition
• non-compliance messages

For example, the following JSON shows a policy assignment in DoNotEnforce mode with dynamic parameters:

All Azure Policy samples are at Azure Policy samples .

Display name and description

You use displayName and description to identify the policy assignment and provide context for its use with the specific set of resources. displayName has a maximum length of 128 characters and description a maximum length of 512 characters.

The optional metadata property stores information about the policy assignment. Customers can define any properties and values useful to their organization in metadata . However, there are some common properties used by Azure Policy. Each metadata property has a limit of 1,024 characters.

Common metadata properties

assignedBy (string): The friendly name of the security principal that created the assignment.

createdBy (string): The GUID of the security principal that created the assignment.

createdOn (string): The Universal ISO 8601 DateTime format of the assignment creation time.

parameterScopes (object): A collection of key-value pairs where the key matches a strongType configured parameter name and the value defines the resource scope used in Portal to provide the list of available resources by matching strongType . Portal sets this value if the scope is different than the assignment scope. If set, an edit of the policy assignment in Portal automatically sets the scope for the parameter to this value. However, the scope isn't locked to the value and it can be changed to another scope.

The following example of parameterScopes is for a strongType parameter named backupPolicyId that sets a scope for resource selection when the assignment is edited in the Portal.

updatedBy (string): The friendly name of the security principal that updated the assignment, if any.

updatedOn (string): The Universal ISO 8601 DateTime format of the assignment update time, if any.

evidenceStorages (object): The recommended default storage account that should be used to hold evidence for attestations to policy assignments with a manual effect. The displayName property is the name of the storage account. The evidenceStorageAccountID property is the resource ID of the storage account. The evidenceBlobContainer property is the blob container name in which you plan to store the evidence.

Resource selectors

The optional resourceSelectors property facilitates safe deployment practices (SDP) by enabling you to gradually roll out policy assignments based on factors like resource location, resource type, or whether a resource has a location. When resource selectors are used, Azure Policy will only evaluate resources that are applicable to the specifications made in the resource selectors. Resource selectors can also be used to narrow down the scope of exemptions in the same way.

In the following example scenario, the new policy assignment is evaluated only if the resource's location is either East US or West US .

When you're ready to expand the evaluation scope for your policy, you just have to modify the assignment. The following example shows our policy assignment with two more Azure regions added to the SDPRegions selector. Note, in this example, SDP means to Safe Deployment Practice :

Resource selectors have the following properties:

name : The name of the resource selector.

selectors : (Optional) The property used to determine which subset of resources applicable to the policy assignment should be evaluated for compliance.

kind : The property of a selector that describes which characteristic narrows down the set of evaluated resources. Each kind can only be used once in a single resource selector. Allowed values are:

resourceLocation : This property is used to select resources based on their type. Can't be used in the same resource selector as resourceWithoutLocation .

resourceType : This property is used to select resources based on their type.

resourceWithoutLocation : This property is used to select resources at the subscription level that don't have a location. Currently only supports subscriptionLevelResources . Can't be used in the same resource selector as resourceLocation .

in : The list of allowed values for the specified kind . Can't be used with notIn . Can contain up to 50 values.

notIn : The list of not-allowed values for the specified kind . Can't be used with in . Can contain up to 50 values.

A resource selector can contain multiple selectors . To be applicable to a resource selector, a resource must meet requirements specified by all its selectors. Further, up to 10 resource selectors can be specified in a single assignment. In-scope resources are evaluated when they satisfy any one of these resource selectors.

The optional overrides property allows you to change the effect of a policy definition without modifying the underlying policy definition or using a parameterized effect in the policy definition.

The most common use case for overrides is policy initiatives with a large number of associated policy definitions. In this situation, managing multiple policy effects can consume significant administrative effort, especially when the effect needs to be updated from time to time. Overrides can be used to simultaneously update the effects of multiple policy definitions within an initiative.

Let's take a look at an example. Imagine you have a policy initiative named CostManagement that includes a custom policy definition with policyDefinitionReferenceId corpVMSizePolicy and a single effect of audit . Suppose you want to assign the CostManagement initiative, but don't yet want to see compliance reported for this policy. This policy's 'audit' effect can be replaced by 'disabled' through an override on the initiative assignment, as shown in the following sample:

Overrides have the following properties:

kind : The property the assignment will override. The supported kind is policyEffect .

value : The new value that overrides the existing value. The supported values are effects .

selectors : (Optional) The property used to determine what scope of the policy assignment should take on the override.

kind : The property of a selector that describes what characteristic will narrow down the scope of the override. Allowed value for kind: policyEffect is:

• policyDefinitionReferenceId : This specifies which policy definitions within an initiative assignment should take on the effect override.

Note that one override can be used to replace the effect of many policies by specifying multiple values in the policyDefinitionReferenceId array. A single override can be used for up to 50 policyDefinitionReferenceIds, and a single policy assignment can contain up to 10 overrides, evaluated in the order in which they're specified. Before the assignment is created, the effect chosen in the override is validated against the policy rule and parameter allowed value list (in cases where the effect is parameterized ).

Enforcement mode

The enforcementMode property provides customers the ability to test the outcome of a policy on existing resources without initiating the policy effect or triggering entries in the Azure Activity log .

This scenario is commonly referred to as "What If" and aligns to safe deployment practices. enforcementMode is different from the Disabled effect, as that effect prevents resource evaluation from happening at all.

This property has the following values:

If enforcementMode isn't specified in a policy or initiative definition, the value Default is used. Remediation tasks can be started for deployIfNotExists policies, even when enforcementMode is set to DoNotEnforce .

Excluded scopes

The scope of the assignment includes all child resource containers and child resources. If a child resource container or child resource shouldn't have the definition applied, each can be excluded from evaluation by setting notScopes . This property is an array to enable excluding one or more resource containers or resources from evaluation. notScopes can be added or updated after creation of the initial assignment.

An excluded resource is different from an exempted resource. For more information, see Understand scope in Azure Policy .

Policy definition ID

This field must be the full path name of either a policy definition or an initiative definition. policyDefinitionId is a string and not an array. The latest content of the assigned policy definition or initiative is retrieved each time the policy assignment is evaluated. It's recommended that if multiple policies are often assigned together, to use an initiative instead.

Non-compliance messages

To set a custom message that describes why a resource is non-compliant with the policy or initiative definition, set nonComplianceMessages in the assignment definition. This node is an array of message entries. This custom message is in addition to the default error message for non-compliance and is optional.

Custom messages for non-compliance are only supported on definitions or initiatives with Resource Manager modes definitions.

If the assignment is for an initiative, different messages can be configured for each policy definition in the initiative. The messages use the policyDefinitionReferenceId value configured in the initiative definition. For details, see policy definitions properties .

This segment of the policy assignment provides the values for the parameters defined in the policy definition or initiative definition . This design makes it possible to reuse a policy or initiative definition with different resources, but check for different business values or outcomes.

In this example, the parameters previously defined in the policy definition are prefix and suffix . This particular policy assignment sets prefix to DeptA and suffix to -LC . The same policy definition is reusable with a different set of parameters for a different department, reducing the duplication and complexity of policy definitions while providing flexibility.

For policy assignments with effect set to deployIfNotExist or modify , it's required to have an identity property to do remediation on non-compliant resources. When using identity, the user must also specify a location for the assignment.

A single policy assignment can be associated with only one system- or user-assigned managed identity. However, that identity can be assigned more than one role if necessary.

• Learn about the policy definition structure .
• Understand how to programmatically create policies .
• Learn how to get compliance data .
• Learn how to remediate non-compliant resources .
• Review what a management group is with Organize your resources with Azure management groups .

Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback .

Submit and view feedback for

Additional resources

• Bahasa Indonesia

Great Eastern General Insurance protects your lifestyle and the things you value, both personal and business

Why buying general insurance is the best thing you can do to safeguard your lifestyle

Let us take care of your company and employees while you focus on growing a successful business

Easily compare and identify the cover that’s right for you. Whatever stage of life you’re at

Need someone to give you professional advice? Search for a trustworthy distribution representative here

Popular searches

Your search history

No search history

Customer Services

Browse topics

Let us address your specific needs.

Digital services

Take advantage of our digital services to understand your coverage and carry out policy transactions online.

• Manulife US REIT
• Manulife Investment Management
• Individual Manulife US REIT Manulife Investment Management

Are you looking for:

Assign your policy

Deed of Assignment

Assign your policy to an Individual

DOWNLOAD DEED OF ASSIGNMENT FORM

Assign your policy to a Corporate

DOWNLOAD CORPORATE OWNER CERTIFICATION FORM

DOWNLOAD CORPORATE POLICY OWNER AUTHORISED SIGNATORY FORM

Instructions

When making a transfer of ownership from the Policyowner (Assignor) to another person or company (Assignee), the Assignee will have full control of the policy as if he or she is the Policyowner.  Both the Assignor and Assignee should be 18 years old or older. If the Assignor or Assignee is below 18 years old, please contact our Client Services team at (65) 6833-8188 for assistance.  To perform an Assignment, please complete the  Deed of Assignment Form  and submit it to us with the necessary document(s) requested.

What you need to provide

Please refer to the “Assignment of Policy Checklist” found in the  Deed of Assignment Form .

Can a Deed of Assignment be performed for all policies?   Not all policies are eligible for a Deed of Assignment. Please refer to the “Assignment of Policy Checklist” found in the Deed of Assignment Form for the submission requirements.

SHOW MORE OF "ASSIGN YOUR POLICY"

Show less of "assign your policy", assign your policy to a financial institution.

Assign your policy to a Financial Institution as additional security for a loan.

Other services that we offer

We are always here to help in whatever way we can.

QUICK LINKS

• Goal Selector

MANULIFE INVESTMENT MANAGEMENT

• Individual investors
• Institutional investors
• FAQ | Self-serve & Support | Manulife Singapore
• Complaint Resolution Process
• How to Start with Retirement Planning
• How to Grow My Wealth Through Investment Plans
• How Can I Protect Myself And My Loved Ones Financially Through Life Insurance
• How Health Insurance Can Protect You From High Medical Expenses
• How to Start Building Your Savings Plan

Terms of use

Fair dealing policy

Insurance guides & useful links

Statement of personal data protection

Cybersecurity Advisory

©2020 - 2024 Manulife (Singapore) Pte Ltd

How Jaylen Brown used Luka Dončić to improve: ‘I’m challenging myself to get better’

Back on Jan. 22, the prospect of an NBA Finals between the Boston Celtics and Dallas Mavericks seemed far-fetched at best. The Mavericks, fresh off missing the Play-In Tournament last season, were sitting in eighth place at the time. So it didn’t cause much commotion when Jaylen Brown , after isolating against Luka Dončić in several 1-on-1 situations down the stretch of a Celtics win, followed that up by highlighting the importance of two-way play.

Advertisement

Brown didn’t take a direct verbal shot at Dončić or Kyrie Irving , but left enough room for listeners to wonder if he meant to throw at least a bit of shade at the Mavericks stars. While Dončić and Irving have always been mesmerizing offensive players, their defensive chops have come into question at times throughout the years (though not as much recently during Dallas’ surge). Even if Brown didn’t intend for his words that night to be taken as personal insults, he set the stage for the defensive challenge he wanted to take on deep in the playoffs — and, unknowingly, for what is now a likely finals matchup against Dončić and Irving. Even after dropping Game 4 to the Minnesota Timberwolves on Tuesday night, the Mavericks hold a 3-1 series lead in the Western Conference finals.

“I think we kind of glorify guys who can play one side of the ball but we don’t really pay respect to people who guard and play defense and get deflections and steals and change the game in that area,” Brown said then. “We only glorify the people who can score because that’s what the NBA has marketed. But basketball is both sides and the purity of it is that as I’m challenging myself to get better, I’m challenging myself to be the best that I can on both sides of the ball. And moments like this kind of prepare you for I think the long run. Being able to pick up guys full court, being able to get in guys’ jerseys for long durations of time kind of builds endurance for the playoffs and stuff like that.”

Getting the respect he DESERVES 👏🏾 pic.twitter.com/qkqu6spnGX — Boston Celtics (@celtics) May 28, 2024

Brown, who took on the Dončić assignment in that January game, brought up how he spent some time last season picking up James Harden full court during a playoff series against Philadelphia . At the time, Brown said he wasn’t in the same level of physical shape. He hadn’t fully embraced the challenge of becoming a defensive stopper, either. He took on more of that responsibility this season, asking Celtics coach Joe Mazzulla for the toughest assignments regularly. By the time the January meeting with Dončić and the Mavericks arrived, Brown said it was “normalized” for him to guard an opponent’s best player.

Dončić still racked up a mighty stat line of 33 points, 18 rebounds and 13 assists in the Celtics’ 119-110 win, but needed 30 field goal attempts and 11 free throw attempts to score that much. Brown tallied 34 points on 13-of-24 shooting with nine free-throw attempts. A look at the film showed six of his made field goals came with Dončić as the primary defender, including a pull-up jumper over the five-time All-NBA guard with two minutes left to put the Celtics ahead by double digits. Brown said Boston wanted to put pressure on Dončić and Irving while the Mavericks were on defense.

“I think it makes them tired on the other side,” Brown said. “So just there’s two sides of the ball. Being able to apply pressure on both, you’ve gotta be at a certain level of shape to be able to do that. So we want to put an emphasis on attacking and being aggressive at both sides of the ball.”

Months before the Finals, that statement from Brown might have revealed the Celtics’ strategy for the potential upcoming series. They should want to hunt Irving and Dončić partly because, with the heavy load they carry on offense, fatigue could eventually weigh them down. In the Finals, Brown will likely have a substantial burden himself on both ends of the court. If the Mavericks knock off the Timberwolves, he could be the primary matchup for Dončić as he was back in January. If Brown is, he hinted back then that he will want to pick Dončić up full court. It would be a win for the Celtics if Dončić tires before Brown does.

The Celtics would have other options to defend Dončić and Irving, including Jrue Holiday and Derrick White , who both made second-team all-defense. As great as those guys are defensively, Brown could be the best suited to hold up against Dončić’s combination of size and strength. He spent significant time guarding Dončić during two regular-season games against Dallas. The Celtics won both of those games, but the Mavericks’ defense transformed later in the season. Over their final 20 regular-season games, they ranked first in defensive efficiency while going 16-4. Entering Tuesday, Dallas had a more than respectable 111.4 defensive rating during the postseason.

For Boston, Brown has taken pride in leveling up his defense this season. He has wanted matchups like Dončić. After closing out the Pacers with an Eastern Conference finals sweep, Brown said it hurt him to fall short of an all-defensive team. He believed he deserved that honor for the commitment he put in on that end of the court.

It would probably mean more to Brown to win a championship. Knowing now that the Celtics could very well tangle with the Mavericks for the title, Brown’s postgame comments from that January win are even more interesting in retrospect.

“I think there’s some great two-way players in this game,” Brown said then. “I don’t think it’s a lost art. I think there’s some guys who take it seriously and emphasize both sides of the ball. I just think it’s not as emphasized, it’s not as celebrated, it’s not as recognized amongst everyday fans or casual fans. It’s only about who’s got a bigger bag on offense, who’s a better shot maker. That’s kind of what we pay attention to in today’s time, but guys who can do both, guys who can get stops and then go on the other end and do that, I think those guys are (few and far) between.”

(Photo: Tim Heitman / Getty Images)

Get all-access to exclusive stories.

Subscribe to The Athletic for in-depth coverage of your favorite players, teams, leagues and clubs. Try a week on us.

Jay King is a staff writer for The Athletic covering the Boston Celtics. He previously covered the team for MassLive for five years. He also co-hosts the "Anything Is Poddable" podcast. Follow Jay on Twitter @ byjayking